---
- test: "ifconfig eth0 down"
description: "match command with ifconfig"
expect_ids: ["network:bring_down_interface"]
- test: "sudo ifconfig eth0 down"
description: "match command with sudo and ifconfig"
expect_ids: ["network:bring_down_interface"]
- test: "ifconfig ens33 down"
description: "match command with modern interface name"
expect_ids: ["network:bring_down_interface"]
- test: "ifconfig enp0s3 down"
description: "match command with predictable interface name"
expect_ids: ["network:bring_down_interface"]
- test: "ifconfig wlan0 down"
description: "match command with wireless interface"
expect_ids: ["network:bring_down_interface"]
- test: "ip link set eth0 down"
description: "match command with ip link"
expect_ids: ["network:bring_down_interface_ip"]
- test: "sudo ip link set eth0 down"
description: "match command with sudo and ip link"
expect_ids: ["network:bring_down_interface_ip"]
- test: "ip link set ens33 down"
description: "match command with ip link and modern interface name"
expect_ids: ["network:bring_down_interface_ip"]
- test: "ifconfig eth0 up"
description: "should not match up command"
expect_ids: []
- test: "ip link set eth0 up"
description: "should not match up command with ip link"
expect_ids: []
- test: "ip link set eth0 down"
description: "match command with ip link"
expect_ids: ["network:bring_down_interface_ip"]
- test: "sudo ip link set eth0 down"
description: "match command with sudo and ip link"
expect_ids: ["network:bring_down_interface_ip"]
- test: "ip link set ens33 down"
description: "match command with modern interface name"
expect_ids: ["network:bring_down_interface_ip"]
- test: "ip link set enp0s3 down"
description: "match command with predictable interface name"
expect_ids: ["network:bring_down_interface_ip"]
- test: "ip link set eth0 up"
description: "should not match up command"
expect_ids: []
- test: "ip link show eth0"
description: "should not match show command"
expect_ids: []
- test: "iptables -X"
description: "match command"
expect_ids: ["network:delete_custom_chains"]
- test: "sudo iptables -X"
description: "match command with sudo"
expect_ids: ["network:delete_custom_chains"]
- test: "iptables -X CUSTOM_CHAIN"
description: "should not match specific chain"
expect_ids: ["network:delete_custom_chains"]
- test: "iptables -L"
description: "should not match list command"
expect_ids: []
- test: "route del default"
description: "match command"
expect_ids: ["network:delete_default_route"]
- test: "sudo route del default"
description: "match command with sudo"
expect_ids: ["network:delete_default_route"]
- test: "route add default"
description: "should not match add command"
expect_ids: []
- test: "route show"
description: "should not match show command"
expect_ids: []
- test: "ufw disable"
description: "match command"
expect_ids: ["network:disable_firewall"]
- test: "sudo ufw disable"
description: "match command with sudo"
expect_ids: ["network:disable_firewall"]
- test: "ufw enable"
description: "should not match enable command"
expect_ids: []
- test: "ufw status"
description: "should not match status command"
expect_ids: []
- test: "iptables -F"
description: "match command"
expect_ids: ["network:flush_iptables"]
- test: "sudo iptables -F"
description: "match command with sudo"
expect_ids: ["network:flush_iptables"]
- test: "iptables -F INPUT"
description: "should not match specific chain"
expect_ids: ["network:flush_iptables"]
- test: "iptables -L"
description: "should not match list command"
expect_ids: []
- test: "iptables -t nat -F"
description: "match command"
expect_ids: ["network:flush_nat_rules"]
- test: "sudo iptables -t nat -F"
description: "match command with sudo"
expect_ids: ["network:flush_nat_rules"]
- test: "iptables -t nat -F PREROUTING"
description: "should not match specific chain"
expect_ids: ["network:flush_nat_rules"]
- test: "iptables -t nat -L"
description: "should not match list command"
expect_ids: []
- test: "ufw --force reset"
description: "match command"
expect_ids: ["network:force_reset_firewall"]
- test: "sudo ufw --force reset"
description: "match command with sudo"
expect_ids: ["network:force_reset_firewall"]
- test: "ufw reset"
description: "should not match without force flag"
expect_ids: []
- test: "ufw status"
description: "should not match status command"
expect_ids: []
- test: "systemctl stop NetworkManager"
description: "match command"
expect_ids: ["network:stop_network_manager"]
- test: "sudo systemctl stop NetworkManager"
description: "match command with sudo"
expect_ids: ["network:stop_network_manager"]
- test: "systemctl status NetworkManager"
description: "should not match status command"
expect_ids: []
- test: "systemctl restart NetworkManager"
description: "should not match restart command"
expect_ids: []
- test: "systemctl stop networking"
description: "match command"
expect_ids: ["network:stop_networking"]
- test: "sudo systemctl stop networking"
description: "match command with sudo"
expect_ids: ["network:stop_networking"]
- test: "systemctl status networking"
description: "should not match status command"
expect_ids: []
- test: "systemctl restart networking"
description: "should not match restart command"
expect_ids: []
- test: "ufw reset --force"
description: "BUG: --force after reset, not matched"
expect_ids: []
- test: "nft flush ruleset"
description: "match nft flush ruleset"
expect_ids: ["network:flush_nftables"]
- test: "sudo nft flush ruleset"
description: "match nft flush ruleset with sudo"
expect_ids: ["network:flush_nftables"]
- test: "nft flush ruleset"
description: "match nft flush ruleset with extra spaces"
expect_ids: ["network:flush_nftables"]
- test: "nft list ruleset"
description: "negative: nft list should not match"
expect_ids: []
- test: "nft flush chain filter input"
description: "negative: flushing specific chain should not match"
expect_ids: []
- test: "ip route flush table main"
description: "match flush routing table"
expect_ids: ["network:flush_routes"]
- test: "sudo ip route flush table main"
description: "match flush routing table with sudo"
expect_ids: ["network:flush_routes"]
- test: "ip route flush table main"
description: "match flush routing table with extra spaces"
expect_ids: ["network:flush_routes"]
- test: "ip route flush cache"
description: "match flush route cache"
expect_ids: ["network:flush_routes"]
- test: "ip route show"
description: "negative: ip route show should not match"
expect_ids: []
- test: "ip route add default via 192.168.1.1"
description: "negative: ip route add should not match"
expect_ids: []
- test: "ip link set br-abc123 down"
description: "match hyphenated interface name"
expect_ids: ["network:bring_down_interface_ip"]
- test: "ip link set docker0 down"
description: "EDGE: docker bridge interface"
expect_ids: ["network:bring_down_interface_ip"]
- test: "ufw disabled"
description: "negative: 'ufw disabled' should not match - requires word boundary after disable"
expect_ids: []
- test: "ip6tables -F"
description: "match ip6tables flush rules"
expect_ids: ["network:flush_iptables"]