diff --git a/testing/btest/Baseline/scripts.base.protocols.dns.wks/dns.log b/testing/btest/Baseline/scripts.base.protocols.dns.wks/dns.log
new file mode 100644
index 0000000000..20c5e818c9
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.protocols.dns.wks/dns.log
@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	dns
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	proto	trans_id	rtt	query	qclass	qclass_name	qtype	qtype_name	rcode	rcode_name	AA	TC	RD	RA	Z	answers	TTLs	rejected	auth	addl
+#types	time	string	addr	port	addr	port	enum	count	interval	string	count	string	count	string	count	string	bool	bool	bool	bool	count	vector[string]	vector[interval]	bool	set[string]	set[string]
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	10.87.3.18	60059	10.87.1.10	53	udp	63119	-	zeek.example.net	1	C_INTERNET	11	WKS	0	NOERROR	F	F	T	F	2	-	-	F	-	-
+#close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/btest/Baseline/scripts.base.protocols.dns.wks/output b/testing/btest/Baseline/scripts.base.protocols.dns.wks/output
new file mode 100644
index 0000000000..49d861c74c
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.protocols.dns.wks/output
@@ -0,0 +1 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
diff --git a/testing/btest/Traces/dns/dns-wks.pcap b/testing/btest/Traces/dns/dns-wks.pcap
new file mode 100644
index 0000000000..b82f5c4f85
Binary files /dev/null and b/testing/btest/Traces/dns/dns-wks.pcap differ
diff --git a/testing/btest/scripts/base/protocols/dns/wks.pcap b/testing/btest/scripts/base/protocols/dns/wks.pcap
new file mode 100644
index 0000000000..826434356d
--- /dev/null
+++ b/testing/btest/scripts/base/protocols/dns/wks.pcap
@@ -0,0 +1,10 @@
+# @TEST-EXEC: zeek -b -C -r $TRACES/dns/dns-wks.pcap %INPUT > output
+# @TEST-EXEC: btest-diff dns.log
+# @TEST-EXEC: btest-diff output
+
+@load policy/protocols/dns/auth-addl
+
+event dns_WKS_reply(c: connection, msg: dns_msg, ans: dns_answer)
+	{
+	print "WKS", dns_msg, dns_answer;
+	}