basic test for linktype 228

diff --git a/tests/linktype-228/check.sh b/tests/linktype-228/check.sh
new file mode 100755 (executable)
index 0000000..958b2ff
--- /dev/null
+++ b/tests/linktype-228/check.sh
@@ -0,0 +1,5 @@
+#! /bin/sh
+
+tcp=$(cat output/eve.json | \
+         jq -c 'select(.event_type == "stats") | .stats.decoder.tcp')
+test "${tcp}" = "7"

diff --git a/tests/linktype-228/flow-test-01.pcap b/tests/linktype-228/flow-test-01.pcap
new file mode 100644 (file)
index 0000000..88779e6
Binary files /dev/null and b/tests/linktype-228/flow-test-01.pcap differ