decode: ERSPAN Type I packet parsing

diff --git a/tests/decode-erspan-typeI-01/README.md b/tests/decode-erspan-typeI-01/README.md
new file mode 100644 (file)
index 0000000..772d21f
--- /dev/null
+++ b/tests/decode-erspan-typeI-01/README.md
@@ -0,0 +1 @@
+Ensure ERSPAN Type I packets are decoded

diff --git a/tests/decode-erspan-typeI-01/input.pcap b/tests/decode-erspan-typeI-01/input.pcap
new file mode 100644 (file)
index 0000000..9610750
Binary files /dev/null and b/tests/decode-erspan-typeI-01/input.pcap differ

diff --git a/tests/decode-erspan-typeI-01/test.yaml b/tests/decode-erspan-typeI-01/test.yaml
new file mode 100644 (file)
index 0000000..034442b
--- /dev/null
+++ b/tests/decode-erspan-typeI-01/test.yaml
@@ -0,0 +1,32 @@
+requires:
+
+  min-version: 6.0.0
+
+
+checks:
+
+    - filter:
+        count: 2
+        match:
+            event_type: flow
+
+    - filter:
+        count: 1
+        match:
+            event_type: flow
+            src_ip: 100.95.2.201
+            proto: ICMP
+            vlan: [1011]
+
+    - filter:
+        count: 1
+        match:
+            event_type: flow
+            src_ip: 100.95.3.105
+            proto: ICMP
+            vlan: [999]
+
+    - stats:
+        decoder.ipv4: 84
+        decoder.gre: 42
+        decoder.erspan: 42