# @TEST-EXEC: zeek -b -C -r $TRACES/tunnels/gtp/gtp2_different_udp_port.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff http.log
# @TEST-EXEC: btest-diff tunnel.log

# Uplink GTP tunnel uses src port 5906 and dst port 2152.
# One side on port 2152 qualifies for GTP user plane.
# The Downlink GTP tunnel uses port 2152 for both src and dst.
# (checksums are incorrect because packets were anonymized and tcprewrite
# seems to fail to correct the checksums when there's IP fragmentation).
#
@load base/frameworks/tunnels
@load base/protocols/conn
@load base/protocols/http
