# @TEST-EXEC: zeek -r $TRACES/tunnels/gtp/gtp4_udp_2152_inside.pcap %INPUT >out
# @TEST-EXEC: btest-diff out

# In telecoms there is never a GTP tunnel within another GTP tunnel.
# So if we find inside a GTP tunnel another IP/UDP packet with port 2152,
# it is just a UDP packet, but not another GTP tunnel.

event analyzer_violation_info(tag: AllAnalyzers::Tag, info: AnalyzerViolationInfo)
    {
    print "protocol_violation", info$c$id, info$reason;
    }
