OISF · jasonish · Jun 2, 2023 · Jun 12, 2023 · May 22, 2023 · Jan 13, 2023
diff --git a/tests/alert-max/alert-max-20/input.pcap b/tests/alert-max/alert-max-20/input.pcap
diff --git a/tests/alert-max/alert-max-20/test.yaml b/tests/alert-max/alert-max-20/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../../alert-max/alert-max-default/input.pcap
+
 args:
 - -k none
 

diff --git a/tests/alert-testmyids-frames/input.pcap b/tests/alert-testmyids-frames/input.pcap
diff --git a/tests/alert-testmyids-frames/test.yaml b/tests/alert-testmyids-frames/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../flowbit-oring/input.pcap
+
 requires:
   features:
     - HAVE_LIBJANSSON

diff --git a/tests/alert-testmyids/input.pcap b/tests/alert-testmyids/input.pcap
diff --git a/tests/alert-testmyids/test.yaml b/tests/alert-testmyids/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../flowbit-oring/input.pcap
+
 requires:
   features:
     - HAVE_LIBJANSSON

diff --git a/tests/app-layer-template-rust/input.pcap b/tests/app-layer-template-rust/input.pcap
diff --git a/tests/app-layer-template-rust/test.yaml b/tests/app-layer-template-rust/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../app-layer-template/input.pcap
+
 # *** Add configuration here ***
 
 requires:

diff --git a/tests/base64-issue-5223-6/input.pcap b/tests/base64-issue-5223-6/input.pcap
diff --git a/tests/base64-issue-5223-6/test.yaml b/tests/base64-issue-5223-6/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../base64-issue-5223/input.pcap
+
 requires:
   min-version: 6
 

diff --git a/tests/bug-1401-01/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01-TEST1.pcap b/tests/bug-1401-01/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01-TEST1.pcap
diff --git a/tests/bug-1401-01/test.yaml b/tests/bug-1401-01/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../eve-metadata-01-alert/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01-TEST1.pcap
+
 requires:
   features:
     - HAVE_LIBJANSSON

diff --git a/tests/bug-1401-02/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01-TEST1.pcap b/tests/bug-1401-02/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01-TEST1.pcap
diff --git a/tests/bug-1401-02/test.yaml b/tests/bug-1401-02/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../eve-metadata-01-alert/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01-TEST1.pcap
+
 requires:
   features:
     - HAVE_LIBJANSSON

diff --git a/tests/bug-1401-04/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01.pcap b/tests/bug-1401-04/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01.pcap
diff --git a/tests/bug-1401-04/test.yaml b/tests/bug-1401-04/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../bug-1401-03/80000000-037-PTP_Example_IPv4_HTTP_Session-PUBLIC-tp-01.pcap
+
 requires:
   features:
     - HAVE_LIBJANSSON

diff --git a/tests/bug-1450-02/test.yaml b/tests/bug-1450-02/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../bug-1450-05/tls_DER-incomplete-content.pcap
+
 requires:
   features:
     - HAVE_LIBJANSSON

diff --git a/tests/bug-1450-02/tls_DER-incomplete-content.pcap b/tests/bug-1450-02/tls_DER-incomplete-content.pcap
diff --git a/tests/bug-1450-03/test.yaml b/tests/bug-1450-03/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../bug-1450-04/tls_DER-incomplete-header.pcap
+
 requires:
   features:
     - HAVE_LIBJANSSON

diff --git a/tests/bug-1450-03/tls_DER-incomplete-header.pcap b/tests/bug-1450-03/tls_DER-incomplete-header.pcap
diff --git a/tests/bug-2558-01/2008.mp4.pcap b/tests/bug-2558-01/2008.mp4.pcap
diff --git a/tests/bug-2558-01/test.yaml b/tests/bug-2558-01/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../bug-2558-02/2008.mp4.pcap
+
 requires:
   features:
     - HAVE_LIBJANSSON

diff --git a/tests/bug-3616/input.pcap b/tests/bug-3616/input.pcap
diff --git a/tests/bug-3616/test.yaml b/tests/bug-3616/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../bug-3616-ips/input.pcap
+
 requires:
   min-version: 6
 

diff --git a/tests/bug-4199-3/input.pcap b/tests/bug-4199-3/input.pcap
diff --git a/tests/bug-4199-3/test.yaml b/tests/bug-4199-3/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../bug-4199-4/input.pcap
+
 requires:
   min-version: 6
 

diff --git a/tests/bug-4199/input.pcap b/tests/bug-4199/input.pcap
diff --git a/tests/bug-4199/test.yaml b/tests/bug-4199/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../bug-4199-4/input.pcap
+
 requires:
   min-version: 6
 

diff --git a/tests/bug-4394-pdonly-drop/input.pcap b/tests/bug-4394-pdonly-drop/input.pcap
diff --git a/tests/bug-4394-pdonly-drop/test.yaml b/tests/bug-4394-pdonly-drop/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../flowbit-oring/input.pcap
+
 requires:
   features:
     - HAVE_LIBJANSSON

diff --git a/tests/bug-5066-iponly-cidr-ordering-02/test-limit.pcap b/tests/bug-5066-iponly-cidr-ordering-02/test-limit.pcap
diff --git a/tests/bug-5066-iponly-cidr-ordering-02/test.yaml b/tests/bug-5066-iponly-cidr-ordering-02/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../bug-5066-iponly-cidr-ordering-01/test-limit.pcap
+
 requirements:
   min-version: 5
 

diff --git a/tests/bug-5066-iponly-cidr-ordering-03/test-limit.pcap b/tests/bug-5066-iponly-cidr-ordering-03/test-limit.pcap
diff --git a/tests/bug-5066-iponly-cidr-ordering-03/test.yaml b/tests/bug-5066-iponly-cidr-ordering-03/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../bug-5066-iponly-cidr-ordering-01/test-limit.pcap
+
 requirements:
   min-version: 5
 

diff --git a/tests/bug-5066-iponly-cidr-ordering-04/test-limit.pcap b/tests/bug-5066-iponly-cidr-ordering-04/test-limit.pcap
diff --git a/tests/bug-5066-iponly-cidr-ordering-04/test.yaml b/tests/bug-5066-iponly-cidr-ordering-04/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../bug-5066-iponly-cidr-ordering-01/test-limit.pcap
+
 requirements:
   min-version: 5
 

diff --git a/tests/bug-5066-iponly-cidr-ordering-05/test-limit.pcap b/tests/bug-5066-iponly-cidr-ordering-05/test-limit.pcap
diff --git a/tests/bug-5066-iponly-cidr-ordering-05/test.yaml b/tests/bug-5066-iponly-cidr-ordering-05/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../bug-5066-iponly-cidr-ordering-01/test-limit.pcap
+
 requirements:
   min-version: 5
 

diff --git a/tests/bug-5198.v6/input.pcap b/tests/bug-5198.v6/input.pcap
diff --git a/tests/bug-5198.v6/test.yaml b/tests/bug-5198.v6/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../eve-flow-vlan/input.pcap
+
 requires:
   lt-version: 7
   features:

diff --git a/tests/bug-5198/input.pcap b/tests/bug-5198/input.pcap
diff --git a/tests/bug-5198/test.yaml b/tests/bug-5198/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../eve-flow-vlan/input.pcap
+
 requires:
   min-version: 7
   features:

diff --git a/tests/bug-5464-verdict-01/test.yaml b/tests/bug-5464-verdict-01/test.yaml
@@ -5,7 +5,7 @@ requires:
 args:
 - --simulate-ips
 
-pcap:  ../detect-app-layer-protocol-02/input.pcap
+pcap:  ../flowbit-oring/input.pcap
 
 checks:
   - filter:

diff --git a/tests/bug-5464-verdict-02/test.yaml b/tests/bug-5464-verdict-02/test.yaml
@@ -1,7 +1,7 @@
 args:
 - --simulate-ips
 
-pcap:  ../detect-app-layer-protocol-02/input.pcap
+pcap:  ../flowbit-oring/input.pcap
 
 checks:
   - filter:

diff --git a/tests/bug-5464-verdict-04/test.yaml b/tests/bug-5464-verdict-04/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../tls/tls-ja3s/input.pcap
+pcap: ../tls/tls-certs-alert/input.pcap
 
 args:
 - -k none

diff --git a/tests/bug-5780-01-http2-header/http2_multiple_headers.pcap b/tests/bug-5780-01-http2-header/http2_multiple_headers.pcap
diff --git a/tests/bug-5780-01-http2-header/test.yaml b/tests/bug-5780-01-http2-header/test.yaml
@@ -1,3 +1,5 @@
+pcap: ../bug-5929-02/http2_multiple_headers.pcap
+
 requires:
   min-version: 7
 

diff --git a/...tream-exception-policy/exception-policy-ids-midstream-disabled-bypass/README.md b/...tream-exception-policy/exception-policy-ids-midstream-disabled-bypass/README.md
@@ -10,5 +10,5 @@ We expect to see no alerts nor ``http`` events logged, as the flow won't be insp
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...-5825-midstream-exception-policy/exception-policy-ids-midstream-disabled-bypass/test.yaml b/...-5825-midstream-exception-policy/exception-policy-ids-midstream-disabled-bypass/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 args:
 - --set stream.midstream=false

diff --git a/...am-exception-policy/exception-policy-ids-midstream-disabled-drop-flow/README.md b/...am-exception-policy/exception-policy-ids-midstream-disabled-drop-flow/README.md
@@ -11,5 +11,5 @@ exception policy value for the midstream exception policy.
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...25-midstream-exception-policy/exception-policy-ids-midstream-disabled-drop-flow/test.yaml b/...25-midstream-exception-policy/exception-policy-ids-midstream-disabled-drop-flow/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 exit-code: 1
 

diff --git a/...-exception-policy/exception-policy-ids-midstream-disabled-drop-packet/README.md b/...-exception-policy/exception-policy-ids-midstream-disabled-drop-packet/README.md
@@ -11,5 +11,5 @@ exception policy value for the midstream exception policy.
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...-midstream-exception-policy/exception-policy-ids-midstream-disabled-drop-packet/test.yaml b/...-midstream-exception-policy/exception-policy-ids-midstream-disabled-drop-packet/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 requires:
   min-version: 7

diff --git a/...tream-exception-policy/exception-policy-ids-midstream-disabled-ignore/README.md b/...tream-exception-policy/exception-policy-ids-midstream-disabled-ignore/README.md
@@ -10,5 +10,5 @@ We expect to see no alerts nor ``http`` events logged, as the flow won't be insp
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...-5825-midstream-exception-policy/exception-policy-ids-midstream-disabled-ignore/test.yaml b/...-5825-midstream-exception-policy/exception-policy-ids-midstream-disabled-ignore/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 args:
 - --set stream.midstream=false

diff --git a/...am-exception-policy/exception-policy-ids-midstream-disabled-pass-flow/README.md b/...am-exception-policy/exception-policy-ids-midstream-disabled-pass-flow/README.md
@@ -10,5 +10,5 @@ We expect to see no alerts nor ``http`` events logged, as the flow won't be insp
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...25-midstream-exception-policy/exception-policy-ids-midstream-disabled-pass-flow/test.yaml b/...25-midstream-exception-policy/exception-policy-ids-midstream-disabled-pass-flow/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 args:
 - --set stream.midstream=false

diff --git a/...-exception-policy/exception-policy-ids-midstream-disabled-pass-packet/README.md b/...-exception-policy/exception-policy-ids-midstream-disabled-pass-packet/README.md
@@ -11,5 +11,5 @@ exception policy value for the midstream exception policy.
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...-midstream-exception-policy/exception-policy-ids-midstream-disabled-pass-packet/test.yaml b/...-midstream-exception-policy/exception-policy-ids-midstream-disabled-pass-packet/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 exit-code: 1
 

diff --git a/...stream-exception-policy/exception-policy-ids-midstream-enabled-bypass/README.md b/...stream-exception-policy/exception-policy-ids-midstream-enabled-bypass/README.md
@@ -11,5 +11,5 @@ exception policy value when midstream picku-up sessions are enabled.
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...g-5825-midstream-exception-policy/exception-policy-ids-midstream-enabled-bypass/test.yaml b/...g-5825-midstream-exception-policy/exception-policy-ids-midstream-enabled-bypass/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 exit-code: 1
 

diff --git a/...eam-exception-policy/exception-policy-ids-midstream-enabled-drop-flow/README.md b/...eam-exception-policy/exception-policy-ids-midstream-enabled-drop-flow/README.md
@@ -11,5 +11,5 @@ exception policy value.
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...825-midstream-exception-policy/exception-policy-ids-midstream-enabled-drop-flow/test.yaml b/...825-midstream-exception-policy/exception-policy-ids-midstream-enabled-drop-flow/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 exit-code: 1
 

diff --git a/...m-exception-policy/exception-policy-ids-midstream-enabled-drop-packet/README.md b/...m-exception-policy/exception-policy-ids-midstream-enabled-drop-packet/README.md
@@ -11,5 +11,5 @@ exception policy value.
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...5-midstream-exception-policy/exception-policy-ids-midstream-enabled-drop-packet/test.yaml b/...5-midstream-exception-policy/exception-policy-ids-midstream-enabled-drop-packet/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 exit-code: 1
 

diff --git a/...stream-exception-policy/exception-policy-ids-midstream-enabled-ignore/README.md b/...stream-exception-policy/exception-policy-ids-midstream-enabled-ignore/README.md
@@ -11,5 +11,5 @@ be inspected.
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...g-5825-midstream-exception-policy/exception-policy-ids-midstream-enabled-ignore/test.yaml b/...g-5825-midstream-exception-policy/exception-policy-ids-midstream-enabled-ignore/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 args:
 - --set stream.midstream=true

diff --git a/...eam-exception-policy/exception-policy-ids-midstream-enabled-pass-flow/README.md b/...eam-exception-policy/exception-policy-ids-midstream-enabled-pass-flow/README.md
@@ -11,5 +11,5 @@ to see ``http`` events logged, as the flow will be inspected.
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...825-midstream-exception-policy/exception-policy-ids-midstream-enabled-pass-flow/test.yaml b/...825-midstream-exception-policy/exception-policy-ids-midstream-enabled-pass-flow/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 args:
 - --set stream.midstream=true

diff --git a/...m-exception-policy/exception-policy-ids-midstream-enabled-pass-packet/README.md b/...m-exception-policy/exception-policy-ids-midstream-enabled-pass-packet/README.md
@@ -11,5 +11,5 @@ exception policy value for the midstream exception policy.
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...5-midstream-exception-policy/exception-policy-ids-midstream-enabled-pass-packet/test.yaml b/...5-midstream-exception-policy/exception-policy-ids-midstream-enabled-pass-packet/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 exit-code: 1
 

diff --git a/...stream-exception-policy/exception-policy-ids-midstream-enabled-reject/README.md b/...stream-exception-policy/exception-policy-ids-midstream-enabled-reject/README.md
@@ -12,5 +12,5 @@ exception policy value when midstream picku-up sessions are enabled.
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...g-5825-midstream-exception-policy/exception-policy-ids-midstream-enabled-reject/test.yaml b/...g-5825-midstream-exception-policy/exception-policy-ids-midstream-enabled-reject/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 exit-code: 1
 

diff --git a/...tream-exception-policy/exception-policy-ips-midstream-disabled-bypass/README.md b/...tream-exception-policy/exception-policy-ips-midstream-disabled-bypass/README.md
@@ -11,5 +11,5 @@ Flow will be bypassed.
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...-5825-midstream-exception-policy/exception-policy-ips-midstream-disabled-bypass/test.yaml b/...-5825-midstream-exception-policy/exception-policy-ips-midstream-disabled-bypass/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 args:
 - --simulate-ips

diff --git a/...am-exception-policy/exception-policy-ips-midstream-disabled-drop-flow/README.md b/...am-exception-policy/exception-policy-ips-midstream-disabled-drop-flow/README.md
@@ -11,5 +11,5 @@ tracked. The flow should be dropped.
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...25-midstream-exception-policy/exception-policy-ips-midstream-disabled-drop-flow/test.yaml b/...25-midstream-exception-policy/exception-policy-ips-midstream-disabled-drop-flow/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 args:
 - --set stream.midstream=false

diff --git a/...-exception-policy/exception-policy-ips-midstream-disabled-drop-packet/README.md b/...-exception-policy/exception-policy-ips-midstream-disabled-drop-packet/README.md
@@ -11,5 +11,5 @@ exception policy value for the midstream exception policy.
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...-midstream-exception-policy/exception-policy-ips-midstream-disabled-drop-packet/test.yaml b/...-midstream-exception-policy/exception-policy-ips-midstream-disabled-drop-packet/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 exit-code: 1
 

diff --git a/...tream-exception-policy/exception-policy-ips-midstream-disabled-ignore/README.md b/...tream-exception-policy/exception-policy-ips-midstream-disabled-ignore/README.md
@@ -10,5 +10,5 @@ We expect to see no alerts nor ``http`` events logged, as the flow won't be insp
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...-5825-midstream-exception-policy/exception-policy-ips-midstream-disabled-ignore/test.yaml b/...-5825-midstream-exception-policy/exception-policy-ips-midstream-disabled-ignore/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 args:
 - --simulate-ips

diff --git a/...am-exception-policy/exception-policy-ips-midstream-disabled-pass-flow/README.md b/...am-exception-policy/exception-policy-ips-midstream-disabled-pass-flow/README.md
@@ -10,5 +10,5 @@ We expect to see no alerts nor ``http`` events logged, as the flow won't be insp
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
diff --git a/...25-midstream-exception-policy/exception-policy-ips-midstream-disabled-pass-flow/test.yaml b/...25-midstream-exception-policy/exception-policy-ips-midstream-disabled-pass-flow/test.yaml
@@ -1,4 +1,4 @@
-pcap: ../../exception-policy-midstream-03/input.pcap
+pcap: ../../alert-testmyids-midstream5/input.pcap
 
 args:
 - --simulate-ips

diff --git a/...-exception-policy/exception-policy-ips-midstream-disabled-pass-packet/README.md b/...-exception-policy/exception-policy-ips-midstream-disabled-pass-packet/README.md
@@ -12,5 +12,5 @@ exception policy value.
 
 # Pcap
 
-Pcap comes from the test ``exception-policy-midstream-03`` and is the result of a
+Pcap comes from the test ``alert-testmyids-midstream5`` and is the result of a
 curl to www.testmyids.com.
-Original file line number
+Diff line change
@@ -1,3 +1,5 @@
+    pcap: ../../alert-max/alert-max-default/input.pcap
     args:
     - -k none
@@ Expand Down @@