Add NTP test.
diff --git a/tests/TESTLIST b/tests/TESTLIST
index eb7b760..588fa41 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -209,6 +209,9 @@
# NFLOG test case moved to nflog-e.sh
+# NTP tests
+ntp ntp.pcap ntp.out -t -v
+
# syslog test case
syslog-v syslog_udp.pcap syslog-v.out -v
diff --git a/tests/ntp.out b/tests/ntp.out
new file mode 100644
index 0000000..015bee0
--- /dev/null
+++ b/tests/ntp.out
@@ -0,0 +1,91 @@
+1497881530.230949 IP (tos 0x0, ttl 64, id 58037, offset 0, flags [DF], proto UDP (17), length 100)
+ 192.168.100.2.58054 > 192.168.100.1.123: NTPv4, length 72
+ Client, Leap indicator: (0), Stratum 0 (unspecified), poll 0 (1s), precision 32
+ Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec)
+ Reference Timestamp: 0.000000000
+ Originator Timestamp: 0.000000000
+ Receive Timestamp: 0.000000000
+ Transmit Timestamp: 2763234513.007738396 (1987-07-25T21:08:33)
+ Originator - Receive Timestamp: 0.000000000
+ Originator - Transmit Timestamp: 2763234513.007738396 (1987-07-25T21:08:33)
+ Key id: 8
+ Authentication: 57ea530f6d74350cc5286bfec1ab8ca747c73584
+1497881530.231082 IP (tos 0xb8, ttl 64, id 24722, offset 0, flags [DF], proto UDP (17), length 80)
+ 192.168.100.1.123 > 192.168.100.2.58054: NTPv4, length 52
+ Server, Leap indicator: clock unsynchronized (192), Stratum 0 (unspecified), poll 3 (8s), precision -23
+ Root Delay: 0.000000, Root dispersion: 0.001373, Reference-ID: (unspec)
+ Reference Timestamp: 0.000000000
+ Originator Timestamp: 2763234513.007738396 (1987-07-25T21:08:33)
+ Receive Timestamp: 3706870329.516015118 (2017-06-19T14:12:09)
+ Transmit Timestamp: 3706870329.516074047 (2017-06-19T14:12:09)
+ Originator - Receive Timestamp: +943635816.508276721
+ Originator - Transmit Timestamp: +943635816.508335651
+ Key id: 0
+1497881958.494390 IP (tos 0x0, ttl 64, id 5777, offset 0, flags [DF], proto UDP (17), length 100)
+ 192.168.100.2.42818 > 192.168.100.1.123: NTPv4, length 72
+ Client, Leap indicator: (0), Stratum 0 (unspecified), poll 0 (1s), precision 32
+ Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec)
+ Reference Timestamp: 0.000000000
+ Originator Timestamp: 3706870757.473833108 (2017-06-19T14:19:17)
+ Receive Timestamp: 1802554105.693999877 (2093-03-22T03:56:41)
+ Transmit Timestamp: 2929527464.107565978 (1992-10-31T13:37:44)
+ Originator - Receive Timestamp: -1904316651.779833231
+ Originator - Transmit Timestamp: -777343293.366267130
+ Key id: 8
+ Authentication: 8b7e640979156264f3faa5ae979656dd86502431
+1497881958.494589 IP (tos 0x0, ttl 64, id 64601, offset 0, flags [DF], proto UDP (17), length 100)
+ 192.168.100.1.123 > 192.168.100.2.42818: NTPv4, length 72
+ Server, Leap indicator: (0), Stratum 2 (secondary reference), poll 0 (1s), precision -23
+ Root Delay: 0.155502, Root dispersion: 0.001571, Reference-ID: 0x0a051b0a
+ Reference Timestamp: 3706870757.720418353 (2017-06-19T14:19:17)
+ Originator Timestamp: 2929527464.107565978 (1992-10-31T13:37:44)
+ Receive Timestamp: 3706870758.494427815 (2017-06-19T14:19:18)
+ Transmit Timestamp: 3706870758.494546877 (2017-06-19T14:19:18)
+ Originator - Receive Timestamp: +777343294.386861836
+ Originator - Transmit Timestamp: +777343294.386980899
+ Key id: 8
+ Authentication: 629990a7fc22cc8467dd88b7af2d220dbe3287d6
+1497882174.488500 IP (tos 0x0, ttl 64, id 31502, offset 0, flags [DF], proto UDP (17), length 76)
+ 192.168.100.2.53144 > 192.168.100.1.123: NTPv4, length 48
+ Client, Leap indicator: clock unsynchronized (192), Stratum 0 (unspecified), poll 3 (8s), precision -6
+ Root Delay: 1.000000, Root dispersion: 1.000000, Reference-ID: (unspec)
+ Reference Timestamp: 0.000000000
+ Originator Timestamp: 0.000000000
+ Receive Timestamp: 0.000000000
+ Transmit Timestamp: 3706870974.488488492 (2017-06-19T14:22:54)
+ Originator - Receive Timestamp: 0.000000000
+ Originator - Transmit Timestamp: 3706870974.488488492 (2017-06-19T14:22:54)
+1497882174.488761 IP (tos 0x0, ttl 64, id 456, offset 0, flags [DF], proto UDP (17), length 76)
+ 192.168.100.1.123 > 192.168.100.2.53144: NTPv4, length 48
+ Server, Leap indicator: (0), Stratum 2 (secondary reference), poll 3 (8s), precision -23
+ Root Delay: 0.155456, Root dispersion: 0.001007, Reference-ID: 0x0a051b0a
+ Reference Timestamp: 3706870972.021018556 (2017-06-19T14:22:52)
+ Originator Timestamp: 3706870974.488488492 (2017-06-19T14:22:54)
+ Receive Timestamp: 3706870974.488540573 (2017-06-19T14:22:54)
+ Transmit Timestamp: 3706870974.488665335 (2017-06-19T14:22:54)
+ Originator - Receive Timestamp: +0.000052081
+ Originator - Transmit Timestamp: +0.000176842
+1497883632.800853 IP (tos 0xc0, ttl 64, id 4575, offset 0, flags [DF], proto UDP (17), length 96)
+ 192.168.100.2.123 > 192.168.100.1.123: NTPv4, length 68
+ Client, Leap indicator: clock unsynchronized (192), Stratum 0 (unspecified), poll 6 (64s), precision -25
+ Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec)
+ Reference Timestamp: 0.000000000
+ Originator Timestamp: 0.000000000
+ Receive Timestamp: 0.000000000
+ Transmit Timestamp: 3706872432.800841171 (2017-06-19T14:47:12)
+ Originator - Receive Timestamp: 0.000000000
+ Originator - Transmit Timestamp: 3706872432.800841171 (2017-06-19T14:47:12)
+ Key id: 8
+ Authentication: d5378a09c04da845732097104348843a
+1497883632.800979 IP (tos 0xb8, ttl 64, id 6653, offset 0, flags [DF], proto UDP (17), length 96)
+ 192.168.100.1.123 > 192.168.100.2.123: NTPv4, length 68
+ Server, Leap indicator: (0), Stratum 2 (secondary reference), poll 6 (64s), precision -23
+ Root Delay: 0.116577, Root dispersion: 0.001739, Reference-ID: 0x0a0ba0ee
+ Reference Timestamp: 3706872421.265296222 (2017-06-19T14:47:01)
+ Originator Timestamp: 3706872432.800841171 (2017-06-19T14:47:12)
+ Receive Timestamp: 3706872432.799168336 (2017-06-19T14:47:12)
+ Transmit Timestamp: 3706872432.799217265 (2017-06-19T14:47:12)
+ Originator - Receive Timestamp: -0.001672834
+ Originator - Transmit Timestamp: -0.001623905
+ Key id: 8
+ Authentication: a7005b034ca215fedfa0d798db37ae9e
diff --git a/tests/ntp.pcap b/tests/ntp.pcap
new file mode 100644
index 0000000..2fd5937
--- /dev/null
+++ b/tests/ntp.pcap
Binary files differ
