Expected Behavior
-----------------

Please note that there will be no exception-policy output associated with the
``flow`` event for the defrag-memcap, as in the defrag engine logic is run before
flow processing. (Cf ticket #7884 - https://redmine.openinfosecfoundation.org/issues/7884)

Pcap
----

pcap from https://wiki.wireshark.org/SampleCaptures
