diff options
| author | Toni Uhlig <matzeton@googlemail.com> | 2021-09-14 18:19:47 +0200 |
|---|---|---|
| committer | Toni Uhlig <matzeton@googlemail.com> | 2021-09-14 18:19:47 +0200 |
| commit | ea0b04d6482a686e967f8372af606115a3b191a9 (patch) | |
| tree | 74f3654f0790074a06536ec833d52601832a32fd | |
| parent | 6faded3cc7084cb898773dafc1ca9422242f9c81 (diff) | |
bump libnDPI to 0eb7a0388c4549ebbf8cd7a10d398088005cc2de
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
226 files changed, 891 insertions, 693 deletions
diff --git a/libnDPI b/libnDPI -Subproject 6b7e5fa8d251f11c1bae16ea892a43a92b09848 +Subproject 0eb7a0388c4549ebbf8cd7a10d398088005cc2d diff --git a/test/results/1kxun.pcap.out b/test/results/1kxun.pcap.out index 44915fa27..9b39bd925 100644 --- a/test/results/1kxun.pcap.out +++ b/test/results/1kxun.pcap.out @@ -1170,7 +1170,7 @@ ~~ total detected protocols..: 113 ~~ total active/idle flows...: 148/148 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2504668 bytes -~~ total memory freed........: 2504668 bytes -~~ total allocations/frees...: 37271/37271 +~~ total memory allocated....: 2497118 bytes +~~ total memory freed........: 2497118 bytes +~~ total allocations/frees...: 37272/37272 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/443-chrome.pcap.out b/test/results/443-chrome.pcap.out index b40823cb9..631573b9a 100644 --- a/test/results/443-chrome.pcap.out +++ b/test/results/443-chrome.pcap.out @@ -11,7 +11,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1928783 bytes -~~ total memory freed........: 1928783 bytes -~~ total allocations/frees...: 35326/35326 +~~ total memory allocated....: 1929465 bytes +~~ total memory freed........: 1929465 bytes +~~ total allocations/frees...: 35327/35327 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/443-curl.pcap.out b/test/results/443-curl.pcap.out index 28665f1d2..7b9afd386 100644 --- a/test/results/443-curl.pcap.out +++ b/test/results/443-curl.pcap.out @@ -27,7 +27,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1934783 bytes -~~ total memory freed........: 1934783 bytes -~~ total allocations/frees...: 35439/35439 +~~ total memory allocated....: 1935465 bytes +~~ total memory freed........: 1935465 bytes +~~ total allocations/frees...: 35440/35440 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/443-firefox.pcap.out b/test/results/443-firefox.pcap.out index fe4bc7577..95fca9cb0 100644 --- a/test/results/443-firefox.pcap.out +++ b/test/results/443-firefox.pcap.out @@ -27,7 +27,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1951019 bytes -~~ total memory freed........: 1951019 bytes -~~ total allocations/frees...: 35998/35998 +~~ total memory allocated....: 1951701 bytes +~~ total memory freed........: 1951701 bytes +~~ total allocations/frees...: 35999/35999 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/443-git.pcap.out b/test/results/443-git.pcap.out index 370839153..6383ff5d9 100644 --- a/test/results/443-git.pcap.out +++ b/test/results/443-git.pcap.out @@ -27,7 +27,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1937162 bytes -~~ total memory freed........: 1937162 bytes -~~ total allocations/frees...: 35402/35402 +~~ total memory allocated....: 1937844 bytes +~~ total memory freed........: 1937844 bytes +~~ total allocations/frees...: 35403/35403 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/443-opvn.pcap.out b/test/results/443-opvn.pcap.out index fa213cf07..2466cc553 100644 --- a/test/results/443-opvn.pcap.out +++ b/test/results/443-opvn.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1930088 bytes -~~ total memory freed........: 1930088 bytes -~~ total allocations/frees...: 35371/35371 +~~ total memory allocated....: 1930770 bytes +~~ total memory freed........: 1930770 bytes +~~ total allocations/frees...: 35372/35372 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/443-safari.pcap.out b/test/results/443-safari.pcap.out index ff348865f..ea753e3ec 100644 --- a/test/results/443-safari.pcap.out +++ b/test/results/443-safari.pcap.out @@ -27,7 +27,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1932841 bytes -~~ total memory freed........: 1932841 bytes -~~ total allocations/frees...: 35371/35371 +~~ total memory allocated....: 1933523 bytes +~~ total memory freed........: 1933523 bytes +~~ total allocations/frees...: 35372/35372 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/4in4tunnel.pcap.out b/test/results/4in4tunnel.pcap.out index 6c68a93c4..45da5fa46 100644 --- a/test/results/4in4tunnel.pcap.out +++ b/test/results/4in4tunnel.pcap.out @@ -17,7 +17,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/4in6tunnel.pcap.out b/test/results/4in6tunnel.pcap.out index bf7503235..3355b5a8f 100644 --- a/test/results/4in6tunnel.pcap.out +++ b/test/results/4in6tunnel.pcap.out @@ -14,7 +14,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926822 bytes -~~ total memory freed........: 1926822 bytes -~~ total allocations/frees...: 35328/35328 +~~ total memory allocated....: 1927504 bytes +~~ total memory freed........: 1927504 bytes +~~ total allocations/frees...: 35329/35329 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/6in4tunnel.pcap.out b/test/results/6in4tunnel.pcap.out index f4a066cd6..4f2393b53 100644 --- a/test/results/6in4tunnel.pcap.out +++ b/test/results/6in4tunnel.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1930389 bytes -~~ total memory freed........: 1930389 bytes -~~ total allocations/frees...: 35451/35451 +~~ total memory allocated....: 1931071 bytes +~~ total memory freed........: 1931071 bytes +~~ total allocations/frees...: 35452/35452 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/6in6tunnel.pcap.out b/test/results/6in6tunnel.pcap.out index 620af327e..6d27be37f 100644 --- a/test/results/6in6tunnel.pcap.out +++ b/test/results/6in6tunnel.pcap.out @@ -15,7 +15,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929924 bytes -~~ total memory freed........: 1929924 bytes -~~ total allocations/frees...: 35329/35329 +~~ total memory allocated....: 1930550 bytes +~~ total memory freed........: 1930550 bytes +~~ total allocations/frees...: 35330/35330 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/BGP_Cisco_hdlc_slarp.pcap.out b/test/results/BGP_Cisco_hdlc_slarp.pcap.out index 7259a458c..b4763578b 100644 --- a/test/results/BGP_Cisco_hdlc_slarp.pcap.out +++ b/test/results/BGP_Cisco_hdlc_slarp.pcap.out @@ -24,7 +24,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1927112 bytes -~~ total memory freed........: 1927112 bytes -~~ total allocations/frees...: 35338/35338 +~~ total memory allocated....: 1927794 bytes +~~ total memory freed........: 1927794 bytes +~~ total allocations/frees...: 35339/35339 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/BGP_redist.pcap.out b/test/results/BGP_redist.pcap.out index 32f97dd29..4c22c33ba 100644 --- a/test/results/BGP_redist.pcap.out +++ b/test/results/BGP_redist.pcap.out @@ -13,7 +13,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926735 bytes -~~ total memory freed........: 1926735 bytes -~~ total allocations/frees...: 35325/35325 +~~ total memory allocated....: 1927417 bytes +~~ total memory freed........: 1927417 bytes +~~ total allocations/frees...: 35326/35326 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/EAQ.pcap.out b/test/results/EAQ.pcap.out index 731b5e649..6a6e56223 100644 --- a/test/results/EAQ.pcap.out +++ b/test/results/EAQ.pcap.out @@ -516,7 +516,7 @@ ~~ total detected protocols..: 10 ~~ total active/idle flows...: 104/104 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2258000 bytes -~~ total memory freed........: 2258000 bytes -~~ total allocations/frees...: 35836/35836 +~~ total memory allocated....: 2252914 bytes +~~ total memory freed........: 2252914 bytes +~~ total allocations/frees...: 35837/35837 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/IEC104.pcap.out b/test/results/IEC104.pcap.out index fe300791e..28a711209 100644 --- a/test/results/IEC104.pcap.out +++ b/test/results/IEC104.pcap.out @@ -28,7 +28,7 @@ ~~ total detected protocols..: 2 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1930301 bytes -~~ total memory freed........: 1930301 bytes -~~ total allocations/frees...: 35342/35342 +~~ total memory allocated....: 1930927 bytes +~~ total memory freed........: 1930927 bytes +~~ total allocations/frees...: 35343/35343 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/KakaoTalk_chat.pcap.out b/test/results/KakaoTalk_chat.pcap.out index 2571687a9..283821aeb 100644 --- a/test/results/KakaoTalk_chat.pcap.out +++ b/test/results/KakaoTalk_chat.pcap.out @@ -383,7 +383,7 @@ ~~ total detected protocols..: 29 ~~ total active/idle flows...: 39/39 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2170672 bytes -~~ total memory freed........: 2170672 bytes -~~ total allocations/frees...: 35995/35995 +~~ total memory allocated....: 2169226 bytes +~~ total memory freed........: 2169226 bytes +~~ total allocations/frees...: 35996/35996 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/KakaoTalk_talk.pcap.out b/test/results/KakaoTalk_talk.pcap.out index cac1fe46d..87eb91be2 100644 --- a/test/results/KakaoTalk_talk.pcap.out +++ b/test/results/KakaoTalk_talk.pcap.out @@ -231,7 +231,7 @@ ~~ total detected protocols..: 9 ~~ total active/idle flows...: 20/20 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2106560 bytes -~~ total memory freed........: 2106560 bytes -~~ total allocations/frees...: 38602/38602 +~~ total memory allocated....: 2106178 bytes +~~ total memory freed........: 2106178 bytes +~~ total allocations/frees...: 38603/38603 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/NTPv2.pcap.out b/test/results/NTPv2.pcap.out index fa30736b5..ff8049cf1 100644 --- a/test/results/NTPv2.pcap.out +++ b/test/results/NTPv2.pcap.out @@ -1,7 +1,7 @@ 00473{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"NTPv2.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"NTPv2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865383632,"flow_last_seen":0,"flow_min_l4_payload_len":368,"flow_max_l4_payload_len":368,"flow_tot_l4_payload_len":368,"flow_avg_l4_payload_len":368,"midstream":0,"l3_proto":"ip4","src_ip":"208.104.95.10","dst_ip":"78.46.76.2","src_port":123,"dst_port":80,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00883{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"NTPv2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1436865383,"pkt_ts_usec":632810,"pkt_caplen":410,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":410,"pkt_l4_len":376,"pkt":"RIpbLCrSACaIdf8bCABFAAGMHS4AADERoZDQaF8KTi5MAgB7AFABeH6Xlw4DKgAFAEgAAAAAAAAQOgAAAAAAAAGISO9ZbawQDGUAAAABDAIHAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAQZwAAAAAAAADHQLufDawQDGUAAAABuxwHAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQxAAAAAAAAAa6UEgp0qwQDGUAAAABKtoHAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ2AAAAAAAAAWzX1q4C6wQDGUAAAABAFAHAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ2wAAAAAAAAWRR3um9qwQDGUAAAABAFAHAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="} -00568{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"NTPv2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865383632,"flow_last_seen":0,"flow_min_l4_payload_len":368,"flow_max_l4_payload_len":368,"flow_tot_l4_payload_len":368,"flow_avg_l4_payload_len":368,"midstream":0,"l3_proto":"ip4","src_ip":"208.104.95.10","dst_ip":"78.46.76.2","src_port":123,"dst_port":80,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"NTP","breed":"Acceptable","category":"System"}} +00511{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"NTPv2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865383632,"flow_last_seen":0,"flow_min_l4_payload_len":368,"flow_max_l4_payload_len":368,"flow_tot_l4_payload_len":368,"flow_avg_l4_payload_len":368,"midstream":0,"l3_proto":"ip4","src_ip":"208.104.95.10","dst_ip":"78.46.76.2","src_port":123,"dst_port":80,"l4_proto":"udp","ndpi": {"proto":"NTP","breed":"Acceptable","category":"System"}} 00482{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1,"source":"NTPv2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865383632,"flow_last_seen":0,"flow_min_l4_payload_len":368,"flow_max_l4_payload_len":368,"flow_tot_l4_payload_len":368,"flow_avg_l4_payload_len":368,"midstream":0,"l3_proto":"ip4","src_ip":"208.104.95.10","dst_ip":"78.46.76.2","src_port":123,"dst_port":80,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"NTPv2.pcap","alias":"nDPId-test"} ~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ @@ -11,7 +11,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926735 bytes -~~ total memory freed........: 1926735 bytes -~~ total allocations/frees...: 35325/35325 +~~ total memory allocated....: 1927417 bytes +~~ total memory freed........: 1927417 bytes +~~ total allocations/frees...: 35326/35326 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/NTPv3.pcap.out b/test/results/NTPv3.pcap.out index 1b7e1b179..10dff5031 100644 --- a/test/results/NTPv3.pcap.out +++ b/test/results/NTPv3.pcap.out @@ -1,7 +1,7 @@ 00473{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"NTPv3.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"NTPv3.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865405371,"flow_last_seen":0,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"175.144.140.29","dst_ip":"78.46.76.2","src_port":123,"dst_port":80,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"NTPv3.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1436865405,"pkt_ts_usec":371462,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"RIpbLCrSACaIdf8bCABFAABMAABAADcRbcOvkIwdTi5MAgB7AFAAOLcYHAAE+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADZT08RAAAAANlPTxEAAAAA"} -00565{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"NTPv3.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865405371,"flow_last_seen":0,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"175.144.140.29","dst_ip":"78.46.76.2","src_port":123,"dst_port":80,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"NTP","breed":"Acceptable","category":"System"}} +00508{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"NTPv3.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865405371,"flow_last_seen":0,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"175.144.140.29","dst_ip":"78.46.76.2","src_port":123,"dst_port":80,"l4_proto":"udp","ndpi": {"proto":"NTP","breed":"Acceptable","category":"System"}} 00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1,"source":"NTPv3.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865405371,"flow_last_seen":0,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"175.144.140.29","dst_ip":"78.46.76.2","src_port":123,"dst_port":80,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"NTPv3.pcap","alias":"nDPId-test"} ~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ @@ -11,7 +11,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926735 bytes -~~ total memory freed........: 1926735 bytes -~~ total allocations/frees...: 35325/35325 +~~ total memory allocated....: 1927417 bytes +~~ total memory freed........: 1927417 bytes +~~ total allocations/frees...: 35326/35326 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/NTPv4.pcap.out b/test/results/NTPv4.pcap.out index f6195b0e5..ae71b995d 100644 --- a/test/results/NTPv4.pcap.out +++ b/test/results/NTPv4.pcap.out @@ -11,7 +11,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926735 bytes -~~ total memory freed........: 1926735 bytes -~~ total allocations/frees...: 35325/35325 +~~ total memory allocated....: 1927417 bytes +~~ total memory freed........: 1927417 bytes +~~ total allocations/frees...: 35326/35326 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/Oscar.pcap.out b/test/results/Oscar.pcap.out index 80bbdf51c..9b9cb5bcd 100644 --- a/test/results/Oscar.pcap.out +++ b/test/results/Oscar.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1973562 bytes -~~ total memory freed........: 1973562 bytes -~~ total allocations/frees...: 35409/35409 +~~ total memory allocated....: 1962329 bytes +~~ total memory freed........: 1962329 bytes +~~ total allocations/frees...: 35407/35407 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/WebattackRCE.pcap.out b/test/results/WebattackRCE.pcap.out index 801dbf8f7..6da231fe9 100644 --- a/test/results/WebattackRCE.pcap.out +++ b/test/results/WebattackRCE.pcap.out @@ -3195,7 +3195,7 @@ ~~ total detected protocols..: 797 ~~ total active/idle flows...: 797/797 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4546451 bytes -~~ total memory freed........: 4546451 bytes -~~ total allocations/frees...: 40094/40094 +~~ total memory allocated....: 4502557 bytes +~~ total memory freed........: 4502557 bytes +~~ total allocations/frees...: 40095/40095 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/WebattackSQLinj.pcap.out b/test/results/WebattackSQLinj.pcap.out index 6c82d60a6..8c6160009 100644 --- a/test/results/WebattackSQLinj.pcap.out +++ b/test/results/WebattackSQLinj.pcap.out @@ -128,7 +128,7 @@ ~~ total detected protocols..: 9 ~~ total active/idle flows...: 9/9 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1956323 bytes -~~ total memory freed........: 1956323 bytes -~~ total allocations/frees...: 35469/35469 +~~ total memory allocated....: 1956557 bytes +~~ total memory freed........: 1956557 bytes +~~ total allocations/frees...: 35470/35470 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/WebattackXSS.pcap.out b/test/results/WebattackXSS.pcap.out index 1cfe1c7d3..bc692d624 100644 --- a/test/results/WebattackXSS.pcap.out +++ b/test/results/WebattackXSS.pcap.out @@ -6153,7 +6153,7 @@ ~~ total detected protocols..: 22 ~~ total active/idle flows...: 661/661 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4288102 bytes -~~ total memory freed........: 4288102 bytes -~~ total allocations/frees...: 46744/46744 +~~ total memory allocated....: 4251824 bytes +~~ total memory freed........: 4251824 bytes +~~ total allocations/frees...: 46745/46745 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/aimini-http.pcap.out b/test/results/aimini-http.pcap.out index 1409422fd..a65d2ccba 100644 --- a/test/results/aimini-http.pcap.out +++ b/test/results/aimini-http.pcap.out @@ -77,7 +77,7 @@ ~~ total detected protocols..: 4 ~~ total active/idle flows...: 4/4 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1940735 bytes -~~ total memory freed........: 1940735 bytes -~~ total allocations/frees...: 35474/35474 +~~ total memory allocated....: 1941249 bytes +~~ total memory freed........: 1941249 bytes +~~ total allocations/frees...: 35475/35475 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ajp.pcap.out b/test/results/ajp.pcap.out index e28812e72..91c6d0df1 100644 --- a/test/results/ajp.pcap.out +++ b/test/results/ajp.pcap.out @@ -83,7 +83,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/alexa-app.pcapng.out b/test/results/alexa-app.pcapng.out index 6ffbb57f5..dd3a105e8 100644 --- a/test/results/alexa-app.pcapng.out +++ b/test/results/alexa-app.pcapng.out @@ -2203,6 +2203,7 @@ 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3210,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":160,"flow_packet_id":1,"flow_first_seen":1490976196840,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":2707,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00449{"flow_id":160,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3210,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976196,"pkt_ts_usec":840676,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"AMDKkaPvePiC0\/vCCABFAAA\/WmdAAEARM02sECrYrBAqAQqTADUAK8ZJ2BYBAAABAAAAAAAABmZscy1uYQZhbWF6b24DY29tAAABAAE="} 00657{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":3210,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":160,"flow_packet_id":1,"flow_first_seen":1490976196840,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":2707,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Amazon","breed":"Acceptable","category":"Web"},"dns": {"query":"fls-na.amazon.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +01241{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":3228,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":156,"flow_packet_id":255,"flow_first_seen":1490976195984,"flow_last_seen":1490976196843,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":228473,"flow_avg_l4_payload_len":895,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.62.115","src_port":41913,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"images-na.ssl-images-amazon.com","server_names":"images-na.ssl-images-amazon.com,images-eu.ssl-images-amazon.com,images-fe.ssl-images-amazon.com,m.media-amazon.com","ja3":"d551fafc4f40f1dec2bb45980bfa9492","ja3s":"76cc3e2d3028143b23ec18e27dbd7ca9","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=US, ST=Washington, L=Seattle, O=Amazon.com, Inc., CN=Images-na.ssl-images-amazon.com","alpn":"h2,http\/1.1","fingerprint":"39:3D:27:B3:4D:FA:B4:04:AB:48:7F:5C:CB:A9:9A:95:F5:22:2A:52"}} 00468{"flow_id":160,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3347,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976196,"pkt_ts_usec":938799,"pkt_caplen":93,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":93,"pkt_l4_len":59,"pkt":"ePiC0\/vCAMDKkaPvCABFAABP7ApAAEARoZmsECoBrBAq2AA1CpMAO2jR2BaBgAABAAEAAAAABmZscy1uYQZhbWF6b24DY29tAAABAAHADAABAAEAAAA7AARIFc55"} 00683{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":3347,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":160,"flow_packet_id":2,"flow_first_seen":1490976196840,"flow_last_seen":1490976196938,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":2707,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Amazon","breed":"Acceptable","category":"Web"},"dns": {"query":"fls-na.amazon.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"72.21.206.121"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3351,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":161,"flow_packet_id":1,"flow_first_seen":1490976196942,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"72.21.206.121","src_port":47605,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -2286,7 +2287,7 @@ 00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":1490976031581,"flow_last_seen":1490976031687,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":107,"flow_avg_l4_payload_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":41030,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":104,"flow_packet_id":2,"flow_first_seen":1490976107217,"flow_last_seen":1490976107359,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":57,"flow_tot_l4_payload_len":98,"flow_avg_l4_payload_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":14476,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":155,"flow_packet_id":30,"flow_first_seen":1490976195983,"flow_last_seen":1490976196942,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":13938,"flow_avg_l4_payload_len":464,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.62.115","src_port":41912,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":156,"flow_packet_id":350,"flow_first_seen":1490976195984,"flow_last_seen":1490976198040,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":248700,"flow_avg_l4_payload_len":710,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.62.115","src_port":41913,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":156,"flow_packet_id":255,"flow_first_seen":1490976195984,"flow_last_seen":1490976198040,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":228473,"flow_avg_l4_payload_len":895,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.62.115","src_port":41913,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":157,"flow_packet_id":35,"flow_first_seen":1490976195985,"flow_last_seen":1490976196943,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":15782,"flow_avg_l4_payload_len":450,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.62.115","src_port":41914,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":139,"flow_packet_id":2,"flow_first_seen":1490976177026,"flow_last_seen":1490976177105,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":53,"flow_tot_l4_payload_len":90,"flow_avg_l4_payload_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":4312,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1490976027724,"flow_last_seen":1490976027725,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":80,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":10462,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -2377,7 +2378,7 @@ ~~ total detected protocols..: 147 ~~ total active/idle flows...: 162/162 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 3053599 bytes -~~ total memory freed........: 3053599 bytes -~~ total allocations/frees...: 39873/39873 +~~ total memory allocated....: 3026439 bytes +~~ total memory freed........: 3026439 bytes +~~ total allocations/frees...: 39872/39872 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/among_us.pcap.out b/test/results/among_us.pcap.out index a55a7d658..dc3bb409c 100644 --- a/test/results/among_us.pcap.out +++ b/test/results/among_us.pcap.out @@ -11,7 +11,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926735 bytes -~~ total memory freed........: 1926735 bytes -~~ total allocations/frees...: 35325/35325 +~~ total memory allocated....: 1927417 bytes +~~ total memory freed........: 1927417 bytes +~~ total allocations/frees...: 35326/35326 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/amqp.pcap.out b/test/results/amqp.pcap.out index 07b7c26af..c2ef2b536 100644 --- a/test/results/amqp.pcap.out +++ b/test/results/amqp.pcap.out @@ -61,7 +61,7 @@ ~~ total detected protocols..: 3 ~~ total active/idle flows...: 3/3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1943810 bytes -~~ total memory freed........: 1943810 bytes -~~ total allocations/frees...: 35493/35493 +~~ total memory allocated....: 1944380 bytes +~~ total memory freed........: 1944380 bytes +~~ total allocations/frees...: 35494/35494 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/android.pcap.out b/test/results/android.pcap.out index 988b06b5b..5e0c756ee 100644 --- a/test/results/android.pcap.out +++ b/test/results/android.pcap.out @@ -647,7 +647,7 @@ ~~ total detected protocols..: 60 ~~ total active/idle flows...: 67/67 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2358998 bytes -~~ total memory freed........: 2358998 bytes -~~ total allocations/frees...: 36260/36260 +~~ total memory allocated....: 2355984 bytes +~~ total memory freed........: 2355984 bytes +~~ total allocations/frees...: 36261/36261 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/anyconnect-vpn.pcap.out b/test/results/anyconnect-vpn.pcap.out index bdb9a574e..d28605163 100644 --- a/test/results/anyconnect-vpn.pcap.out +++ b/test/results/anyconnect-vpn.pcap.out @@ -623,7 +623,7 @@ ~~ total detected protocols..: 60 ~~ total active/idle flows...: 72/72 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2302896 bytes -~~ total memory freed........: 2302896 bytes -~~ total allocations/frees...: 38582/38582 +~~ total memory allocated....: 2299602 bytes +~~ total memory freed........: 2299602 bytes +~~ total allocations/frees...: 38583/38583 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/anydesk-2.pcap.out b/test/results/anydesk-2.pcap.out index 72a5c23e1..9cf161c71 100644 --- a/test/results/anydesk-2.pcap.out +++ b/test/results/anydesk-2.pcap.out @@ -934,7 +934,7 @@ ~~ total detected protocols..: 4 ~~ total active/idle flows...: 4/4 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2008971 bytes -~~ total memory freed........: 2008971 bytes -~~ total allocations/frees...: 37422/37422 +~~ total memory allocated....: 2009485 bytes +~~ total memory freed........: 2009485 bytes +~~ total allocations/frees...: 37423/37423 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/anydesk.pcap.out b/test/results/anydesk.pcap.out index 5aa2115e7..c5dfd658f 100644 --- a/test/results/anydesk.pcap.out +++ b/test/results/anydesk.pcap.out @@ -27,6 +27,7 @@ 00416{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"anydesk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591342199,"pkt_ts_usec":534956,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AAwplUdeAFBW5dKtCABFAAAoe1oAAIAGRx0zU+7bwKiVgQBQqg9odW6qKaaiQFAQ+vDvJAAAAAAAAAAA"} 00478{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"anydesk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591342199,"pkt_ts_usec":699842,"pkt_caplen":105,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":105,"pkt_l4_len":71,"pkt":"AAwplUdeAFBW5dKtCABFAABbe1sAAIAGRukzU+7bwKiVgQBQqg9odW6qKaaiQFAY+vB2YAAAFAMDAAEBFgMDACi4iiS75ftB9gM9aj9+xuZ4lRQvtRoX8YpGHm1rLD+ZptnwWDmjbYq4"} 00408{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"anydesk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591342199,"pkt_ts_usec":699869,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AFBW5dKtAAwplUdeCABFAAAoCJdAAEAGueDAqJWBM1Pu26oPAFAppqJAaHVu3VAQ+NR4cwAA"} +01149{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":263,"source":"anydesk.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":255,"flow_first_seen":1591342199201,"flow_last_seen":1591342212202,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":126748,"flow_avg_l4_payload_len":497,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.149.129","dst_ip":"51.83.238.219","src_port":43535,"dst_port":80,"l4_proto":"tcp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port","15":"TLS (probably) not carrying HTTPS","24":"SNI TLS extension was missing","30":"Desktop\/File Sharing Session"},"proto":"TLS.AnyDesk","breed":"Acceptable","category":"RemoteAccess"},"tls": {"version":"TLSv1.2","client_requested_server_name":"","ja3":"201999283915cc31cee6b15472ef3332","ja3s":"107030a763c7224285717ff1569a17f3","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","issuerDN":"CN=AnyNet Root CA, O=philandro Software GmbH, C=DE","issuerDN":"C=DE, O=philandro Software GmbH, CN=AnyNet Relay","fingerprint":"9E:08:D2:58:A9:02:CD:4F:E2:4A:26:B8:48:5C:43:0B:81:29:99:E3"}} 00478{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":675,"source":"anydesk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591342214,"pkt_ts_usec":31681,"pkt_caplen":105,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":105,"pkt_l4_len":71,"pkt":"AFBW5dKtAAwplUdeCABFAABbto5AAEAGCwHAqJWBM1PvkI3\/AFB7i56NMVwTIlAY+DR5WwAAFwMDAC7mz9mv7V5oqQRiiK1BmntnBec1wc6utyo8wHetLW4+4vpxLCxi5CGV1lyg9OUE"} 00416{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":676,"source":"anydesk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591342214,"pkt_ts_usec":31959,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AAwplUdeAFBW5dKtCABFAAAofKsAAIAGRRczU++QwKiVgQBQjf8xXBMie4uewFAQ+vBOvAAAAAAAAAAA"} 00480{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":740,"source":"anydesk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591342214,"pkt_ts_usec":255944,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"AAwplUdeAFBW5dKtCABFAABZfM4AAIAGRMMzU++QwKiVgQBQjf8xXBMie4uewFAY+vBbDwAAFwMDACwkrUQuni1bFVh+peWRbnlsLw+6JDYDm31RWqGf060eD0C3WeR2ucetl5\/1QQ=="} @@ -36,7 +37,7 @@ 00481{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3423,"source":"anydesk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591342229,"pkt_ts_usec":454086,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"AAwplUdeAFBW5dKtCABFAABZgw0AAIAGPoQzU++QwKiVgQBQjf8xXBNTe4ue81AY+vB\/XQAAFwMDACwkrUQuni1bFlXQfhlbpM1ompEjuxnWze1GuQIrlqNjGlJEE1Ae4+mTb0GZcg=="} 00558{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":6963,"source":"anydesk.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":1591342198821,"flow_last_seen":1591342244652,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":159,"flow_tot_l4_payload_len":607,"flow_avg_l4_payload_len":30,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.149.129","dst_ip":"51.83.239.144","src_port":36351,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP.AnyDesk","breed":"Acceptable","category":"RemoteAccess"},"http": {}} 00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6963,"source":"anydesk.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":1591342198821,"flow_last_seen":1591342244652,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":159,"flow_tot_l4_payload_len":607,"flow_avg_l4_payload_len":30,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.149.129","dst_ip":"51.83.239.144","src_port":36351,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6963,"source":"anydesk.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":6943,"flow_first_seen":1591342199201,"flow_last_seen":1591342255171,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":2417415,"flow_avg_l4_payload_len":348,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.149.129","dst_ip":"51.83.238.219","src_port":43535,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6963,"source":"anydesk.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":255,"flow_first_seen":1591342199201,"flow_last_seen":1591342255171,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":126748,"flow_avg_l4_payload_len":497,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.149.129","dst_ip":"51.83.238.219","src_port":43535,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":6963,"source":"anydesk.pcap","alias":"nDPId-test"} ~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ ~~ packets captured/processed: 6963/6963 @@ -45,7 +46,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2149668 bytes -~~ total memory freed........: 2149668 bytes +~~ total memory allocated....: 2146168 bytes +~~ total memory freed........: 2146168 bytes ~~ total allocations/frees...: 42298/42298 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/avast_securedns.pcapng.out b/test/results/avast_securedns.pcapng.out index d545a2b84..d09b46400 100644 --- a/test/results/avast_securedns.pcapng.out +++ b/test/results/avast_securedns.pcapng.out @@ -201,7 +201,7 @@ ~~ total detected protocols..: 39 ~~ total active/idle flows...: 39/39 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2049019 bytes -~~ total memory freed........: 2049019 bytes -~~ total allocations/frees...: 35515/35515 +~~ total memory allocated....: 2047573 bytes +~~ total memory freed........: 2047573 bytes +~~ total allocations/frees...: 35516/35516 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/bad-dns-traffic.pcap.out b/test/results/bad-dns-traffic.pcap.out index 412d088dc..485221334 100644 --- a/test/results/bad-dns-traffic.pcap.out +++ b/test/results/bad-dns-traffic.pcap.out @@ -76,7 +76,7 @@ ~~ total detected protocols..: 3 ~~ total active/idle flows...: 3/3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1944104 bytes -~~ total memory freed........: 1944104 bytes -~~ total allocations/frees...: 35712/35712 +~~ total memory allocated....: 1944674 bytes +~~ total memory freed........: 1944674 bytes +~~ total allocations/frees...: 35713/35713 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/badpackets.pcap.out b/test/results/badpackets.pcap.out index b5cb639a1..08cb321b7 100644 --- a/test/results/badpackets.pcap.out +++ b/test/results/badpackets.pcap.out @@ -207,7 +207,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/bitcoin.pcap.out b/test/results/bitcoin.pcap.out index 55a306665..8089969bf 100644 --- a/test/results/bitcoin.pcap.out +++ b/test/results/bitcoin.pcap.out @@ -115,7 +115,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 6/6 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 6144439 bytes -~~ total memory freed........: 6144439 bytes -~~ total allocations/frees...: 36153/36153 +~~ total memory allocated....: 3075191 bytes +~~ total memory freed........: 3075191 bytes +~~ total allocations/frees...: 36055/36055 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/bittorrent.pcap.out b/test/results/bittorrent.pcap.out index 8bbc0fba4..1abecb902 100644 --- a/test/results/bittorrent.pcap.out +++ b/test/results/bittorrent.pcap.out @@ -186,7 +186,7 @@ ~~ total detected protocols..: 25 ~~ total active/idle flows...: 25/25 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2058321 bytes -~~ total memory freed........: 2058321 bytes -~~ total allocations/frees...: 35718/35718 +~~ total memory allocated....: 2057659 bytes +~~ total memory freed........: 2057659 bytes +~~ total allocations/frees...: 35719/35719 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/bittorrent_ip.pcap.out b/test/results/bittorrent_ip.pcap.out index cf5645616..528c47a6d 100644 --- a/test/results/bittorrent_ip.pcap.out +++ b/test/results/bittorrent_ip.pcap.out @@ -44,7 +44,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 3363389 bytes -~~ total memory freed........: 3363389 bytes -~~ total allocations/frees...: 35860/35860 +~~ total memory allocated....: 2222860 bytes +~~ total memory freed........: 2222860 bytes +~~ total allocations/frees...: 35834/35834 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/bittorrent_utp.pcap.out b/test/results/bittorrent_utp.pcap.out index e179a0e72..c32f2ec76 100644 --- a/test/results/bittorrent_utp.pcap.out +++ b/test/results/bittorrent_utp.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929200 bytes -~~ total memory freed........: 1929200 bytes -~~ total allocations/frees...: 35410/35410 +~~ total memory allocated....: 1929882 bytes +~~ total memory freed........: 1929882 bytes +~~ total allocations/frees...: 35411/35411 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/bt_search.pcap.out b/test/results/bt_search.pcap.out index 0a39dfa57..d1854e61a 100644 --- a/test/results/bt_search.pcap.out +++ b/test/results/bt_search.pcap.out @@ -15,7 +15,7 @@ ~~ total detected protocols..: 2 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929924 bytes -~~ total memory freed........: 1929924 bytes -~~ total allocations/frees...: 35329/35329 +~~ total memory allocated....: 1930550 bytes +~~ total memory freed........: 1930550 bytes +~~ total allocations/frees...: 35330/35330 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/capwap.pcap.out b/test/results/capwap.pcap.out index 9d7b3eba8..6ee355158 100644 --- a/test/results/capwap.pcap.out +++ b/test/results/capwap.pcap.out @@ -77,7 +77,7 @@ ~~ total detected protocols..: 5 ~~ total active/idle flows...: 5/5 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1950859 bytes -~~ total memory freed........: 1950859 bytes -~~ total allocations/frees...: 35733/35733 +~~ total memory allocated....: 1951317 bytes +~~ total memory freed........: 1951317 bytes +~~ total allocations/frees...: 35734/35734 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/cassandra.pcap.out b/test/results/cassandra.pcap.out new file mode 100644 index 000000000..b52232621 --- /dev/null +++ b/test/results/cassandra.pcap.out @@ -0,0 +1,49 @@ +00477{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"cassandra.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} +00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"cassandra.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1450889498032,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":46536,"dst_port":9042,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00437{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":32587,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AAAAAAAAAAAAAAAACABFAAA86nRAAEAGUkV\/AAABfwAAAbXII1K9tHk3AAAAAKACqqr+MAAAAgT\/1wQCCAon7JNDAAAAAAEDAwc="} +00437{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":32598,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AAAAAAAAAAAAAAAACABFAAA8AABAAEAGPLp\/AAABfwAAASNStcjswQ7evbR5OKASqqr+MAAAAgT\/1wQCCAon7JNDJ+yTQwEDAwc="} +00424{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":32606,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAAAAAAAAAAAAAACABFAAA06nVAAEAGUkx\/AAABfwAAAbXII1K9tHk47MEO34AQAVb+KAAAAQEICifsk0Mn7JND"} +00436{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":32855,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"AAAAAAAAAAAAAAAACABFAAA96nZAAEAGUkJ\/AAABfwAAAbXII1K9tHk47MEO34AYAVb+MQAAAQEICifsk0Mn7JNDBAAAAAUAAAAA"} +00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"cassandra.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1450889498032,"flow_last_seen":1450889498032,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":9,"flow_tot_l4_payload_len":9,"flow_avg_l4_payload_len":2,"midstream":0,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":46536,"dst_port":9042,"l4_proto":"tcp","ndpi": {"proto":"Cassandra","breed":"Acceptable","category":"Database"}} +00424{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":32862,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAAAAAAAAAAAAAACABFAAA0nZxAAEAGnyV\/AAABfwAAASNStcjswQ7fvbR5QYAQAVb+KAAAAQEICifsk0Mn7JND"} +00510{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":38534,"pkt_caplen":127,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":127,"pkt_l4_len":93,"pkt":"AAAAAAAAAAAAAAAACABFAABxnZ1AAEAGnud\/AAABfwAAASNStcjswQ7fvbR5QYAYAVb+ZQAAAQEICifsk0kn7JNDhAAAAAYAAAA0AAIAC0NPTVBSRVNTSU9OAAIABnNuYXBweQADbHo0AAtDUUxfVkVSU0lPTgABAAUzLjMuMQ=="} +00424{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":38541,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAAAAAAAAAAAAAACABFAAA06ndAAEAGUkp\/AAABfwAAAbXII1K9tHlB7MEPHIAQAVb+KAAAAQEICifsk0kn7JNJ"} +00468{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":38774,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":97,"pkt_l4_len":63,"pkt":"AAAAAAAAAAAAAAAACABFAABT6nhAAEAGUip\/AAABfwAAAbXII1K9tHlB7MEPHIAYAVb+RwAAAQEICifsk0kn7JNJBAAAAQEAAAAWAAEAC0NRTF9WRVJTSU9OAAUzLjMuMQ=="} +00436{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":39154,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"AAAAAAAAAAAAAAAACABFAAA9nZ5AAEAGnxp\/AAABfwAAASNStcjswQ8cvbR5YIAYAVb+MQAAAQEICifsk0kn7JNJhAAAAQIAAAAA"} +00508{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":40307,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":124,"pkt_l4_len":90,"pkt":"AAAAAAAAAAAAAAAACABFAABu6nlAAEAGUg5\/AAABfwAAAbXII1K9tHlg7MEPJYAYAVb+YgAAAQEICifsk0on7JNJBAAAAgsAAAAxAAMAD1RPUE9MT0dZX0NIQU5HRQANU1RBVFVTX0NIQU5HRQANU0NIRU1BX0NIQU5HRQ=="} +00438{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":40747,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"AAAAAAAAAAAAAAAACABFAAA9nZ9AAEAGnxl\/AAABfwAAASNStcjswQ8lvbR5moAYAVb+MQAAAQEICifsk0sn7JNKhAAAAgIAAAAA"} +00565{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":41938,"pkt_caplen":167,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":167,"pkt_l4_len":133,"pkt":"AAAAAAAAAAAAAAAACABFAACZ6npAAEAGUeJ\/AAABfwAAAbXII1K9tHma7MEPLoAYAVb+jQAAAQEICifsk0wn7JNLBAAAAwcAAABcAAAAVVNFTEVDVCBwZWVyLCBkYXRhX2NlbnRlciwgcmFjaywgdG9rZW5zLCBycGNfYWRkcmVzcywgc2NoZW1hX3ZlcnNpb24gRlJPTSBzeXN0ZW0ucGVlcnMAAQA="} +00586{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":43065,"pkt_caplen":182,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":182,"pkt_l4_len":148,"pkt":"AAAAAAAAAAAAAAAACABFAAConaBAAEAGnq1\/AAABfwAAASNStcjswQ8uvbR5\/4AYAVb+nAAAAQEICifsk00n7JNMhAAAAwgAAABrAAAAAgAAAAEAAAAGAAZzeXN0ZW0ABXBlZXJzAARwZWVyABAAC2RhdGFfY2VudGVyAA0ABHJhY2sADQAGdG9rZW5zACIADQALcnBjX2FkZHJlc3MAEAAOc2NoZW1hX3ZlcnNpb24ADAAAAAA="} +00602{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":43074,"pkt_caplen":193,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":193,"pkt_l4_len":159,"pkt":"AAAAAAAAAAAAAAAACABFAACz6ntAAEAGUcd\/AAABfwAAAbXII1K9tHn\/7MEPooAYAVb+pwAAAQEICifsk00n7JNNBAAABAcAAAB2AAAAb1NFTEVDVCBjbHVzdGVyX25hbWUsIGRhdGFfY2VudGVyLCByYWNrLCB0b2tlbnMsIHBhcnRpdGlvbmVyLCBzY2hlbWFfdmVyc2lvbiBGUk9NIHN5c3RlbS5sb2NhbCBXSEVSRSBrZXk9J2xvY2FsJwABAA=="} +00337{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":46559,"pkt_caplen":11145,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":11145,"pkt_l4_len":11111} +00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":26,"source":"cassandra.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1450889498074,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":46537,"dst_port":9042,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00438{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":26,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":74112,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AAAAAAAAAAAAAAAACABFAAA81IRAAEAGaDV\/AAABfwAAAbXJI1KmXkfoAAAAAKACqqr+MAAAAgT\/1wQCCAon7JNsAAAAAAEDAwc="} +00438{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":27,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":74125,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AAAAAAAAAAAAAAAACABFAAA8AABAAEAGPLp\/AAABfwAAASNStckXl5aGpl5H6aASqqr+MAAAAgT\/1wQCCAon7JNsJ+yTbAEDAwc="} +00425{"flow_id":2,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":28,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":74133,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAAAAAAAAAAAAAACABFAAA01IVAAEAGaDx\/AAABfwAAAbXJI1KmXkfpF5eWh4AQAVb+KAAAAQEICifsk2wn7JNs"} +00437{"flow_id":2,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":29,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":74804,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"AAAAAAAAAAAAAAAACABFAAA91IZAAEAGaDJ\/AAABfwAAAbXJI1KmXkfpF5eWh4AYAVb+MQAAAQEICifsk20n7JNsBAAAAAUAAAAA"} +00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":29,"source":"cassandra.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":1450889498074,"flow_last_seen":1450889498074,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":9,"flow_tot_l4_payload_len":9,"flow_avg_l4_payload_len":2,"midstream":0,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":46537,"dst_port":9042,"l4_proto":"tcp","ndpi": {"proto":"Cassandra","breed":"Acceptable","category":"Database"}} +00425{"flow_id":2,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":30,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":74813,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAAAAAAAAAAAAAACABFAAA0BetAAEAGNtd\/AAABfwAAASNStckXl5aHpl5H8oAQAVb+KAAAAQEICifsk20n7JNt"} +00511{"flow_id":2,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":31,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":80104,"pkt_caplen":127,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":127,"pkt_l4_len":93,"pkt":"AAAAAAAAAAAAAAAACABFAABxBexAAEAGNpl\/AAABfwAAASNStckXl5aHpl5H8oAYAVb+ZQAAAQEICifsk3In7JNthAAAAAYAAAA0AAIAC0NPTVBSRVNTSU9OAAIABnNuYXBweQADbHo0AAtDUUxfVkVSU0lPTgABAAUzLjMuMQ=="} +00425{"flow_id":2,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":32,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":80119,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAAAAAAAAAAAAAACABFAAA01IdAAEAGaDp\/AAABfwAAAbXJI1KmXkfyF5eWxIAQAVb+KAAAAQEICifsk3In7JNy"} +00469{"flow_id":2,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":33,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":80407,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":97,"pkt_l4_len":63,"pkt":"AAAAAAAAAAAAAAAACABFAABT1IhAAEAGaBp\/AAABfwAAAbXJI1KmXkfyF5eWxIAYAVb+RwAAAQEICifsk3In7JNyBAAAAQEAAAAWAAEAC0NRTF9WRVJTSU9OAAUzLjMuMQ=="} +00437{"flow_id":2,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":80853,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"AAAAAAAAAAAAAAAACABFAAA9Be1AAEAGNsx\/AAABfwAAASNStckXl5bEpl5IEYAYAVb+MQAAAQEICifsk3Mn7JNyhAAAAQIAAAAA"} +00529{"flow_id":2,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":35,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":82067,"pkt_caplen":140,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":140,"pkt_l4_len":106,"pkt":"AAAAAAAAAAAAAAAACABFAAB+1IlAAEAGZ+5\/AAABfwAAAbXJI1KmXkgRF5eWzYAYAVb+cgAAAQEICifsk3Qn7JNzBAAAAgcAAABBAAAALnNlbGVjdCAqIGZyb20gc3lzdGVtLmxvY2FsIHdoZXJlIGtleSA9ICdsb2NhbCcAASQAABOIAAUnk4kkONg="} +00337{"flow_id":2,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":36,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":85390,"pkt_caplen":11512,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":11512,"pkt_l4_len":11478} +00426{"flow_id":2,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":37,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889498,"pkt_ts_usec":85441,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAAAAAAAAAAAAAACABFAAA01IpAAEAGaDd\/AAABfwAAAbXJI1KmXkhbF5fDg4AQBVX+KAAAAQEICifsk3gn7JN3"} +00610{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":38,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889523,"pkt_ts_usec":982509,"pkt_caplen":201,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":201,"pkt_l4_len":167,"pkt":"AAAAAAAAAAAAAAAACABFAAC71ItAAEAGZ69\/AAABfwAAAbXJI1KmXkhbF5fDg4AYBVX+rwAAAQEICifs+KEn7JN3BAAAAwcAAAB+AAAAaUNSRUFURSBLRVlTUEFDRSB0ZXN0X2tleXNwYWNlIFdJVEggUkVQTElDQVRJT04gPSB7ICdjbGFzcycgOiAnU2ltcGxlU3RyYXRlZ3knLCAncmVwbGljYXRpb25fZmFjdG9yJzogMiB9OwABNAAAAGQACAAFJ5OKr29U"} +00426{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":40,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889524,"pkt_ts_usec":22451,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAAAAAAAAAAAAAACABFAAA0Be9AAEAGNtN\/AAABfwAAASNStckXl8ODpl5I4oAQAV7+KAAAAQEICifs+Mkn7Pih"} +00492{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":41,"source":"cassandra.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1450889524,"pkt_ts_usec":28482,"pkt_caplen":113,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":113,"pkt_l4_len":79,"pkt":"AAAAAAAAAAAAAAAACABFAABjBfBAAEAGNqN\/AAABfwAAASNStckXl8ODpl5I4oAYAV7+VwAAAQEICifs+M8n7PihhAAAAwgAAAAmAAAABQAHQ1JFQVRFRAAIS0VZU1BBQ0UADXRlc3Rfa2V5c3BhY2U="} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":286,"source":"cassandra.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":144,"flow_first_seen":1450889498032,"flow_last_seen":1450889698077,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":25148,"flow_tot_l4_payload_len":78224,"flow_avg_l4_payload_len":543,"midstream":0,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":46536,"dst_port":9042,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":286,"source":"cassandra.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":142,"flow_first_seen":1450889498074,"flow_last_seen":1450889698077,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":11446,"flow_tot_l4_payload_len":28884,"flow_avg_l4_payload_len":203,"midstream":0,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":46537,"dst_port":9042,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":286,"source":"cassandra.pcap","alias":"nDPId-test"} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 286/286 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 116292 bytes +~~ total detected protocols..: 2 +~~ total active/idle flows...: 2/2 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 1938786 bytes +~~ total memory freed........: 1938786 bytes +~~ total allocations/frees...: 35614/35614 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/check_mk_new.pcap.out b/test/results/check_mk_new.pcap.out index 27de8e029..a08810748 100644 --- a/test/results/check_mk_new.pcap.out +++ b/test/results/check_mk_new.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929548 bytes -~~ total memory freed........: 1929548 bytes -~~ total allocations/frees...: 35422/35422 +~~ total memory allocated....: 1930230 bytes +~~ total memory freed........: 1930230 bytes +~~ total allocations/frees...: 35423/35423 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/chrome.pcap.out b/test/results/chrome.pcap.out index 260267ea0..7fd4b421d 100644 --- a/test/results/chrome.pcap.out +++ b/test/results/chrome.pcap.out @@ -107,13 +107,17 @@ 00426{"flow_id":5,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":229,"source":"chrome.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620902509,"pkt_ts_usec":370352,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0neZAADQGGkGSMDoSwKgBsgG7+5p\/iBkRd\/ScG4AQAfobUAAAAQEICjqbGxAzdJe3"} 00426{"flow_id":5,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":232,"source":"chrome.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620902509,"pkt_ts_usec":370468,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0nedAADQGGkCSMDoSwKgBsgG7+5p\/iBkRd\/Se3YAQAfUYkgAAAQEICjqbGxEzdJe3"} 00846{"flow_id":5,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":233,"source":"chrome.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620902509,"pkt_ts_usec":370585,"pkt_caplen":369,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":369,"pkt_l4_len":335,"pkt":"KDc3AG3IEBMx8Tl2CABFAAFjnehAADQGGRCSMDoSwKgBsgG7+5p\/iBkRd\/Se3YAYAfV9JAAAAQEICjqbGxEzdJe3FwMDASqAJRG6bgsbTW0tWRsjRYVGzw9H6gvxErz3e5D\/27VNhWASbt\/0PEltptiu389fTERtuCmmRusUQRw8btYWhKKYy6KckWYkE+6x\/7q4R9bYW0ih6KOhgAi\/cH2GADtxZ6ussAdlzyCJlkjv+vazlqpZeq0Jhjf7+nUOmgwRazjst\/FtIcJfUh634Oav0SiiDA1ZlevmBcX354z7M2\/nSm95\/mVD8ytZN\/0pg6jP98N1XAoBQ+41y58S1q6k3m51Oh4K8wBd383AO\/6iqnSKmamyeg\/2agMRVBw4Dict381VYLjIcmwAvXnTzAnSXsAWFAcfriAwwIE0Vpus4qeP9P6h9YA2N7BkX2vWZR4jWt14ppy\/8G\/8PaR2YFFWOgV\/gVOc3pC93ZzIIfIK"} +00832{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":658,"source":"chrome.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":255,"flow_first_seen":1620902509276,"flow_last_seen":1620902509468,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":196675,"flow_avg_l4_payload_len":771,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64411,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"www.iit.cnr.it","ja3":"aa50c12a5dfa717d9d6ab34e97de79d5","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} +00833{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1637,"source":"chrome.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":255,"flow_first_seen":1620902508740,"flow_last_seen":1620902509575,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":194049,"flow_avg_l4_payload_len":760,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64394,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"www.iit.cnr.it","ja3":"1b73862eae8f1711440a446b1ef357fd","ja3s":"2253c82f03b621c5144709b393fde2c9","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} 00833{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1958,"source":"chrome.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":255,"flow_first_seen":1620902509274,"flow_last_seen":1620902509612,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":214304,"flow_avg_l4_payload_len":840,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64410,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"www.iit.cnr.it","ja3":"aa50c12a5dfa717d9d6ab34e97de79d5","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} +00833{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2039,"source":"chrome.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":255,"flow_first_seen":1620902509273,"flow_last_seen":1620902509621,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":209480,"flow_avg_l4_payload_len":821,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64409,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"www.iit.cnr.it","ja3":"1b73862eae8f1711440a446b1ef357fd","ja3s":"2253c82f03b621c5144709b393fde2c9","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} +00833{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":3132,"source":"chrome.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":255,"flow_first_seen":1620902509272,"flow_last_seen":1620902509764,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":206438,"flow_avg_l4_payload_len":809,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64408,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"www.iit.cnr.it","ja3":"1b73862eae8f1711440a446b1ef357fd","ja3s":"2253c82f03b621c5144709b393fde2c9","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} 00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":5633,"source":"chrome.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":862,"flow_first_seen":1620902507870,"flow_last_seen":1620902514626,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":687973,"flow_avg_l4_payload_len":798,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64393,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00507{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":5633,"source":"chrome.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1134,"flow_first_seen":1620902508740,"flow_last_seen":1620902515037,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":930115,"flow_avg_l4_payload_len":820,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64394,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":5633,"source":"chrome.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":376,"flow_first_seen":1620902509272,"flow_last_seen":1620902515049,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":297726,"flow_avg_l4_payload_len":791,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64408,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":5633,"source":"chrome.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":956,"flow_first_seen":1620902509273,"flow_last_seen":1620902515019,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":773272,"flow_avg_l4_payload_len":808,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64409,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":5633,"source":"chrome.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":255,"flow_first_seen":1620902508740,"flow_last_seen":1620902515037,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":194049,"flow_avg_l4_payload_len":760,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64394,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":5633,"source":"chrome.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":255,"flow_first_seen":1620902509272,"flow_last_seen":1620902515049,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":206438,"flow_avg_l4_payload_len":809,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64408,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":5633,"source":"chrome.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":255,"flow_first_seen":1620902509273,"flow_last_seen":1620902515019,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":209480,"flow_avg_l4_payload_len":821,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64409,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":5633,"source":"chrome.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":255,"flow_first_seen":1620902509274,"flow_last_seen":1620902515040,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":214304,"flow_avg_l4_payload_len":840,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64410,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00508{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":5633,"source":"chrome.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1199,"flow_first_seen":1620902509276,"flow_last_seen":1620902515049,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1009870,"flow_avg_l4_payload_len":842,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64411,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":5633,"source":"chrome.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":255,"flow_first_seen":1620902509276,"flow_last_seen":1620902515049,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":196675,"flow_avg_l4_payload_len":771,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":64411,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":5633,"source":"chrome.pcap","alias":"nDPId-test"} ~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ ~~ packets captured/processed: 5633/5633 @@ -122,7 +126,7 @@ ~~ total detected protocols..: 6 ~~ total active/idle flows...: 6/6 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2586329 bytes -~~ total memory freed........: 2586329 bytes -~~ total allocations/frees...: 41046/41046 +~~ total memory allocated....: 2540138 bytes +~~ total memory freed........: 2540138 bytes +~~ total allocations/frees...: 41044/41044 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/coap_mqtt.pcap.out b/test/results/coap_mqtt.pcap.out index fae052e54..d4c65b96a 100644 --- a/test/results/coap_mqtt.pcap.out +++ b/test/results/coap_mqtt.pcap.out @@ -194,7 +194,7 @@ ~~ total detected protocols..: 16 ~~ total active/idle flows...: 16/16 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2229204 bytes -~~ total memory freed........: 2229204 bytes -~~ total allocations/frees...: 43887/43887 +~~ total memory allocated....: 2229046 bytes +~~ total memory freed........: 2229046 bytes +~~ total allocations/frees...: 43888/43888 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/cpha.pcap.out b/test/results/cpha.pcap.out index e74989c80..be57991e0 100644 --- a/test/results/cpha.pcap.out +++ b/test/results/cpha.pcap.out @@ -9,7 +9,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dcerpc.pcap.out b/test/results/dcerpc.pcap.out index 651a6e29d..678dc0689 100644 --- a/test/results/dcerpc.pcap.out +++ b/test/results/dcerpc.pcap.out @@ -35,7 +35,7 @@ ~~ total detected protocols..: 4 ~~ total active/idle flows...: 4/4 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1936650 bytes -~~ total memory freed........: 1936650 bytes -~~ total allocations/frees...: 35349/35349 +~~ total memory allocated....: 1937164 bytes +~~ total memory freed........: 1937164 bytes +~~ total allocations/frees...: 35350/35350 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/diameter.pcap.out b/test/results/diameter.pcap.out index 9c1455e3d..bbb3bd555 100644 --- a/test/results/diameter.pcap.out +++ b/test/results/diameter.pcap.out @@ -16,7 +16,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1928928 bytes -~~ total memory freed........: 1928928 bytes -~~ total allocations/frees...: 35331/35331 +~~ total memory allocated....: 1929610 bytes +~~ total memory freed........: 1929610 bytes +~~ total allocations/frees...: 35332/35332 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dlt_ppp.pcap.out b/test/results/dlt_ppp.pcap.out index c9a3515a2..689154288 100644 --- a/test/results/dlt_ppp.pcap.out +++ b/test/results/dlt_ppp.pcap.out @@ -9,7 +9,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dnp3.pcap.out b/test/results/dnp3.pcap.out index 11498fa13..e0c63cd96 100644 --- a/test/results/dnp3.pcap.out +++ b/test/results/dnp3.pcap.out @@ -151,7 +151,7 @@ ~~ total detected protocols..: 8 ~~ total active/idle flows...: 8/8 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1966621 bytes -~~ total memory freed........: 1966621 bytes -~~ total allocations/frees...: 35889/35889 +~~ total memory allocated....: 1966911 bytes +~~ total memory freed........: 1966911 bytes +~~ total allocations/frees...: 35890/35890 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dns-tunnel-iodine.pcap.out b/test/results/dns-tunnel-iodine.pcap.out index c22fd4fb4..292ce297d 100644 --- a/test/results/dns-tunnel-iodine.pcap.out +++ b/test/results/dns-tunnel-iodine.pcap.out @@ -31,7 +31,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1939292 bytes -~~ total memory freed........: 1939292 bytes -~~ total allocations/frees...: 35758/35758 +~~ total memory allocated....: 1939974 bytes +~~ total memory freed........: 1939974 bytes +~~ total allocations/frees...: 35759/35759 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dns_ambiguous_names.pcap.out b/test/results/dns_ambiguous_names.pcap.out index be71202e0..13add4a51 100644 --- a/test/results/dns_ambiguous_names.pcap.out +++ b/test/results/dns_ambiguous_names.pcap.out @@ -67,7 +67,7 @@ ~~ total detected protocols..: 10 ~~ total active/idle flows...: 10/10 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1955726 bytes -~~ total memory freed........: 1955726 bytes -~~ total allocations/frees...: 35371/35371 +~~ total memory allocated....: 1955904 bytes +~~ total memory freed........: 1955904 bytes +~~ total allocations/frees...: 35372/35372 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dns_doh.pcap.out b/test/results/dns_doh.pcap.out index cee14dc39..5b91d10ad 100644 --- a/test/results/dns_doh.pcap.out +++ b/test/results/dns_doh.pcap.out @@ -26,7 +26,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1938299 bytes -~~ total memory freed........: 1938299 bytes -~~ total allocations/frees...: 35471/35471 +~~ total memory allocated....: 1938981 bytes +~~ total memory freed........: 1938981 bytes +~~ total allocations/frees...: 35472/35472 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dns_dot.pcap.out b/test/results/dns_dot.pcap.out index 90d10bfd4..b05e9d55b 100644 --- a/test/results/dns_dot.pcap.out +++ b/test/results/dns_dot.pcap.out @@ -26,7 +26,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1932837 bytes -~~ total memory freed........: 1932837 bytes -~~ total allocations/frees...: 35357/35357 +~~ total memory allocated....: 1933519 bytes +~~ total memory freed........: 1933519 bytes +~~ total allocations/frees...: 35358/35358 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dns_exfiltration.pcap.out b/test/results/dns_exfiltration.pcap.out index a7841e166..fdff77a1c 100644 --- a/test/results/dns_exfiltration.pcap.out +++ b/test/results/dns_exfiltration.pcap.out @@ -31,7 +31,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1935406 bytes -~~ total memory freed........: 1935406 bytes -~~ total allocations/frees...: 35624/35624 +~~ total memory allocated....: 1936088 bytes +~~ total memory freed........: 1936088 bytes +~~ total allocations/frees...: 35625/35625 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dns_long_domainname.pcap.out b/test/results/dns_long_domainname.pcap.out index 8952bc584..6cd71f3ce 100644 --- a/test/results/dns_long_domainname.pcap.out +++ b/test/results/dns_long_domainname.pcap.out @@ -13,7 +13,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926764 bytes -~~ total memory freed........: 1926764 bytes -~~ total allocations/frees...: 35326/35326 +~~ total memory allocated....: 1927446 bytes +~~ total memory freed........: 1927446 bytes +~~ total allocations/frees...: 35327/35327 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dnscrypt-v1-and-resolver-pings.pcap.out b/test/results/dnscrypt-v1-and-resolver-pings.pcap.out index 37a2772b7..54327a8dd 100644 --- a/test/results/dnscrypt-v1-and-resolver-pings.pcap.out +++ b/test/results/dnscrypt-v1-and-resolver-pings.pcap.out @@ -1488,7 +1488,7 @@ ~~ total detected protocols..: 251 ~~ total active/idle flows...: 251/251 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2730858 bytes -~~ total memory freed........: 2730858 bytes -~~ total allocations/frees...: 36562/36562 +~~ total memory allocated....: 2717540 bytes +~~ total memory freed........: 2717540 bytes +~~ total allocations/frees...: 36563/36563 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dnscrypt-v2-doh.pcap.out b/test/results/dnscrypt-v2-doh.pcap.out index c83f5cbe5..c32d8b4cb 100644 --- a/test/results/dnscrypt-v2-doh.pcap.out +++ b/test/results/dnscrypt-v2-doh.pcap.out @@ -627,7 +627,7 @@ ~~ total detected protocols..: 34 ~~ total active/idle flows...: 34/34 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2260329 bytes -~~ total memory freed........: 2260329 bytes -~~ total allocations/frees...: 36157/36157 +~~ total memory allocated....: 2259163 bytes +~~ total memory freed........: 2259163 bytes +~~ total allocations/frees...: 36158/36158 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dnscrypt_skype_false_positive.pcapng.out b/test/results/dnscrypt_skype_false_positive.pcapng.out index ae56b737e..b461a6ca4 100644 --- a/test/results/dnscrypt_skype_false_positive.pcapng.out +++ b/test/results/dnscrypt_skype_false_positive.pcapng.out @@ -22,7 +22,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 3/3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1933200 bytes -~~ total memory freed........: 1933200 bytes -~~ total allocations/frees...: 35336/35336 +~~ total memory allocated....: 1933770 bytes +~~ total memory freed........: 1933770 bytes +~~ total allocations/frees...: 35337/35337 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/doq.pcapng.out b/test/results/doq.pcapng.out index 1e298c9fa..e6a59ed05 100644 --- a/test/results/doq.pcapng.out +++ b/test/results/doq.pcapng.out @@ -33,7 +33,7 @@ ~~ total detected protocols..: 2 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1935898 bytes -~~ total memory freed........: 1935898 bytes -~~ total allocations/frees...: 35359/35359 +~~ total memory allocated....: 1936524 bytes +~~ total memory freed........: 1936524 bytes +~~ total allocations/frees...: 35360/35360 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/doq_adguard.pcapng.out b/test/results/doq_adguard.pcapng.out index 34af20f07..43e4fa3e8 100644 --- a/test/results/doq_adguard.pcapng.out +++ b/test/results/doq_adguard.pcapng.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1940694 bytes -~~ total memory freed........: 1940694 bytes -~~ total allocations/frees...: 35632/35632 +~~ total memory allocated....: 1941376 bytes +~~ total memory freed........: 1941376 bytes +~~ total allocations/frees...: 35633/35633 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dos_win98_smb_netbeui.pcap.out b/test/results/dos_win98_smb_netbeui.pcap.out index a699886cb..f9e6514dd 100644 --- a/test/results/dos_win98_smb_netbeui.pcap.out +++ b/test/results/dos_win98_smb_netbeui.pcap.out @@ -389,7 +389,7 @@ ~~ total detected protocols..: 7 ~~ total active/idle flows...: 7/7 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1947464 bytes -~~ total memory freed........: 1947464 bytes -~~ total allocations/frees...: 35404/35404 +~~ total memory allocated....: 1947810 bytes +~~ total memory freed........: 1947810 bytes +~~ total allocations/frees...: 35405/35405 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/drda_db2.pcap.out b/test/results/drda_db2.pcap.out index a992059f7..1b3b82b64 100644 --- a/test/results/drda_db2.pcap.out +++ b/test/results/drda_db2.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929856 bytes -~~ total memory freed........: 1929856 bytes -~~ total allocations/frees...: 35363/35363 +~~ total memory allocated....: 1930538 bytes +~~ total memory freed........: 1930538 bytes +~~ total allocations/frees...: 35364/35364 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dropbox.pcap.out b/test/results/dropbox.pcap.out index 13bae0f9b..fcde4c68f 100644 --- a/test/results/dropbox.pcap.out +++ b/test/results/dropbox.pcap.out @@ -178,7 +178,7 @@ ~~ total detected protocols..: 19 ~~ total active/idle flows...: 19/19 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2008178 bytes -~~ total memory freed........: 2008178 bytes -~~ total allocations/frees...: 36226/36226 +~~ total memory allocated....: 2007852 bytes +~~ total memory freed........: 2007852 bytes +~~ total allocations/frees...: 36227/36227 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dtls.pcap.out b/test/results/dtls.pcap.out index 8bb5b2e10..1c52fe7d5 100644 --- a/test/results/dtls.pcap.out +++ b/test/results/dtls.pcap.out @@ -12,7 +12,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926764 bytes -~~ total memory freed........: 1926764 bytes -~~ total allocations/frees...: 35326/35326 +~~ total memory allocated....: 1927446 bytes +~~ total memory freed........: 1927446 bytes +~~ total allocations/frees...: 35327/35327 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dtls2.pcap.out b/test/results/dtls2.pcap.out index 4279851e8..f3bfa9a26 100644 --- a/test/results/dtls2.pcap.out +++ b/test/results/dtls2.pcap.out @@ -26,7 +26,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1927620 bytes -~~ total memory freed........: 1927620 bytes -~~ total allocations/frees...: 35356/35356 +~~ total memory allocated....: 1928302 bytes +~~ total memory freed........: 1928302 bytes +~~ total allocations/frees...: 35357/35357 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dtls_certificate_fragments.pcap.out b/test/results/dtls_certificate_fragments.pcap.out index 69fe500a9..3211f6429 100644 --- a/test/results/dtls_certificate_fragments.pcap.out +++ b/test/results/dtls_certificate_fragments.pcap.out @@ -26,7 +26,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1927286 bytes -~~ total memory freed........: 1927286 bytes -~~ total allocations/frees...: 35344/35344 +~~ total memory allocated....: 1927968 bytes +~~ total memory freed........: 1927968 bytes +~~ total allocations/frees...: 35345/35345 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/dtls_session_id_and_coockie_both.pcap.out b/test/results/dtls_session_id_and_coockie_both.pcap.out index 2d2f73334..8f2e1b58c 100644 --- a/test/results/dtls_session_id_and_coockie_both.pcap.out +++ b/test/results/dtls_session_id_and_coockie_both.pcap.out @@ -15,7 +15,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926822 bytes -~~ total memory freed........: 1926822 bytes -~~ total allocations/frees...: 35328/35328 +~~ total memory allocated....: 1927504 bytes +~~ total memory freed........: 1927504 bytes +~~ total allocations/frees...: 35329/35329 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/encrypted_sni.pcap.out b/test/results/encrypted_sni.pcap.out index 1ca77755e..1e1a18dba 100644 --- a/test/results/encrypted_sni.pcap.out +++ b/test/results/encrypted_sni.pcap.out @@ -19,7 +19,7 @@ ~~ total detected protocols..: 3 ~~ total active/idle flows...: 3/3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1941138 bytes -~~ total memory freed........: 1941138 bytes -~~ total allocations/frees...: 35345/35345 +~~ total memory allocated....: 1941708 bytes +~~ total memory freed........: 1941708 bytes +~~ total allocations/frees...: 35346/35346 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ethereum.pcap.out b/test/results/ethereum.pcap.out index 37003d287..db0da3e5c 100644 --- a/test/results/ethereum.pcap.out +++ b/test/results/ethereum.pcap.out @@ -1034,7 +1034,7 @@ ~~ total detected protocols..: 71 ~~ total active/idle flows...: 74/74 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2332138 bytes -~~ total memory freed........: 2332138 bytes -~~ total allocations/frees...: 37598/37598 +~~ total memory allocated....: 2328732 bytes +~~ total memory freed........: 2328732 bytes +~~ total allocations/frees...: 37599/37599 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/exe_download.pcap.out b/test/results/exe_download.pcap.out index 245905709..50cf3a667 100644 --- a/test/results/exe_download.pcap.out +++ b/test/results/exe_download.pcap.out @@ -26,7 +26,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1947173 bytes -~~ total memory freed........: 1947173 bytes -~~ total allocations/frees...: 36030/36030 +~~ total memory allocated....: 1947855 bytes +~~ total memory freed........: 1947855 bytes +~~ total allocations/frees...: 36031/36031 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/exe_download_as_png.pcap.out b/test/results/exe_download_as_png.pcap.out index 8e0df6681..bb7d9a39f 100644 --- a/test/results/exe_download_as_png.pcap.out +++ b/test/results/exe_download_as_png.pcap.out @@ -26,7 +26,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1942247 bytes -~~ total memory freed........: 1942247 bytes -~~ total allocations/frees...: 35861/35861 +~~ total memory allocated....: 1942929 bytes +~~ total memory freed........: 1942929 bytes +~~ total allocations/frees...: 35862/35862 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/facebook.pcap.out b/test/results/facebook.pcap.out index 2b224cd71..4ba7ec5ad 100644 --- a/test/results/facebook.pcap.out +++ b/test/results/facebook.pcap.out @@ -46,7 +46,7 @@ ~~ total detected protocols..: 2 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1942927 bytes -~~ total memory freed........: 1942927 bytes -~~ total allocations/frees...: 35408/35408 +~~ total memory allocated....: 1943553 bytes +~~ total memory freed........: 1943553 bytes +~~ total allocations/frees...: 35409/35409 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/firefox.pcap.out b/test/results/firefox.pcap.out index 9aa191617..030702e0e 100644 --- a/test/results/firefox.pcap.out +++ b/test/results/firefox.pcap.out @@ -107,13 +107,16 @@ 00425{"flow_id":6,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":316,"source":"firefox.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620927999,"pkt_ts_usec":226198,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0Ru9AADQGcTiSMDoSwKgBsgG7yZFyBGoNy0T9GYAQAfZfogAAAQEICjwgDNA0DJnO"} 02377{"flow_id":6,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":324,"source":"firefox.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620927999,"pkt_ts_usec":226686,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXURvBAADQGa5eSMDoSwKgBsgG7yZFyBGoNy0T9GYAQAfZkjwAAAQEICjwgDNE0DJnOFwMDATCFItPF6rhHl1\/YPDMm6GWa4HPcCuK3mqzRTOvvGM6NtGhFTVozdHMGJUEg+z3B0BwleVJpB0reYbEUloZUNqh+kMOlhUZkm4pupaUY0U3DCPm5Acsk4V8tBtBDRLG6xi5ISPF0fnoOemdPNS5pkmhpcXIQTJwrun+oXoL5UMlx4p6HorQcXT3ymZw9p3ypfFXkNfWHg05tgi2hPSGA4o2hvt12+\/r5TqNogm+YBmdd5EhiErbSF+joVzv3duY6fTgEB86x2h8HE\/TFVEHU8HKlPkU6Svy67aTvtbLONANSb8cpYbsgRmmZbRuoDoqmKhfmkhF8uqt5BA5bHxI9CRcQuESZNqQ03RWwnd0xSJ62fuTT7fNyfbaItVf+d+C4AcL5+m96krweQdTXjAV0ZPLmFwMDIeAN9X2eDfUrz11hvbQsIH5c5SfESCAAlIcc2dpQ97y8luRHUEzUkqXDf\/PLM9KOB4UlHlDacLBy1+b8ityG6\/T9TcqAtZtO8cZtb5T8k\/oOc1vYtX\/fgq8q48fIWSmBZU9jTzBi6aEuKMRRnFRhiRxNh9dyb0Yy2FB6oHFwHwHwf5PAHxnV+X59ajF1exRa1UMHzVir8f4FXkVOKMv8cUQQoB4shcljjAEh3YWc4GwJNz6EtfFw9aKeyANS\/FfpHhP17AitFF420+2PsvZPCQFk61oBLlZBkwQu2TpYfarh3hR6rObQFgBNt\/1xoQzprgM51ImkTMS7QSgpgPmVlxM2EATn9cyIKyHbcO4IofjSmxOC\/TVgLA4\/PR3n8QyGp4vmho\/FVYR1+q79PXff9tf\/5mnDk82iUl448pw+rTHDgB1Oejo8OWfKP5yNUeJ+CuRxcCMXRvnXeM1fLPveq3kCveongKC2oflEtuUNEL6fFI94HtalTDWb+Ux8GjoNpr6BxzJKzjHMKM6LZges2fD8PHJZbfzIaskZvfdSBuolTgW2sBuqhivFhjELX+oUCjiKGociBtPOA8Ni+\/iEtI9NJHp8aGoFdSWFa1uqewlQMVodLxawlNpmg0WtfeZ5YSM1OPkyyX4YciYb7q7tYNunRHDhhT2kJLE5A+8q5rTA3u0q\/wL3yJ6FCCwtYSbvldQZTy4MIsOSqzYsDbFrfXCZYTRHYU8H4LJOB5HUdwtbykh\/5sC+HVoyTLbuocH\/spyZYSNkpjWdlwHoH9h9umAjBgwyDAEwyXjzox1tkv\/qvECE3\/OJ6FiVTmMRRf9fk8lPbfiL\/rPXKcw3bAJLJd7PjfDQ8RdRnfJXD0cS6txrN1TTPgHumvmuAmrVsrS+bWAC0Yysl\/Bz95z5obxGI8PQbvH4IU3C4dLfyvW0Jdl2HjBK5yw7HYjAM2htntg23mpT3fqAfn6gy6C3g5KyIP6o4FqT2FGtQaU9Gdo0eFIKiQ4k0TzMBHtWJW0x\/Zg\/+rNMWKMN8WllqBzrpncwdqW6r89jEdyeR+UFAMUXkISP1VN8q7rZTM+jwA1qnjUi6YaGu9TgOt\/Q2Bi21rv6wZKWBIQvMkpzMFXnEaZHpOxm8PFeM\/8E6Wy0MhwWlBotTz0taZJm3bg+JnHp8U6XTLPeuyi+k9vgASq4vBuqC4FV+G9CoPjLqe5WcPy96wz34Gh0Zue2fVjELTOUewWs9fpSmP0Q39IZFXpW9Hs\/lWFoE5yPY++XW1eJ76eVN3B3iDAdUBtcjMOfxmSlic0NyNauA57QWMuFhJj6UlsNJvOpJzYCB8JfOI40SaKcX0nHBIBldeKKFvwAMCT1Y9LjaFM9Ab34HTrSHJye92uqoYM1CzMXhYOvDWXUHtNhZBQra1Olu1ergOfzFZC4stSCM+dwXkAKV8OPjlDGnieK85H2V5M8SEsAsk0jsbmK9VpvJeZs9zJUSvbATHYsyqm1FczDpSo3nRy+"} 02380{"flow_id":6,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":325,"source":"firefox.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620927999,"pkt_ts_usec":226805,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXURvFAADQGa5aSMDoSwKgBsgG7yZFyBG+ty0T9GYAYAfZGWQAAAQEICjwgDNE0DJnO46bdv8K\/Cv0Y71KHBDx2E6DhVxHnO\/Vz+xRwx2MqZfoXdkMxPSicnl3rYCYWn0W24kGlecvyv7f0wZjyQvEeJD0ho1yneg4\/xbfN6nJQCbyAHn52qAkHGnKjO1KZDQzFc+5TrtwQEh+BUcCr8cmLjsOay578DJPCS8ae7imn292Lro+q4p\/3K4HTVpMrHgLfaY6hGzqsUOvRYnp+mBY5J563lmxOlx\/X\/oRuF++LlsfkL4e4knMLMkCVM+4iUfa04TW9CkLfEBrv4TH6EnUWnZyHOF8RFK\/1abv2HzFnA6zXuYU\/Kd5MKn+6eVVnhXGptFU+YDY9XL86PB+02SsiTjKa52KdTP+9os8CK8SqxnVrHpeE8v2tj2IhDJHzCsyjbWxg80M07qQn9G6WWAfhwMD03oDyqCwxVdIW\/MNogzyD29FkqRX3j9n7yWj8xN+nH1XMHDS6XIuSGpwiPcgoHxc0cUkIR5gIcEee+K3NQoHTxX6ggiXJFwDsSAltMJPa777kTM1SAmCL6mIKH5RFm5s+L7B9+mAtbO8rBf5cnca1izIIU+eT1mvlWCfXyubs\/uJZuUdJr7Y86g6QqP+IPTdFl4C7gy0KF+hZPVpBQkFjAx6PRGdxZ3N4LgGKVsnxLmp7ZUheaHfua3vO7HM7OSvw8l\/ze9oD3As+2V7Wmo2giwB8EPOPhoPXSkNhVN8I8jb+AsJnkzY9ecRVSW83tpBDyKQ2XjpmpBwQ9EVwM4CmUKlheybzefnWu1t1PoK21rSakqzAdjrlBFAfkN5f9coT9sI668vA7pI6f2kN4GZ8tIyQwALesL5d32vkjmxhcR9Ephra5vd9TYwTxhKz1Hw33GqfwwnnkzroMItWkC94MT9\/VKvHCr9Tkne6c675Spl2JDFJ3wb5Sydf4A7x2Qg3fRV4opVqzovvzIGgjiZp0CujVL5zOXAkS2HnJxxBD6a2gGfwbj\/Z6sWKOHuDmD\/QBbc9R3zoENgebZ5HtkdkM5tiFNi5InBSHUuObtHnicUdsBv00hPvLUdi0axYCkTtOQYGUheExhiPQQEYgxhPteOzgbjU3mg9+D4CAvzmoWQwsXki5G3MHnAl4MXqGvqYE35YBip6lmx7\/qQkQLExsjMjl+B7GjF\/GjOrYPDQp\/yGV3pHo3O93LWc+UPT+cyc6Ae20\/u3TH3HOo175rQxEg8VW8HVppHsPzIro2fS3GjdyYvBkuLUwDQqAMX4KVTQ4dnO2qsHL+PKVSYcWYly94o5AN77+DmqopSXpQNbyQlzyIzvrgEAOQMj3QfQWQ0Bn8P5Mj+x97H31p8bwf+iNIyw1Swh8fBDvI+AQ0NlZQabe8BzYQmSmRcuhpnkpzfl1wqCP41Ddi8oRLH9G6sT6xjZ+wCmKYQkpmcJBB2Lh8WPQieK6YZvKXFoH7WLC9q24PuGX50w+D4GOr9tvvtBJ2hYPSmZZCP5F+s59SjEghaoKmMGmcH3ppSVAXFE+rrhyYwS+lcqrXjygZhVDgxenUAdLAcDP\/yEtCVPz1MHb1t8t6r7oVmy9HlRVXy8DrtoIbjLDK+Zp2b2M4ERf22yJYBywgnxzDl3qvMmzni+KXjVOVDd078bzWIe3hT1D+ZNLLWcU49PEPJzQXgUobzxSiw8OKUxu2RM8AsKXQbk3i7x\/4DNic0LLIwxlebFuv\/Hup8TuMCyQR9whOnAxau+R2yPyGEHDSf\/wWqW4kDMsq0pZwak4tNm1YE3WjpiXtBoHK1xlAOgyUil\/3uCxlv\/\/guIJMnwv3zRPe9\/AZVpFL0rBjS9F0LKy\/khl2r2y4uw+8DTcXG8M12ci\/8\/7or9Eg+8WXPvfCVuEk60aMXsSqG7KFu6NpASmHnKw7OeZUmavwS1YmSksKTYzohf8zu7u1yDfIYmAtV0cNsQsU45"} +00813{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1330,"source":"firefox.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":255,"flow_first_seen":1620927998806,"flow_last_seen":1620927999354,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":195425,"flow_avg_l4_payload_len":766,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":51588,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"www.iit.cnr.it","ja3":"ab78a7ef7106e8144808f22ab4a26dc8","ja3s":"2253c82f03b621c5144709b393fde2c9","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} 00813{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1636,"source":"firefox.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":255,"flow_first_seen":1620927999109,"flow_last_seen":1620927999385,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":200954,"flow_avg_l4_payload_len":788,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":51599,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"www.iit.cnr.it","ja3":"ab78a7ef7106e8144808f22ab4a26dc8","ja3s":"2253c82f03b621c5144709b393fde2c9","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00813{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2615,"source":"firefox.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":255,"flow_first_seen":1620927999112,"flow_last_seen":1620927999490,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":207776,"flow_avg_l4_payload_len":814,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":51601,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"www.iit.cnr.it","ja3":"ab78a7ef7106e8144808f22ab4a26dc8","ja3s":"2253c82f03b621c5144709b393fde2c9","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00813{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":3808,"source":"firefox.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":255,"flow_first_seen":1620927999111,"flow_last_seen":1620927999648,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":203554,"flow_avg_l4_payload_len":798,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":51600,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"www.iit.cnr.it","ja3":"ab78a7ef7106e8144808f22ab4a26dc8","ja3s":"2253c82f03b621c5144709b393fde2c9","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} 00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5441,"source":"firefox.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1065,"flow_first_seen":1620927997754,"flow_last_seen":1620927999853,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":891202,"flow_avg_l4_payload_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":51577,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5441,"source":"firefox.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1031,"flow_first_seen":1620927998782,"flow_last_seen":1620927999948,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":869503,"flow_avg_l4_payload_len":843,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":51583,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5441,"source":"firefox.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1387,"flow_first_seen":1620927998806,"flow_last_seen":1620927999915,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1189641,"flow_avg_l4_payload_len":857,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":51588,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5441,"source":"firefox.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":255,"flow_first_seen":1620927998806,"flow_last_seen":1620927999915,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":195425,"flow_avg_l4_payload_len":766,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":51588,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5441,"source":"firefox.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":255,"flow_first_seen":1620927999109,"flow_last_seen":1620927999830,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":200954,"flow_avg_l4_payload_len":788,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":51599,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5441,"source":"firefox.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":646,"flow_first_seen":1620927999111,"flow_last_seen":1620927999879,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":545091,"flow_avg_l4_payload_len":843,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":51600,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5441,"source":"firefox.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":878,"flow_first_seen":1620927999112,"flow_last_seen":1620927999897,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":744373,"flow_avg_l4_payload_len":847,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":51601,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5441,"source":"firefox.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":255,"flow_first_seen":1620927999111,"flow_last_seen":1620927999879,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":203554,"flow_avg_l4_payload_len":798,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":51600,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5441,"source":"firefox.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":255,"flow_first_seen":1620927999112,"flow_last_seen":1620927999897,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":207776,"flow_avg_l4_payload_len":814,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":51601,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":5441,"source":"firefox.pcap","alias":"nDPId-test"} ~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ ~~ packets captured/processed: 5441/5441 @@ -122,7 +125,7 @@ ~~ total detected protocols..: 6 ~~ total active/idle flows...: 6/6 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2563192 bytes -~~ total memory freed........: 2563192 bytes -~~ total allocations/frees...: 40848/40848 +~~ total memory allocated....: 2434467 bytes +~~ total memory freed........: 2434467 bytes +~~ total allocations/frees...: 40840/40840 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/fix.pcap.out b/test/results/fix.pcap.out index 2a83deb66..56240da37 100644 --- a/test/results/fix.pcap.out +++ b/test/results/fix.pcap.out @@ -191,7 +191,7 @@ ~~ total detected protocols..: 12 ~~ total active/idle flows...: 12/12 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2022611 bytes -~~ total memory freed........: 2022611 bytes -~~ total allocations/frees...: 36630/36630 +~~ total memory allocated....: 2022677 bytes +~~ total memory freed........: 2022677 bytes +~~ total allocations/frees...: 36631/36631 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/forticlient.pcap.out b/test/results/forticlient.pcap.out index 2af8abeac..d21efcbb8 100644 --- a/test/results/forticlient.pcap.out +++ b/test/results/forticlient.pcap.out @@ -107,7 +107,7 @@ ~~ total detected protocols..: 5 ~~ total active/idle flows...: 5/5 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2041933 bytes -~~ total memory freed........: 2041933 bytes -~~ total allocations/frees...: 37363/37363 +~~ total memory allocated....: 2042391 bytes +~~ total memory freed........: 2042391 bytes +~~ total allocations/frees...: 37364/37364 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ftp.pcap.out b/test/results/ftp.pcap.out index 99e0ca2d0..573dfffb4 100644 --- a/test/results/ftp.pcap.out +++ b/test/results/ftp.pcap.out @@ -12,7 +12,7 @@ 00441{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"ftp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1552590234,"pkt_ts_usec":976972,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"EBMx8Tl2xCwDBkn+CABFEABBAABAAEAGAADAqAHUWoJGScYGABWjI5f+WCrCCYAYECpjewAAAQEICjtXmOwSZ\/tbUEFTUyBOY0ZUUEANCg=="} 00419{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"ftp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1552590235,"pkt_ts_usec":45752,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xCwDBkn+EBMx8Tl2CABFAAA0OopAADYGpvJagkZJwKgB1AAVxgZYKsIJoyOYC4AQAAMV2wAAAQEIChJn+207V5js"} 00451{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"ftp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1552590235,"pkt_ts_usec":66945,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"xCwDBkn+EBMx8Tl2CABFAABLOotAADYGptpagkZJwKgB1AAVxgZYKsIJoyOYC4AYAAM0PgAAAQEIChJn+3I7V5jsMjMwIExvZ2luIHN1Y2Nlc3NmdWwuDQo="} -00630{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":12,"source":"ftp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":12,"flow_first_seen":1552590234892,"flow_last_seen":1552590235066,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":106,"flow_avg_l4_payload_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.212","dst_ip":"90.130.70.73","src_port":50694,"dst_port":21,"l4_proto":"tcp","ndpi": {"flow_risk": {"22":"Unsafe Protocol"},"proto":"FTP_CONTROL","breed":"Unsafe","category":"Download"},"ftp": {"user":"anonymous","password":"NcFTP@","auth_failed":0}} +00660{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":12,"source":"ftp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":12,"flow_first_seen":1552590234892,"flow_last_seen":1552590235066,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":106,"flow_avg_l4_payload_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.212","dst_ip":"90.130.70.73","src_port":50694,"dst_port":21,"l4_proto":"tcp","ndpi": {"flow_risk": {"22":"Unsafe Protocol","36":"Clear-text credentials"},"proto":"FTP_CONTROL","breed":"Unsafe","category":"Download"},"ftp": {"user":"anonymous","password":"NcFTP@","auth_failed":0}} 00420{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"ftp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1552590235,"pkt_ts_usec":67019,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2xCwDBkn+CABFEAA0AABAAEAGAADAqAHUWoJGScYGABWjI5gLWCrCIIAQECljbgAAAQEICjtXmUUSZ\/ty"} 00428{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"ftp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1552590235,"pkt_ts_usec":67325,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"EBMx8Tl2xCwDBkn+CABFEAA5AABAAEAGAADAqAHUWoJGScYGABWjI5gLWCrCIIAYECljcwAAAQEICjtXmUUSZ\/tyUFdEDQo="} 00419{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"ftp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1552590235,"pkt_ts_usec":94015,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xCwDBkn+EBMx8Tl2CABFAAA0OoxAADYGpvBagkZJwKgB1AAVxgZYKsIgoyOYEIAQAAMVWgAAAQEIChJn+3k7V5lF"} @@ -55,7 +55,7 @@ ~~ total detected protocols..: 2 ~~ total active/idle flows...: 3/3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1973738 bytes -~~ total memory freed........: 1973738 bytes -~~ total allocations/frees...: 36525/36525 +~~ total memory allocated....: 1974308 bytes +~~ total memory freed........: 1974308 bytes +~~ total allocations/frees...: 36526/36526 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ftp_failed.pcap.out b/test/results/ftp_failed.pcap.out index a12029b45..79da3e8f6 100644 --- a/test/results/ftp_failed.pcap.out +++ b/test/results/ftp_failed.pcap.out @@ -15,7 +15,7 @@ 00465{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"ftp_failed.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1574361633,"pkt_ts_usec":74667,"pkt_caplen":92,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":92,"pkt_l4_len":38,"pkt":"9LUv\/K\/wZABqYzXMht1gC5eXACYGQCoADUAAAQADAZIAEgGTABEqAAgAEBAAAAAAAAAAAAABrrQAFZk3QchwFQbPgBgA4XzJAAABAQgKlgV6zFbTThFRVUlUDQo="} 00479{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"ftp_failed.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1574361633,"pkt_ts_usec":88560,"pkt_caplen":100,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":100,"pkt_l4_len":46,"pkt":"ZABqYzXM9LUv\/K\/wht1gC1mOAC4GOioACAAQEAAAAAAAAAAAAAEqAA1AAAEAAwGSABIBkwARABWutHAVBs+ZN0HOgBgCAFELAAABAQgKVtNPzpYFeswyMjEgR29vZGJ5ZS4NCg=="} 00457{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"ftp_failed.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1574361633,"pkt_ts_usec":88598,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"9LUv\/K\/wZABqYzXMht1gC5eXACAGQCoADUAAAQADAZIAEgGTABEqAAgAEBAAAAAAAAAAAAABrrQAFZk3Qc5wFQbdgBAA4XzDAAABAQgKlgV62lbTT84="} -00605{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":18,"source":"ftp_failed.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":18,"flow_first_seen":1574361625864,"flow_last_seen":1574361633102,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":136,"flow_avg_l4_payload_len":7,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:192:12:193:11","dst_ip":"2a00:800:1010::1","src_port":44724,"dst_port":21,"l4_proto":"tcp","ndpi": {"proto":"FTP_CONTROL","breed":"Unsafe","category":"Download"},"ftp": {"user":"hello","password":"","auth_failed":1}} +00650{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":18,"source":"ftp_failed.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":18,"flow_first_seen":1574361625864,"flow_last_seen":1574361633102,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":136,"flow_avg_l4_payload_len":7,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:192:12:193:11","dst_ip":"2a00:800:1010::1","src_port":44724,"dst_port":21,"l4_proto":"tcp","ndpi": {"flow_risk": {"36":"Clear-text credentials"},"proto":"FTP_CONTROL","breed":"Unsafe","category":"Download"},"ftp": {"user":"hello","password":"","auth_failed":1}} 00516{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":18,"source":"ftp_failed.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":18,"flow_first_seen":1574361625864,"flow_last_seen":1574361633102,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":136,"flow_avg_l4_payload_len":7,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:192:12:193:11","dst_ip":"2a00:800:1010::1","src_port":44724,"dst_port":21,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":18,"source":"ftp_failed.pcap","alias":"nDPId-test"} ~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ @@ -25,7 +25,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929276 bytes -~~ total memory freed........: 1929276 bytes -~~ total allocations/frees...: 35343/35343 +~~ total memory allocated....: 1929958 bytes +~~ total memory freed........: 1929958 bytes +~~ total allocations/frees...: 35344/35344 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/genshin-impact.pcap.out b/test/results/genshin-impact.pcap.out index 0edf2ca49..70bdff630 100644 --- a/test/results/genshin-impact.pcap.out +++ b/test/results/genshin-impact.pcap.out @@ -61,7 +61,7 @@ ~~ total detected protocols..: 3 ~~ total active/idle flows...: 3/3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1934331 bytes -~~ total memory freed........: 1934331 bytes -~~ total allocations/frees...: 35375/35375 +~~ total memory allocated....: 1934901 bytes +~~ total memory freed........: 1934901 bytes +~~ total allocations/frees...: 35376/35376 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/git.pcap.out b/test/results/git.pcap.out index a654d5bf0..5d09fcd24 100644 --- a/test/results/git.pcap.out +++ b/test/results/git.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929316 bytes -~~ total memory freed........: 1929316 bytes -~~ total allocations/frees...: 35414/35414 +~~ total memory allocated....: 1929998 bytes +~~ total memory freed........: 1929998 bytes +~~ total allocations/frees...: 35415/35415 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/google_ssl.pcap.out b/test/results/google_ssl.pcap.out index 44c4c8587..c52a40ef7 100644 --- a/test/results/google_ssl.pcap.out +++ b/test/results/google_ssl.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929566 bytes -~~ total memory freed........: 1929566 bytes -~~ total allocations/frees...: 35353/35353 +~~ total memory allocated....: 1930248 bytes +~~ total memory freed........: 1930248 bytes +~~ total allocations/frees...: 35354/35354 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/googledns_android10.pcap.out b/test/results/googledns_android10.pcap.out index 4e427f166..206110ae3 100644 --- a/test/results/googledns_android10.pcap.out +++ b/test/results/googledns_android10.pcap.out @@ -65,7 +65,7 @@ 00420{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":68,"source":"googledns_android10.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592552826,"pkt_ts_usec":208808,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2ag\/ahpuQCABFAAAoAABAAEAGaHnAqAGfCAgICNowA1VpY9IUAAAAAFAEAADEiwAA"} 00457{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":81,"source":"googledns_android10.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1592552827426,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.159","dst_ip":"8.8.8.8","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} 00480{"flow_id":5,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":81,"source":"googledns_android10.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592552827,"pkt_ts_usec":426405,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"EBMx8Tl2ag\/ahpuQCABFAABUl9BAAEAB0IHAqAGfCAgICAgA4JUAAgABem3sXgAAAADqxwcAAAAAABAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc="} -00498{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":81,"source":"googledns_android10.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1592552827426,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.159","dst_ip":"8.8.8.8","l4_proto":"icmp","ndpi": {"proto":"ICMP.Google","breed":"Tracker\/Ads","category":"Network"}} +00517{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":81,"source":"googledns_android10.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1592552827426,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.159","dst_ip":"8.8.8.8","l4_proto":"icmp","ndpi": {"entropy":5.297900,"proto":"ICMP.Google","breed":"Tracker\/Ads","category":"Network"}} 00480{"flow_id":5,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":83,"source":"googledns_android10.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592552827,"pkt_ts_usec":440141,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"ag\/ahpuQEBMx8Tl2CABFoABUAAAAAHEBdrIICAgIwKgBnwAA6JUAAgABem3sXgAAAADqxwcAAAAAABAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc="} 00481{"flow_id":5,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":87,"source":"googledns_android10.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592552828,"pkt_ts_usec":402579,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"EBMx8Tl2ag\/ahpuQCABFAABUl\/5AAEAB0FPAqAGfCAgICAgAgPEAAwABe23sXgAAAABJawcAAAAAABAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc="} 00480{"flow_id":5,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":88,"source":"googledns_android10.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592552828,"pkt_ts_usec":415412,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"ag\/ahpuQEBMx8Tl2CABFoABUAAAAAHEBdrIICAgIwKgBnwAAiPEAAwABe23sXgAAAABJawcAAAAAABAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc="} @@ -127,7 +127,7 @@ ~~ total detected protocols..: 6 ~~ total active/idle flows...: 8/8 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1986838 bytes -~~ total memory freed........: 1986838 bytes -~~ total allocations/frees...: 35914/35914 +~~ total memory allocated....: 1987128 bytes +~~ total memory freed........: 1987128 bytes +~~ total allocations/frees...: 35915/35915 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/gquic.pcap.out b/test/results/gquic.pcap.out index ea84bf38f..4c5f560f2 100644 --- a/test/results/gquic.pcap.out +++ b/test/results/gquic.pcap.out @@ -11,7 +11,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1932295 bytes -~~ total memory freed........: 1932295 bytes -~~ total allocations/frees...: 35336/35336 +~~ total memory allocated....: 1932977 bytes +~~ total memory freed........: 1932977 bytes +~~ total allocations/frees...: 35337/35337 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/h323-overflow.pcap.out b/test/results/h323-overflow.pcap.out index 239ba4e70..78202a799 100644 --- a/test/results/h323-overflow.pcap.out +++ b/test/results/h323-overflow.pcap.out @@ -11,7 +11,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1928783 bytes -~~ total memory freed........: 1928783 bytes -~~ total allocations/frees...: 35326/35326 +~~ total memory allocated....: 1929465 bytes +~~ total memory freed........: 1929465 bytes +~~ total allocations/frees...: 35327/35327 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/hangout.pcap.out b/test/results/hangout.pcap.out index 9626227dc..b28a18115 100644 --- a/test/results/hangout.pcap.out +++ b/test/results/hangout.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1935465 bytes -~~ total memory freed........: 1935465 bytes -~~ total allocations/frees...: 35345/35345 +~~ total memory allocated....: 1936147 bytes +~~ total memory freed........: 1936147 bytes +~~ total allocations/frees...: 35346/35346 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/hpvirtgrp.pcap.out b/test/results/hpvirtgrp.pcap.out index 74027edd1..aa308b556 100644 --- a/test/results/hpvirtgrp.pcap.out +++ b/test/results/hpvirtgrp.pcap.out @@ -169,7 +169,7 @@ ~~ total detected protocols..: 9 ~~ total active/idle flows...: 9/9 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1974333 bytes -~~ total memory freed........: 1974333 bytes -~~ total allocations/frees...: 35492/35492 +~~ total memory allocated....: 1974567 bytes +~~ total memory freed........: 1974567 bytes +~~ total allocations/frees...: 35493/35493 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/http-crash-content-disposition.pcap.out b/test/results/http-crash-content-disposition.pcap.out index 3b1fa713e..117b9fbec 100644 --- a/test/results/http-crash-content-disposition.pcap.out +++ b/test/results/http-crash-content-disposition.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/http-lines-split.pcap.out b/test/results/http-lines-split.pcap.out index 36b9a39e3..bced9e591 100644 --- a/test/results/http-lines-split.pcap.out +++ b/test/results/http-lines-split.pcap.out @@ -24,7 +24,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1927142 bytes -~~ total memory freed........: 1927142 bytes -~~ total allocations/frees...: 35340/35340 +~~ total memory allocated....: 1927824 bytes +~~ total memory freed........: 1927824 bytes +~~ total allocations/frees...: 35341/35341 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/http-manipulated.pcap.out b/test/results/http-manipulated.pcap.out new file mode 100644 index 000000000..d3b3120dc --- /dev/null +++ b/test/results/http-manipulated.pcap.out @@ -0,0 +1,44 @@ +00484{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"http-manipulated.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} +00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"http-manipulated.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946727901369,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.20","dst_ip":"192.168.0.7","src_port":33632,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00430{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946727901,"pkt_ts_usec":369326,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0h+5iIqPABjzZLGICABFAAA0umlAAI8Gr+7AqAAUwKgAB4NgH5BugXMeAAAAAIAC+vCBkgAAAgQFtAEBBAIBAwMH"} +00430{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946727901,"pkt_ts_usec":369648,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABjzZLGI0h+5iIqPCABFAAA0AABAAEAGuVjAqAAHwKgAFB+Qg2CKV04jboFzH4AS+vCVmQAAAgQFtAEBBAIBAwMG"} +00415{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946727901,"pkt_ts_usec":369657,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0h+5iIqPABjzZLGICABFAAAoumpAAI8Gr\/nAqAAUwKgAB4NgH5BugXMfildOJFAQAfaBhgAA"} +00520{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946727901,"pkt_ts_usec":369701,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"pkt":"0h+5iIqPABjzZLGICABFAAB0umtAAI8Gr6zAqAAUwKgAB4NgH5BugXMfildOJFAYAfaB0gAAR0VUIC8gSFRUUC8xLjENCmhPc1Q6d3d3dy5sYW46ODA4MA0KVXNlci1BZ2VudDogY3VybC83LjY0LjANCkFjY2VwdDogKi8qDQoNCg=="} +00697{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"http-manipulated.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":946727901369,"flow_last_seen":946727901369,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":76,"flow_tot_l4_payload_len":76,"flow_avg_l4_payload_len":19,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.20","dst_ip":"192.168.0.7","src_port":33632,"dst_port":8080,"l4_proto":"tcp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"wwww.lan","url":"wwww.lan:8080\/","code":0,"content_type":"","user_agent":"curl\/7.64.0"}} +00422{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946727901,"pkt_ts_usec":369854,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ABjzZLGI0h+5iIqPCABFAAAoC+pAAEAGrXrAqAAHwKgAFB+Qg2CKV04kboFza1AQA+vNJAAAAAAAAAAA"} +01189{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946727901,"pkt_ts_usec":370325,"pkt_caplen":631,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":631,"pkt_l4_len":597,"pkt":"ABjzZLGI0h+5iIqPCABFAAJpC+tAAEAGqzjAqAAHwKgAFB+Qg2CKV04kboFza1AYA+sEtQAASFRUUC8xLjEgMjAwIE9LDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbA0KQWNjZXB0LVJhbmdlczogYnl0ZXMNCkVUYWc6ICIyNTY0OTY0Mjk3Ig0KTGFzdC1Nb2RpZmllZDogTW9uLCAyNiBKdWwgMjAyMSAwMDozOTo0MyBHTVQNCkNvbnRlbnQtTGVuZ3RoOiAzNjYNCkRhdGU6IFRodSwgMDUgQXVnIDIwMjEgMTI6NTg6MjEgR01UDQpTZXJ2ZXI6IGdhbW1hX2h0dHBkDQoNCjxodG1sPgo8aGVhZD4KPHRpdGxlPiBSaWNrIFJvbGxlZCA8L3RpdGxlPgo8IS0tIHJpY2tyb2xsZWQgLS0+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cmh0bWwgewoJYmFja2dyb3VuZDogIzAwMDsKfQojcmlja3JvbGxlZCB7Cgl3aWR0aDogMTAwJTsKCWhlaWdodDogMTAwJTsKCWJhY2tncm91bmQ6IHVybCgnL3JpY2suZ2lmJyk7CgliYWNrZ3JvdW5kLXNpemU6IDEwMCUgMTAwJTsKfQo8L3N0eWxlPgo8L2hlYWQ+Cjxib2R5Pgo8ZGl2IGlkPSJyaWNrcm9sbGVkIj4KPGF1ZGlvIHNyYz0iL3JpY2sub2dnIiB0eXBlPSJhdWRpby9vZ2ciIGF1dG9wbGF5PWF1dG9wbGF5IGxvb3A9bG9vcD48L2F1ZGlvPgo8L2Rpdj4KPC9ib2R5Pgo8L2h0bWw+Cg=="} +00415{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946727901,"pkt_ts_usec":370330,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0h+5iIqPABjzZLGICABFAAAoumxAAI8Gr\/fAqAAUwKgAB4NgH5BugXNrildQZVAQAfWBhgAA"} +00415{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946727901,"pkt_ts_usec":370406,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0h+5iIqPABjzZLGICABFAAAoum1AAI8Gr\/bAqAAUwKgAB4NgH5BugXNrildQZVARAfWBhgAA"} +00422{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946727901,"pkt_ts_usec":370531,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ABjzZLGI0h+5iIqPCABFAAAoC+xAAEAGrXjAqAAHwKgAFB+Qg2CKV1BlboFzbFARA+vK4QAAAAAAAAAA"} +00417{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946727901,"pkt_ts_usec":370537,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0h+5iIqPABjzZLGICABFAAAoum5AAI8Gr\/XAqAAUwKgAB4NgH5BugXNsildQZlAQAfWBhgAA"} +00505{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11,"source":"http-manipulated.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":10,"flow_first_seen":946727901369,"flow_last_seen":946727901370,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":577,"flow_tot_l4_payload_len":653,"flow_avg_l4_payload_len":65,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.20","dst_ip":"192.168.0.7","src_port":33632,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":11,"source":"http-manipulated.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":946729142063,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.20","dst_ip":"192.168.0.7","src_port":33684,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00430{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":63151,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0h+5iIqPABjzZLGICABFAAA0svlAAL4GiF7AqAAUwKgAB4OUH5ARN20zAAAAAIAC+vCBkgAAAgQFtAEBBAIBAwMH"} +00431{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":63378,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABjzZLGI0h+5iIqPCABFAAA0AABAAEAGuVjAqAAHwKgAFB+Qg5SNfRmbETdtNIAS+vAp\/QAAAgQFtAEBBAIBAwMG"} +00414{"flow_id":2,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":63387,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0h+5iIqPABjzZLGICABFAAAosvpAAL4GiGnAqAAUwKgAB4OUH5ARN200jX0ZnFAQAfaBhgAA"} +00933{"flow_id":2,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":63498,"pkt_caplen":440,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":440,"pkt_l4_len":406,"pkt":"0h+5iIqPABjzZLGICABFAAGqsvtAAL4GhubAqAAUwKgAB4OUH5ARN200jX0ZnFAYAfaDCAAAR0VUICAgICAgICAgICAgICAgICAgL2FhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYV92ZXJ5X2xvbmdfdXJpIEhUVFAvMS4xDQpIb3N0OiB3d3cubGFuOjgwODANClVzZXItQWdlbnQ6IE1vemlsbGEvNS4wIChYMTE7IExpbnV4IHg4Nl82NDsgcnY6ODEuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC84MS4wDQpBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL3dlYnAsKi8qO3E9MC44DQpBY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTLGVuO3E9MC41DQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUNCkROVDogMQ0KQ29ubmVjdGlvbjoga2VlcC1hbGl2ZQ0KVXBncmFkZS1JbnNlY3VyZS1SZXF1ZXN0czogMQ0KDQo="} +00795{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":14,"source":"http-manipulated.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":946729142063,"flow_last_seen":946729142063,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":386,"flow_tot_l4_payload_len":386,"flow_avg_l4_payload_len":96,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.20","dst_ip":"192.168.0.7","src_port":33684,"dst_port":8080,"l4_proto":"tcp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"www.lan","url":"www.lan:8080\/aaaaaaaaaaaaaaaaaaaaaaaa_very_long_uri","code":0,"content_type":"","user_agent":"Mozilla\/5.0 (X11; Linux x86_64; rv:81.0) Gecko\/20100101 Firefox\/81.0"}} +00422{"flow_id":2,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":63714,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ABjzZLGI0h+5iIqPCABFAAAoDhZAAEAGq07AqAAHwKgAFB+Qg5SNfRmcETdutlAQA+pgUwAAAAAAAAAA"} +01189{"flow_id":2,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":63907,"pkt_caplen":631,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":631,"pkt_l4_len":597,"pkt":"ABjzZLGI0h+5iIqPCABFAAJpDhdAAEAGqQzAqAAHwKgAFB+Qg5SNfRmcETdutlAYA+qY5QAASFRUUC8xLjEgMjAwIE9LDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbA0KQWNjZXB0LVJhbmdlczogYnl0ZXMNCkVUYWc6ICIyNTY0OTY0Mjk3Ig0KTGFzdC1Nb2RpZmllZDogTW9uLCAyNiBKdWwgMjAyMSAwMDozOTo0MyBHTVQNCkNvbnRlbnQtTGVuZ3RoOiAzNjYNCkRhdGU6IFRodSwgMDUgQXVnIDIwMjEgMTM6MTk6MDIgR01UDQpTZXJ2ZXI6IGdhbW1hX2h0dHBkDQoNCjxodG1sPgo8aGVhZD4KPHRpdGxlPiBSaWNrIFJvbGxlZCA8L3RpdGxlPgo8IS0tIHJpY2tyb2xsZWQgLS0+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cmh0bWwgewoJYmFja2dyb3VuZDogIzAwMDsKfQojcmlja3JvbGxlZCB7Cgl3aWR0aDogMTAwJTsKCWhlaWdodDogMTAwJTsKCWJhY2tncm91bmQ6IHVybCgnL3JpY2suZ2lmJyk7CgliYWNrZ3JvdW5kLXNpemU6IDEwMCUgMTAwJTsKfQo8L3N0eWxlPgo8L2hlYWQ+Cjxib2R5Pgo8ZGl2IGlkPSJyaWNrcm9sbGVkIj4KPGF1ZGlvIHNyYz0iL3JpY2sub2dnIiB0eXBlPSJhdWRpby9vZ2ciIGF1dG9wbGF5PWF1dG9wbGF5IGxvb3A9bG9vcD48L2F1ZGlvPgo8L2Rpdj4KPC9ib2R5Pgo8L2h0bWw+Cg=="} +00414{"flow_id":2,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":63912,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0h+5iIqPABjzZLGICABFAAAosvxAAL4GiGfAqAAUwKgAB4OUH5ARN262jX0b3VAQAfWBhgAA"} +00866{"flow_id":2,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":136762,"pkt_caplen":389,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":389,"pkt_l4_len":355,"pkt":"0h+5iIqPABjzZLGICABFAAF3sv1AAL4GhxfAqAAUwKgAB4OUH5ARN262jX0b3VAYAfWC1QAAR0VUIC9yaWNrLmdpZiBIVFRQLzEuMQ0KSG9zdDogd3d3Lmxhbjo4MDgwDQpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoWDExOyBMaW51eCB4ODZfNjQ7IHJ2OjgxLjApIEdlY2tvLzIwMTAwMTAxIEZpcmVmb3gvODEuMA0KQWNjZXB0OiBpbWFnZS93ZWJwLCovKg0KQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlDQpETlQ6IDENCkNvbm5lY3Rpb246IGtlZXAtYWxpdmUNClJlZmVyZXI6IGh0dHA6Ly93d3cubGFuOjgwODAvYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFfdmVyeV9sb25nX3VyaQ0KDQo="} +00423{"flow_id":2,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":136972,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ABjzZLGI0h+5iIqPCABFAAAoDhhAAEAGq0zAqAAHwKgAFB+Qg5SNfRvdETdwBVAQA+pcwwAAAAAAAAAA"} +04346{"flow_id":2,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":137159,"pkt_caplen":2974,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2974,"pkt_l4_len":2940,"pkt":"ABjzZLGI0h+5iIqPCABFAAuQDhlAAEAGn+PAqAAHwKgAFB+Qg5SNfRvdETdwBVAQA+qM7gAASFRUUC8xLjEgMjAwIE9LDQpDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQ0KQWNjZXB0LVJhbmdlczogYnl0ZXMNCkNvbnRlbnQtTGVuZ3RoOiA4ODk0NzkNCkRhdGU6IFRodSwgMDUgQXVnIDIwMjEgMTM6MTk6MDIgR01UDQpTZXJ2ZXI6IGdhbW1hX2h0dHBkDQoNCkdJRjg5YUAB8AB3AAAh+QQACgAAACH\/C05FVFNDQVBFMi4wAwEAAAAsAAAAAEAB8ACnlpu0maGspaa5o5qnl5eohZGbqLPHi5amtbXJko2imJKbqbfWqabBprG9jaCttrvWo520NjIpjZq0LjAcs63DnrC9maW3ODUyrsDajIyjLSwkt8TmwsfkpqGslZ7BKScXvcDNLjAplYuZNzAdq6zCNCwaRTk3LjAwuMryq7vjmqTDtKq5o6XDmqXMjqCzpZSaMy0mwL\/gnrDDmaXQQTAfpKvDtrC+oqvLoqzRrsHnucHalaPMJSIMlqXQwrjKoI2gsK7QqqzKwrzSHyALMiQPnKnLm6rSs73iqXZ5mWNbl6jCRDUowcPalaLDRSwnpYuVl5CNP0A0ho2ZIx4RpJ\/AYlhMd2hlq67ZmGdnm6rDU0g7MS0xW1NHSkM3f42VtpqxVTk2mYaJZVpUqnqCoabJnrHSsXp7wazCqKbIpnJqRztDsHyCV1A+lFtYVklEdGNciVhWhmhnpGxzlnyFlFxiXFZUSS4wtIWFamJWo2lat6SoiGNZmmtyRCkcoabQZmBOqJKJpGlnh1ZJn67YZjwldlpYlqjMVT5DhHNrtJqkLi4wd0g2pYeJenFqVTcqw87xl6jQHh0LiFxjioWIi4B3l4N6P0BBtpWMwMLOtZeYwqu1l3d5iFI4d1NJhUgpSEEuPjpDaWRlTURSbEErtI+lu6GZGRcWZjkcqHyQqq7RS0VFeVA+h2t0vtD4T1BFxKaneFtkxbG6poZ5p3FbtYV5UUAvb3BxenV2h3qEaEU4eU5SmGFKl3ZrtGh1f4CBg0w0ZVpmiHd2IR4Lz9DqXDQbZDs2tIuWlVc3Zk1UZ0hFZ11yd0QoVU1iXFRmqVxmtGdqNy5Boa7YcD4hlVxGhE1GQB8QxJmUVkpWilAt0LzDbGVynGA\/xZSIllMsxYp3Yj5CdTwaUC0mol030ba3tXpmsVxleW6AwtD0d0xEvoNuuHZb05J4qGI7fXSBw6GdeEAedWdzhUMcw5qiw56zUS0fol9Csm5IpmdJx46exoRoORwMzZF9kk4htHBJxoFcgj8aCP8AWwgUeOOGkYEHZxiZwbBhj4c9duyIuKNFxR0zBDLUOAOHx48f\/eDwQ5KMyCtXjqhcmYqMCpdkgixY0FKFh5sAcub0oLOnz50APKioESSIAJ0EACTNmdQDCRI1ajyNKoCnUgIHsh7IcIAAgQxgwyYY65VAAgIQIDBYuzbtgAEQ4A7wOrds2bF4vUIQwJavgL+AlWbASzhBWLFnAQBe\/NdqzrSK+T5l8DetgLRUIGSmwmKz5s+ZIXgQjfPnz7Jbw2rNKUECgNawX\/+UoKKIihsEW8wgc4PkwhmDGs6A+HB4RokWMeoWzpEhyeciR\/pJlXIlyxsvVdxOteDIgyM3WNj\/5HmTfGvyjq2W51w0FQSdCeAzXRrUp9etAFSDlXD4sOHBSaXFAAUMrDDgCmlB8ENcaf0AgIMPQogXWGTB9ddaBvYFgVeFEZaBV1Ic1pQANbBQFVJkleXTaGl5sBkVMMaIWYxUuBgaiwBA1tN7TCG1VWpc7ScbbEQOqRN2BfHG2wx+6IaDQkYsFOVwxFXZA0PKNWcSSR2RJJ2XfqC0UgwxPBKDSn6QQUYLvHE30wJBhKeCTuVJcBNs5AEQY3kQsIBGUSzIB0B8g15ll1aGqZgBaz195d9YObE1IAUUrEApBV8kqGCEP3Sq4HsOmmUYYXTtJSllPI012KikOioifRs6\/3pWWCrq1KJoou052k0wjgajZr+O9thPCTbqKJAZtLYokcy29pqdEmRxQxEtFOTHDUzi5geUUzJkZXHFzYCRcM6VyyR0z6WiEplHbEDmmUfUxKZMb9KEnQo1nkdjr3bWqOdNLWbGAgs89kRofIT+mB8AqeUH1lLlsfYoWpMO6IMPZ2SM8RlodEwBaL9qmqCoE7JKwFsDXPYeyR0COOh\/\/gHYX5CEDpujyC6KjGtoNOIK2c85Bn2zscjul2yzzHrgmtJZ1JBFtQUVsduT20ZpdZTfEifRuOSWuy10Hom0bgwbHIHCBmirlMpAN6g70wPfpXIDbwKx0HYqHs1Nxp41av+HGZ+OHdxTa2MdIMFWCRi+aM05VvYyYo9R4MOlPggBxBlACHHxGRt\/3KDOVGS6YWEi9Nfyqi3HN3oGIc7sOuO2\/ivjrVQwcCOwL97uGI8FG+vVYVntxx9sEDSrdFDR1tBCEQUVlNFywl1pRNYQSSSuuBzp1sK2I50bHQ4pkYkCCuyqlMIVOGh3wwJXfPeddwu0jVIq6sJd7xFB4Kud3+UBXJ\/BB0NYfAaTmkSZ5WWNO4qrKAQpCFAAAZeigBCEkDEg+MCClfMBGkQHOioQKC0cGkvpwDJC15nwQ2hRCswo5LqXQcorNxMQCQC1q9oBgUAv4tXsisXD9+ylWPPRSn\/\/lAWt8xDpeEzLAm+KUAQy4IAMDDFJQ35DJeoZpyI9sMhGMrKtjoBEJKlIQbvIN76zqeQKC6BWtRbgvvc9AH3ge8BMvCPHt6lNJkUJAgkGpikc5SQBzhKcaRxWKEgNa4GDKdSkIngGSmFOg2jI4A0xozMHsmV0E5JC6VR1wpklRlSdHEyyDKmUGDIgCA+kQBAIhhk0zIRABGMRC3xVo121aDQnEk3QCvaV1GxleIRLWhGNqL7mtcAIX+ti16b3LYxsDTlazMjzhBO2FuCgO2RyVwzGR7YjoE+NRejOEc73RjQWhH0LoMAcLcdG+9FRjkFAwCpVZqMcSQAyEoDdIA\/I\/yEVmeVD\/xEVABZ5qRs6kmNnmKAQ0ECBHX7uCx+sSwhVNSrXlU4EGN1kYULJQAEGSC0MVSelVkma2knQcrAcGCvHcyuf+UxYl\/GRL8NivGFCqz7GLIhHuNi16DXzetfL4rgGoszo+MEI4GtX2sSHthQsQCC2ucEVUvCA8y3AqsxDZ73SCQQ2CuFt9puJPMkwS2E9pnjFQ+BjGHMUgwEohKbTCwMQMDkKJJSCFACCBRd61zN8waEJqh2CJMqykmVgkyQsIQNFyToptK4\/TQFKoXI0KQR8VaQkSBAL5vqAGDxACPJkwMBwqbKWqrQxl\/GAACyAlGMFaZRGHKbSlAatGv8UpFph6yKXHHKlKlqJOcqZyEA0wr1ogOQBaCObu8p2Rty0QAXLuyrcUkBVOd4AB9WFm3bt+M4YcMCz2n0AECijGRbpyCd78YtUSMAYFfYzcYlzmVokp9AFKFShF8Pv5UTmmQU1iC4psstERZgBBWSgABllLOpg9rsPqeVUDHiPSRX62QnKUbR8kUlnwSsECuyxKgMTQGdi1JnTqvYyKjgvVn5UgF8eEU8wRh4TmdcbrwHHp9565tZ6e72KWCQ5PrYm+FBC5DFuoIwxsCoOBLK\/rFaXquOcSfvo6B3PVvm73+GAlh\/ABA4wQY579FXxzOoTES\/mKWhmAAkYYKgDwDf\/LwOtrA8QgIBG1lVz+VXo5f5KCp4lyL+lekslIUOyAh+YhKYjy1kGoJicqEAAaCZBKgXEgMzZd4L2jYEQ2DswEvhgw9q9rIkIFmIRc0alo+7TiduqlNQUoABHa03xoCUaaNGWJ0XIghq31xA\/BCd6z9PxMxvi460lZyDgo+44qfsdtD3iEWnzyK6hq51qMZvZ6A=="} +00416{"flow_id":2,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":137164,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0h+5iIqPABjzZLGICABFAAAosv5AAL4GiGXAqAAUwKgAB4OUH5ARN3AFjX0nRVAQAfCBhgAA"} +06335{"flow_id":2,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":137210,"pkt_caplen":4434,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":4434,"pkt_l4_len":4400,"pkt":"ABjzZLGI0h+5iIqPCABFABFEDhtAAEAGmi3AqAAHwKgAFB+Qg5SNfSdFETdwBVAYA+qSogAAu6pK3AheuB0By9\/esg6+DKdc2ZPMPblQVCJtgL4YiqJMSVmGJH0pOqP0kZfL2AQ99lc\/h4ZBDzbQCjL0bxWSEMEXLaEB000iwKCZBZKWZwQvVV8Lr3JgDBWCpt+lXQqQFdV7GZhoUW2iVfMIK0f\/g7Uwh\/kaJEoAO2tS03NuTC6KPNMQOtZeRH4sEOQUIalK3TaU16US465pINTWTjip61SnnlPZb\/K2tzlARzLpILwPMIqOejefnEDaAGk2AIHWIgDCmuVkjxnQWigFQUpd7KBA6BgaOOYxjn3h7r\/yL1wgMHBLWeqDmmmLCw1zgNJpEnLpvdBT\/vKUIJSIKEBAs4dRKYTvfLXynx35Ke0Lt3eRKeuSEvlmNzvyUlfFMStOlvAAKVs7KS1fSqPWrqHX04dMBDlB1oj1NtJzifxcTEp1lzffp7YmHb3aKmgCdM951TfhgPlv4s4Zw9vdq283wi7yo328Tm+wM8AANmhA\/wMoM5eulCVlgBF720HwgDnPWXN1nmAjI5mx+svdrwryL4PYYqBLUeaSgzchnhQZ7BVp64ZmRIEAC0BndIZK7YRpGgdPKhUEQNBZWkYmWBZ3a0F6JFd6BJNiMaUTP3IYxGMnY+Z6RYRry8NECXEuy\/Et3pJFwMZjuhddU8V045Q21RFtalItz7U\/axR1VVUvU9VO2rVt2aRlVOddZ6JdQSBauyI0PQJDikECYgd2BtBuazF+FgBDKlIZA4IAICA5XAZ\/+FU5FMQ596VQHfN2lKQpE+dhpzI6hdUfLUYAgNFpkfYUkScVQKCACyhHCth54eVZC4UGokWBG\/ZdHFcUav+iUpJCBntkYicSRKr3akhDWymIgsNFVLz2gtUjERFBEQMxVMyBEDfYdNSFNmKyAdB2BB6xJrgBXTZYVVOFXN6BRtL1He9yBO\/iLs92gRzwCBcIelWRGVK4fVVohWtGAeN3IZQxhUlBXpVFKSAgBCBAZ2iYZxizhgqlbxrkOZrydxE0hxMFUCsEFl0RGYy3h8zIhwyogPKEABvmWRgoXn8SBB3TVfXYbXm0WR0DiTExeiV3XvnBH7GWT7F1Jww5W63BREumLS24LS3QA8ykNc\/Ucz2lPUVgBFPVVFdFVU61AMtVNkuGdLdxTVNWVVRVNiMpXeuiTdm0AUpIjN6lhOn\/NE\/AwhMF8wNJQYVPIXYeZoWS0gDsNVkUAxgERVcQxJSUU1cXk2fy11fiKCATt2bmeHZfIYD+kRRmJmI18BfrRiIM4Id\/2ICSVog3+QAUkI9k9Sf86HniNRN59ISid3F8VBocoo6\/lJAn6JB3YkSduBy60SS6QT0TYXtA1WvSlBFLhzYbgAHvg0bV0Vxssj9kIGXMhjZwUzbWdQMiiVwz6S5aphJKGG5ZhwaodozJiBSRYgBiiABZeClZCHaBQijT+H8NUG\/0ODk+sABvJzl1xTn111eRREEcNF8ZM3aUsmZ8EWGDsmCzIoDr6AEQt14qBRUmEpRA4IA5yUbd9i5C\/xAEMVEUqrmPcMOIchSB8tSdqil6peYTgAQkCJmQDrmJdwIAncgkn8gQzPSfowguU7SRPheSysaKH+mS8YN0TtQ+LIlcaeMdTvVz1PU2kUl9U9dt4\/meAuBnPLkjPaIWzLiFlJKFi8dLpiIAKxCbZHgxlqVQlhWV9OWNjZRQZyAyltJIlDIpWEl2fxSAqPMw6whpFBh5M1QUT\/FAClg59kMBD+BlnudZ7pmP+qiPaKBX9Vh5n7dd72ligQNINFWfstY\/dWJrDjmY2sNrWGJF3NJTO4V7OxAlM5ECTYUSOniSz7VGIrmZLvkdGJAC14QBG9CZMokBGIhl39GdZMUWqP8WGnqiE45KF16XEwNgAWTnOFNoIRYDAu73WQuIX\/cVld6YhpmDfwmySJljV2O3FkdZSIoWpKMUHyoAcXoFj\/JEgfbGeRX2pIxYjFMqd\/pIBnJXgVIabofKlh7oqPChLDSleudBpreWgvqJprSnEA9xkTx2NVRkBNEwVVewEBchXBWBXdSVoHJELUkXTrsIoYO6ipE5E2QTr0oYr+yyAECQCuQJiaSHlzhCBWnHSz9ZK5RqF64JAHBhMQ\/0aZ+VqxdTYVK5hpNzOWigMwzAUAm1oyrzFyoEKR7CQrBBKKqFZnplpH8YT5gGN\/fKq4f6eSP7hHI3MHtDBhUoXkBQJr3\/6ln4imqlgRf1aTSxdifJUiezdaYDsUVdk5jEASUK4Z9XMwhTlQPnYwThGiXWEw3nkxIgOXvKtz4t2WztSqeDOhOQCaHz+nn6yAJkIFpp6yd\/ok571Cfm5q8DFShd12oBK2BUSBcnI6JqlrBNyZR0xamiGpVouJxrQQULsiD\/drgnB0OEUR8c2yFwBgCPdoAlcqQOiGn4qnFRKpdHMKUjF7Mz6z7DyAGECCdkZZBj0RqpIaY\/K7TRWkQC8RtSs0W9B6AWOUVWAyXdynQbkALRMBy7Zz040Lvt4k14+oNr9B1Md20YIKh1BKFeywGcCTfkSZ7CGpAxcWl4WRU8tHhM\/1EzeOuFV1FKhvJDkJZKbNd2CVtvdeV\/bfE5n+JDU0hRj6sZAeiqeOFeOQFxYEcCJVsU9tUd9\/pOpXuBW+qeokUF51mzVnaTpgtqcNIZPCFQ9cliYZqCQ4uCmji7Rct7OeZbucu0U+K0YJsDaIMCUSu1D\/FjDBENvftNLaB82tEELSBdFTqnkSmovzunbbRh3rQAOBAnN7BKwrqoqNRZWbeajkOka9ZagzJRAlZKIGQXCUJfDFh5hJuN8QhBGSIyDvJfSuEgnfKTK9RADOABq1sYg+Ia0fkwSfFoItZVN0SPocZGvliPjCie+IgGwgqzDkx99\/ikMQAnc8IaCJnIyf9SAIn8rA3pehssAfspEBSRYz0ACUk7JbtrBCmQA2X0yRsAtd+Kexrpn8PVBDY8wypArjm8ADw8thY6mt8VP2iLiOdZsX\/CeaabUqsZsggwGb4jKjDEaDczvnsnABLUfi+KeZXDBIT7dhFWSf6FuPpHv4WVdhEWQJDCH2Dqs7RyAFUowErsqXrsecMwDGbyeR1jO1QgrKmgXQ7Kq1TXZZ5FAnPyOxeMkIwsPDAGydF6phshbGt6ydd6rZqsEFaLwp8MylA7CFL7Y8VWis+Vysmnpw\/wvDxMNiyZbYS6EvAUHjXwiGqCiBpmgVlXIhhGMH\/BAmf5y6ymIm+hlGsXYQH\/MhdzERdzxX6Tc41C4MwX49OE+0HJyV+ZASE+aRek8mCZ9Ues97g5MURGQwAecErqdGndxQTGusdkYiaf2zFklb2j+y5KqMQLYM+DoxqJDGtGM7RC28+01XtBFde+lZgzFqdRcoOhfLwr0bxXgHOk3HOAjcoDkVUWCpmQ+ZJCPBPNkyQfJ9Lh4ccsAJ72OJ4QF2LiURUCII8IUAM6QcyRQVAUAAJjeBmMdjJ0kTLC2antJ9pRKbicSgGlBcaDRsZmfBa5aSls9jLFgzBB8R7NusbxoVosEE8z0VXslJ5KuMc3q6hsu48OepPWl05hZnD8QQCHo3qGw6z2eWsNCZjI\/7Gm4uJMMTg9kDARUnsQRlAGqdi87I0S5+PXxgbYLeABOyDYy7M+ugi2LPm8zKbYtjGr2gGzZFXEIvdxQcC5TdpppicAjwbA7FV26cYWlzKGSgrbBitRgsYXwvlA7MeprM2AMioyydmWO\/pvoZEUto0WGk4gTL2\/hBKCquIaq\/shQVFp9lXVeaWlh4rAnkcTi+rHDBXW9jPdTNEwrXY4QnQ0\/NzdmsiQrjFc4T28wjuKv0G1HQm2aKPQUFtGUIvCOTDK1PpjFW3RD4DCh92SnGlO2MEmbKImvMECthUTDKAmJKCr77IAa1Eip3UZLAB2rMZoMV0gFCCUg05v7IUyp\/\/9Fl9gKT6Qjdt4MYKrjRiDIDqTKY6kOWnYYZGaF3g40wcESBCwv3F2IoBEGITTv+pkOShb0kp8k+DFcXGnUsJapELwbeKFfT2R3f\/DFTnRl0SUNP8MmK3xTFeSmBjRW1JCwjM2VQvd7OOTwiqcRsM1ewKRyteE5YZt2EoYtovN2EkyMP8YExRQZV22ZY4nFSbylZPRVoDudePXt3LIfysgAB0wFwqgACgzAItuA02ZQY0uuM+MKWmRnBAVSQ97BtEsGGJxMnzxHgKkkISiZqK1200N8VLNtpkjXuq0XZnWuVKqmms73EFAP5U3wbqkE2DhaI6hOIqTwaPxrI5sphL\/gJjFISU2HyUseAWe7Ow8fzZXwEQr+DynvDztgzZalu2QSb2s+HzNUxQFEScD8\/RFQRTpWe5bNhUlstKm8uAFw2jInI2wCTdcPGc2MHB6MAAvkPZp\/wRsnwiJ8AqaEAvZMPcKxQQ+jWfRPPBpcSmRJLHl2Bb\/5B8p0+L5VOquIVoS38ZIUzPkkStoUPJdBZ7fZfeetQCIiLYLPNxyJ1o2IVNLQyJUwRNZ4TD0CfP+zMGwEaABeuwyaJHaajXqDe1n0\/NcjvMr2JHOxWTWhOVKb+ZI71RMz\/RNXxBRX8RxQvWIGgN2\/wBQoeeLkXhB8xZeV+HaqI3ZEAt6kP16UAqZ\/5AJpVAKl3AJd3AH4V8Kr\/AK45D+c2\/3TIBnPjDvEMBBBa8x+HVS7BuNYsEVaFdI91Tq\/QsQAliwoAIggQQJBxMcTLgwgUEAET2wCCLE4oMHHDRujPEACJqBIAeOHAnBg4eIAA5kOABARQ0gBoDMJCEAgISVByQUyJBBAgQJJ4UORSkU4Y4ePZAmVQop6QwjUI1MpWpk0KArOTZs3YrC61euXFNMLdKiyNkZZ1usNbsgxVatcDFs0LghR4oFN\/SS4as3SCq9elncGBgkCIsaQR4wwfggRgwmC0ggriHAskkBEGwCgGABwICIAkggQECBtA8KmjTpKXXpkjVrri9x4\/\/mjRatdEhu07rz2tqrV+PG+fCBYAWDzBCUK2dwxuJz6M8RLCheM0OC6w4JGFS4EOFCAAwGJr\/p3TvC6xIiPnwIAc1fIKUXxF\/QWAiQwyRJUvGQGSV3hAAQzQDSEIgPgRpUUEkn9HwSCoAHifIgqAmTgmQppZjqAaoZpKoKqytSyOGrEXM4AoUjNkBhAxHjSuGKBYww6ywZ2VoLh7fC0rEVFHJYQK0i+OorlQWOSMWwIMhgQckamvwro8Y0YmyyGki6zLLQNLNMAAZIoICCLouz4ZXW7riDm31q82bNfNSZZZZd4tzlzTfT4M2aUvTQo4MvBlgOgi+OQ0OIx6JbADr\/4h5YAEwCCDigUQIS2A6ih8p7yIMuJ2MADSoguOkHSxvqLiVMKVigyAeEOLUxjFTNTz+C\/PM0pYheqsEAmXDFNcGIVuoJIWAhlHAoCI\/ScAeknEoqqg6puiqaFET0qhUev7L2WmpXfPEKI4Asq6wWcHhgqxw5WJEubX886wYy2MUhlSOO4OAIjPK6AQ0SbpiMosWYgGyjB0ioYd8tO73SMhIS9rJAAygo7pVMLrnDm3UqblMdjO2p55hjsPEEG2yO4QQbTjjZZhc7L8nkhQFaZo4BBihwLgaLfBDCZudUXdRmBIIQgICerjvgAEnZqxRATEkIQunSCvpBvYS++w6i\/5RYIKG+GDh47LGNHtH6AQpEEo8gFgQ4aVaqLfAsIhfadkFtF3r1lUEJqODPbg\/4G3bCpZDtARLAd4BKWaiuuuLwHL165Npps\/2qWhQ42ApGcNcC1y1y3\/pK8g0U7baIvfTC4YoH5H3kkY6A0Jew\/IKojwMmmICdMSCarGxLszNDeLQCSQMBBASIO4M1bipeJ59+2BGHHeXF6aYbT6KPHmTpS57zNpVZDlTmL3O2"} +00416{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":137217,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0h+5iIqPABjzZLGICABFAAAosv9AAL4GiGTAqAAUwKgAB4OUH5ARN3AFjX04YVAQAemBhgAA"} +04354{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":137223,"pkt_caplen":2974,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2974,"pkt_l4_len":2940,"pkt":"ABjzZLGI0h+5iIqPCABFAAuQDh5AAEAGn97AqAAHwKgAFB+Qg5SNfThhETdwBVAQA+qM7gAA6IwzHDbN4dJMQ6CmRhMgeqFIjQYvoYgSXroiIAqC6OmfGDqIu0YhjJnVxxxhaxqJwQJEQhIVdIpWknLJrQzgQNs1CWYqUBBOMnATCOlNg\/xpwv9JOlihDAGOKcyaQQ+oEqJoSWtFjLOW41hILm7ZyHKYiwFXzHUuDFzhLDtcCxneFa+ucUAHCwhCYhCDmCAgICOw0wFjzoeYLXlAS7pbGAge0DsQfIkCYyoFbSrmj350gx\/8WJ7yjiG96P1CjZ74Rcmsl4dZ8EZliVjBGYTnveichjRfIk1NsMS\/7bBHPQBST5cMEzMgMCAioIoasBqynklBCAKuwxoBBQgwIurnbCl5SCFzRSADzcRAOIgJrwgwSABwsAmrXKUKmqACD55EAknZgQifwiwjmNAqKEyhXUZ0LnLF60ReSdG5tHKXF8VIhmbBEV024pUNYCBaZdghuPr\/Qrp5YUReQlRUEAgzEBIAYYmMwQgJVLCl8WgmNKIp0EyC0DAt2kATrcGNOuxhD3Y8b3n4dB4a2ahGNbqxZNOAIy1cUwpN+CAbPrAjdOxDGossajoLOF\/CkAMponHHIRsNj9LkFwRFsgcA6VukJNVTqe2chApoeN1jHJO1Qi2AAZ0aiHL+Az9P4goHDEOArkhjAEXqhFSvpGBRi8pKWSIFQ7r0EFRClANktgiqXoFqVa91hBRAs0UsitbhfmS5s2DOK3WJJl5wsMPPsWswVxBgY7ZJwG4OJDGvY4IOMOIzy5xTAHrlzO4SViUuMcAGDFiBJjKxhjTMoh7PY2w3xCGO\/2NA1mNpBOgvFrEIgAr0epdwxytisVA72myhNhOCfCxSPtKA1EsUIAFKgCZI8+wPAFYzTHxIAAGHqKd9EKACzEDqqQtSTYoMAAJMOdKRQgWBP2U7Ca0iop4a7LSn08HVAgyAA1xRV0G1Mmp3KdgCWK4SJUzpGy6dJdW7TLVxLGTvtKDpyxd97iyjUxFc8JIXtczIcu26QbxiIMyN0Ct2BTzMwJSYkdjpAEEs0GvudIew1BaxBjBbQQc6kAhGpCEPZ\/xHPOLhiXi8Q3rLIDGJLXvZRYxCxaNYBmbdOI1d5CEdl9DEcMAXWuLkmLUOo6hh+mi1PiKHagppCPwEFE7SAP+BBAXpJETqFjMwYUmkEuEtGkrnGI5ghAMPOEx\/WKCcBWIwC7rCrk7JnN3axc0lRh2IUcFLQfECAEM7yCWdpVI4aUEVve1loeOypaOxFEG+C0Ah5cDbhGX28AZEcszpNpLN0vnrioRJjBI3EpnKlK1sB+MSCXxQrz1ucQUryMQd0jANbIBD1R9+R6vBIQ1Yw7rFKB4FIUYhjRUvo42cmIYgBLGHNCB0HJoorB212MeEfUlgVpvM7izDgiF3Bz0PsdqBaoeSSh2ttxRYWpVmdTRJsgAIWJPd12SnKOSwoLnO9QAFb1XmM5e5zD3drgXYrAIGe9cDH8yQUpbSIYAbIRr\/v9QzwRn3SxS4MOE8gpxdxHLWqZhFvpVjCw\/N0oJ2xat0jp7XlrUJpVclpl+we0BlxvZszSiHnQgAQXEKFIsx6eES6bjHGT3siWWoGtanIETPbU3rWvucENLQ9SJWwQlf\/1oWwFGNDXRsPoV5qdkJwx3uPACejQILO0eezhM1yhne9lZpS0sYtGllv7yhgQJafrRLKRArk3wmJQ4sEAZ6StFTESi7p5pPguy9Vwrmmy\/fzZsrx3usv21oKlCBVlWR6XiqlsiqkGMcXKBKLhp1K9EyzO\/Fb6AYAHr84wCTMGUUE7stE2zTlpHilha2x+DFIhaaeIU1vEEOjXXME+A4\/4U0TvF74PNc6D0nBjF8jmKkT0P5gsACIGqsiVgoNMe\/Kw1pKMpa20adBDD79kN8Iir1UGE0RNyMQcJvN9+q\/urgoZUUByLOGHhNI43p8rpdIgCYFOhUdjcABvzPd7zzPwzwiASpkqJiMAYjA\/B6M8PzgL6hJaUqIcaTqhQYBPSCPMiLPGi6PD1LoRdZi89ZJmTZgc1bixuoD43DMmFqDNkhMKupEiSqjyu6nU07Jy3BjJUrDR+IhWF7BXeoDXKoOZx7h+DjuVMoPkf4veEbvlFAsaM7OqUrhVfQBKcjjt6pPoZBMiXjne0rP4fIDgnwiesQAMOgALMJpHAbD2Ybif8aQBvnEhYVIINUYDvSM5v\/AAALgJn86ykDwLsFEEAE+L\/peAAdGECPIKUbgEEExDfvWiU5G0GnqCWmmgELJLhoKRE+y0Sq8kBu2QFB6zwbeSUZUgGMA68THBeMiL9Hg7QekyuSSBjSAKzxuAzNkCItWZgtoj0f\/EFvmIVt8Jh3AIdgBD5C+L3iKz4lXMJcQ7HLsixBSII7kEJNMB8+6qPeSRhcITuFgYD0MZpfAQAxTACKWBqbiJSI0IxZFA1uG7vNcIiU8BQpwjfDqCQOEALmArPQYAAVqIAKyAJ\/1JXrAqWfIhAZHEADOZXaqYEsoKDBI8WjagIAsJALYQoOkYr\/SuyRS+yRTFS4FuIRGOIWQauRb6mcIsABHFgAHBCM72qBU9warqGXlzoCJEFAw2iSTWsSgXi2TTMYlWOnHDsD2nMHa+AGWvDFjiGxV\/O94DtGZBS+JbS1FYvKy9qDaNQDKkQAG1iB0WAt7ds+qdu+LvmZnsitMBzLg7ggiigb87uO0DgifPMo+YE2oQA3SXI\/FniP+iC\/s\/kPW2EAB7ouk8SunSKznVqVejmViVKdG8A3BSQDhzwqOUs8SYwKyjyhrCo49dLETGQRbvkczRtJszjBFHipB7gCdnHIG8CRcdmKjmiM\/1oAJJoMSuoZBhMITVPDzNCr1huNVvEBLrqE\/9sgB6P0mGXANd8rPkJwBKYkBqdMRp8rBhWDzlGQzkXoBFnIk6YbtdUCSxLQFQbAFapDDgsAmkcxiOv4ldg6p5EKGnAMLvxLkPeUq2bjErOjFQhQAZOgAoKwm4G4Q1oZEJkYN+vzv+kQQAFsDB2IAbtqDAwoREUZCHYhgyxYTKNyQA2hJRPykKmgQEw8OM0Eiw3oTLJoAZEEq9SsD9akFxhZzMA4wbnYgACSF0WpEm+aRyFQlIQcCdvMySvRjNH4tAfwzRXQA2u4A3IQzl3YBt0rzqBDTuVEQqcchVxQsVy4rFVYBWa8LOg0Ol4ohVKwAaejgBWAJwpoADI9Nq40gP\/tG6n+wQ7sKMtRARr2bM\/+eTa4nM\/+2D5si6S9zBv7ecORcol3uhXrIw0MoCglMlBDxACXNEQdYE1FaVEVuIEFpCAHHEF\/QxaAQxar8ECpuhbHQzir6pFfsq9oCMFStJEiIMWwSoEB3AoBOgJ70YuXOElG1Qiv6aaadB0WVBSBsR0dFYjl2J0CEVMivYN0EM48uIeNIc6dK0afCz5CyAVqvdJf24M9SAJt3QM4EAQsTbFiqM4uzRMwzUo+0iLzucLsOp9yzIBAwo6gGZWgaYmI6AlHkQhmkx+BgSXRCAL\/PMdzlKJ\/fUMPsJ2AXFeK8r8HwIDfWdTHgFFDJETWnNX\/wOiuS0UKqlCKZjECSDCCp0qhDmUhUVWvzNSK+KoRzau4InilLCiC+ohY0qTQdTlRrslVJNGXtWNBxtBGixoPKthR0Ug2Mf2CiEFWclCHPNiYjvmFElsGFUsxo6vSy+qEa00CLEgDrJUFJEACWUgDLNgDXUAHah2FVeCFSyBXMK1GCmiYKyzWrQSqcjRHNw1Dhbgge4WQzbggoNmOHR3HyTinJmHT9puVuHtDrIsI28kCwSwDgAQlVpHBBIVYjGhQZ8KAGwCdwACvhXQlTA2RK3CKqrAKDszID32cx6kWGDqrlDQCHAgXr3IlFXBZFBWmx0iBFm1RcdKyAnoPbzpF\/0ljDCHYF2ZDDpTLzZULUjF9AYlZEw=="} +00416{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":25,"source":"http-manipulated.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946729142,"pkt_ts_usec":137226,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0h+5iIqPABjzZLGICABFAAAoswBAAL4GiGPAqAAUwKgAB4OUH5ARN3AFjX1DyVAQAfCBhgAA"} +00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":328,"source":"http-manipulated.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":318,"flow_first_seen":946729142063,"flow_last_seen":946729148160,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":29200,"flow_tot_l4_payload_len":940892,"flow_avg_l4_payload_len":2958,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.20","dst_ip":"192.168.0.7","src_port":33684,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00137{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":328,"source":"http-manipulated.pcap","alias":"nDPId-test"} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 328/328 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 948153 bytes +~~ total detected protocols..: 2 +~~ total active/idle flows...: 2/2 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 1940172 bytes +~~ total memory freed........: 1940172 bytes +~~ total allocations/frees...: 35662/35662 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/http_auth.pcap.out b/test/results/http_auth.pcap.out new file mode 100644 index 000000000..0ea92817c --- /dev/null +++ b/test/results/http_auth.pcap.out @@ -0,0 +1,31 @@ +00477{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"http_auth.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} +00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"http_auth.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1381844050222,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.4","dst_ip":"192.254.189.169","src_port":54337,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00443{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":222515,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"TBfruiThKM\/pITwrCABFAABARSdAAEAGtjzAqAAEwP69qdRBAFCa4jGyAAAAALAC\/\/8jTAAAAgQFtAEDAwQBAQgKH38TuAAAAAAEAgAA"} +00439{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":402547,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KM\/pITwrTBfruiThCABFAAA8AABAADgGA2jA\/r2pwKgABABQ1EEDZtH9muIxs6ASOJA\/hAAAAgQFtAQCCAowzbX3H38TuAEDAwc="} +00427{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":402655,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"TBfruiThKM\/pITwrCABFAAA0XSJAAEAGnk3AqAAEwP69qdRBAFCa4jGzA2bR\/oAQICuGBAAAAQEICh9\/FGkwzbX3"} +01418{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":402794,"pkt_caplen":805,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":805,"pkt_l4_len":771,"pkt":"TBfruiThKM\/pITwrCABFAAMXqUtAAEAGT0HAqAAEwP69qdRBAFCa4jGzA2bR\/oAYICs3TAAAAQEICh9\/FGkwzbX3R0VUIC9wYXNzd29yZC1vay5waHAgSFRUUC8xLjENCkhvc3Q6IGJyb3dzZXJzcHkuZGsNCkNvbm5lY3Rpb246IGtlZXAtYWxpdmUNCkNhY2hlLUNvbnRyb2w6IG1heC1hZ2U9MA0KQXV0aG9yaXphdGlvbjogQmFzaWMgZEdWemREcG1ZV2xzTWc9PQ0KQWNjZXB0OiB0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSxpbWFnZS93ZWJwLCovKjtxPTAuOA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfOF81KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMzAuMC4xNTk5LjY5IFNhZmFyaS81MzcuMzYNClJlZmVyZXI6IGh0dHA6Ly9icm93c2Vyc3B5LmRrL3Bhc3N3b3JkLnBocA0KQWNjZXB0LUVuY29kaW5nOiBnemlwLGRlZmxhdGUsc2RjaA0KQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuOA0KQ29va2llOiBfX3V0bWE9MTkwOTA4MjgxLjE1NjAwOTU2MTEuMTM4MTg0Mzk2OC4xMzgxODQzOTY4LjEzODE4NDM5NjguMTsgX191dG1iPTE5MDkwODI4MS4yLjEwLjEzODE4NDM5Njk7IF9fdXRtYz0xOTA5MDgyODE7IF9fdXRtej0xOTA5MDgyODEuMTM4MTg0Mzk2OS4xLjEudXRtY3NyPWdvb2dsZXx1dG1jY249KG9yZ2FuaWMpfHV0bWNtZD1vcmdhbmljfHV0bWN0cj0obm90JTIwcHJvdmlkZWQpOyBfX3VuYW09NmI2YWI2ZC0xNDFiYzUxYTgxZS00MTAyYTY2MS0yDQoNCg=="} +00815{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"http_auth.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1381844050222,"flow_last_seen":1381844050402,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":739,"flow_tot_l4_payload_len":739,"flow_avg_l4_payload_len":184,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.4","dst_ip":"192.254.189.169","src_port":54337,"dst_port":80,"l4_proto":"tcp","ndpi": {"flow_risk": {"36":"Clear-text credentials"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"browserspy.dk","url":"browserspy.dk\/password-ok.php","code":0,"content_type":"","user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/30.0.1599.69 Safari\/537.36"}} +00427{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":596540,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KM\/pITwrTBfruiThCABFAAA0Z\/RAADgGm3vA\/r2pwKgABABQ1EEDZtH+muI0loAQAH2ivAAAAQEICjDNtgoffxRp"} +02365{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":802943,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"KM\/pITwrTBfruiThCABFAAXcZ\/VAADgGldLA\/r2pwKgABABQ1EEDZtH+muI0loAQAH1SGgAAAQEICjDNth8ffxRpSFRUUC8xLjEgNDAxIEF1dGhvcml6YXRpb24gUmVxdWlyZWQNCkRhdGU6IFR1ZSwgMTUgT2N0IDIwMTMgMTM6MzQ6MDIgR01UDQpTZXJ2ZXI6IEFwYWNoZQ0KV1dXLUF1dGhlbnRpY2F0ZTogQmFzaWMgcmVhbG09IkJyb3dzZXJTcHkuZGsgLSBIVFRQIFBhc3N3b3JkIFRlc3QiDQpFeHBpcmVzOiBNb24sIDI2IEp1bCAxOTk3IDA1OjAwOjAwIEdNVA0KQ2FjaGUtQ29udHJvbDogbm8tc3RvcmUsIG5vLWNhY2hlLCBtdXN0LXJldmFsaWRhdGUsIHBvc3QtY2hlY2s9MCwgcHJlLWNoZWNrPTANClByYWdtYTogbm8tY2FjaGUNCktlZXAtQWxpdmU6IHRpbWVvdXQ9NSwgbWF4PTc1DQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQpUcmFuc2Zlci1FbmNvZGluZzogY2h1bmtlZA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCg0KNWYxDQo8IURPQ1RZUEUgaHRtbCBQVUJMSUMgIi0vL1czQy8vRFREIFhIVE1MIDEuMCBTdHJpY3QvL0VOIiAiaHR0cDovL3d3dy53My5vcmcvVFIveGh0bWwxL0RURC94aHRtbDEtc3RyaWN0LmR0ZCI+CjxodG1sIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIiB4bWw6bGFuZz0iZW4iIGxhbmc9ImVuIj4KPGhlYWQ+CjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PWlzby04ODU5LTEiIC8+Cjx0aXRsZT5IVFRQIFBhc3N3b3JkIEluZm9ybWF0aW9uIC0gRmFpbHVyZSAtIEJyb3dzZXJTcHkuZGs8L3RpdGxlPgo8bWV0YSBuYW1lPSJkZXNjcmlwdGlvbiIgY29udGVudD0iRmFpbHVyZSEgWW91ciBjbGllbnQgZG9lc24ndCBzdXBwb3J0cyBIVFRQIEJhc2ljIEF1dGhlbnRpY2F0aW9uIG9yIHlvdSBwcm92aWRlIHRoZSB3cm9uZyB1c2VybmFtZSBhbmQvb3IgcGFzc3dvcmQuIEJlbG93IGFyZSBsaXN0ZWQgd2hhdCB5b3UgcHJvdmlkZWQgYXMgbG9naW4gaW5mb3JtYXRpb24uIiAvPgo8bWV0YSBuYW1lPSJrZXl3b3JkcyIgY29udGVudD0iZmFpbHVyZSxwYXNzd29yZCxodHRwLGJhc2ljLGF1dGhlbnRpY2F0aW9uLHByb3RlY3Rpb24iIC8+CjxsaW5rIHJlbD0iaWNvbiIgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvZmF2aWNvbi5pY28iIHR5cGU9ImltYWdlL3gtaWNvbiIgLz4KPGxpbmsgcmVsPSJzaG9ydGN1dCBpY29uIiBocmVmPSJodHRwOi8vYnJvd3NlcnNweS5kay9mYXZpY29uLmljbyIgdHlwZT0iaW1hZ2UveC1pY29uIiAvPgo8bGluayByZWw9InN0eWxlc2hlZXQiIHR5cGU9InRleHQvY3NzIiBtZWRpYT0iYWxsIiBocmVmPSJodHRwOi8vYnJvd3NlcnNweS5kay90aGVtZS9yZXNldC5jc3MiIC8+CjxsaW5rIHJlbD0ic3R5bGVzaGVldCIgdHlwZT0idGV4dC9jc3MiIG1lZGlhPSJhbGwiIGhyZWY9Imh0dHA6Ly9icm93c2Vyc3B5LmRrL3RoZW1lL2RlZmF1bHQuY3NzIiAvPgo8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCIgc3JjPSJodHRwOi8vYnI="} +01078{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":804265,"pkt_caplen":551,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":551,"pkt_l4_len":517,"pkt":"KM\/pITwrTBfruiThCABFAAIZZ\/ZAADgGmZTA\/r2pwKgABABQ1EEDZtemmuI0loAYAH3Q5gAAAQEICjDNth8ffxRpb3dzZXJzcHkuZGsvanMvanF1ZXJ5LmpzIj48L3NjcmlwdD4KPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiIHNyYz0iaHR0cDovL3d3dy5nb29nbGUuY29tL2Nvb3AvY3NlL2JyYW5kP2Zvcm09Y3NlLXNlYXJjaC1ib3gmYW1wO2xhbmc9ZW4iPjwvc2NyaXB0Pgo8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCIgc3JjPSJqcy9qcXVlcnkuYnJvd3Nlci5qcyI+PC9zY3JpcHQ+CjxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij4KLy88IVtDREFUQVsKDQoJCQkkKGRvY3VtZW50KS5yZWFkeShmdW5jdGlvbigpew0KCQkJCSQoImFbcmVsPWV4dGVybmFsXSIpLmNsaWNrKGZ1bmN0aW9uKCl7DQoJCQkJCXBhZ2VUcmFja2VyLl90cmFja1BhZ2V2aWV3KCIvb3V0Z29pbmcvIisgJCh0aGlzKS5hdHRyKCJocmVmIikpOw0KCQkJCX0pOw0KCQkJfSk7DQoJCQovL11dPgo8L3NjcmlwdD4KPC9oZWFkPgo8Ym9keSBpZD0iYnJvd3NlcnNweWRrIj4KDQo="} +00426{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":804299,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"TBfruiThKM\/pITwrCABFAAA0JFRAAEAG1xvAqAAEwP69qdRBAFCa4jSWA2bZi4AQH+F6KAAAAQEICh9\/FfcwzbYf"} +00538{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":804861,"pkt_caplen":145,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":145,"pkt_l4_len":111,"pkt":"KM\/pITwrTBfruiThCABFAACDZ\/dAADgGmynA\/r2pwKgABABQ1EEDZtmLmuI0loAYAH06nAAAAQEICjDNth8ffxRpNDkNCg0KCQkJPGRpdiBpZD0iaGVhZGVyIj4NCgkJCQk8ZGl2IGNsYXNzPSJpbm5lciI+DQoJCQkJCTxkaXYgaWQ9ImxvZ28iPg0KCQkNCg=="} +00428{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":804893,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"TBfruiThKM\/pITwrCABFAAA03TRAAEAGHjvAqAAEwP69qdRBAFCa4jSWA2bZ2oAQH9x53gAAAQEICh9\/FfcwzbYf"} +00728{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":805596,"pkt_caplen":288,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":288,"pkt_l4_len":254,"pkt":"KM\/pITwrTBfruiThCABFAAESZ\/hAADgGmpnA\/r2pwKgABABQ1EEDZtnamuI0loAYAH3nAAAAAQEICjDNth8ffxRpZDgNCjxhIGhyZWY9Imh0dHA6Ly9icm93c2Vyc3B5LmRrLyIgdGl0bGU9IkJhY2sgdG8gQnJvd3NlclNweS5kayBmcm9udHBhZ2UiPjxpbWcgYWx0PSJCcm93c2VyU3B5LmRrIGxvZ28iIHdpZHRoPSIzMDAiIGhlaWdodD0iNTMiIHNyYz0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvcGljcy9sb2dvLnBuZyIgLz48L2E+DQoJCQkJCTwvZGl2Pg0KCQkJPGRpdiBpZD0iYmFubmVyLWhlYWRlciI+Cg0K"} +00428{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":805617,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"TBfruiThKM\/pITwrCABFAAA0s2FAAEAGSA7AqAAEwP69qdRBAFCa4jSWA2bauIAQH855DQAAAQEICh9\/FfgwzbYf"} +02367{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":809623,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"KM\/pITwrTBfruiThCABFAAXcZ\/lAADgGlc7A\/r2pwKgABABQ1EEDZtq4muI0loAQAH36uQAAAQEICjDNth8ffxRpMmQ4NA0KPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPgovLzwhW0NEQVRBWwp2YXIgZ29vZ2xlX2FkX2NsaWVudCA9ICJwdWItMzc4MjU5Nzk5NjIxNjI1NyI7CnZhciBnb29nbGVfYWRfc2xvdCA9ICI3NTY0NDY5MzQzIjsKdmFyIGdvb2dsZV9hZF93aWR0aCA9IDQ2ODsKdmFyIGdvb2dsZV9hZF9oZWlnaHQgPSA2MDsKLy9dXT4KPC9zY3JpcHQ+CjxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0IiBzcmM9Imh0dHA6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvc2hvd19hZHMuanMiPjwvc2NyaXB0Pgo8L2Rpdj4KCTwvZGl2Pg0KCQkJCTxkaXYgY2xhc3M9ImNsciI+PC9kaXY+DQoJCQk8L2Rpdj4NCgkJCTxkaXYgaWQ9Im1lbnUiPg0KCQkJCTx1bCBpZD0ibWVudXRvcCI+CjxsaSBjbGFzcz0iYWN0aXZlIj48YSBocmVmPSJodHRwOi8vYnJvd3NlcnNweS5kay8iIHRpdGxlPSJCYWNrIHRvIHRoZSBmcm9udHBhZ2Ugb2YgQnJvd3NlclNweS5kayI+SG9tZTwvYT48L2xpPjxsaT48YSBocmVmPSJodHRwOi8vYnJvd3NlcnNweS5kay9hYm91dC8iIHRpdGxlPSJXaGF0IGlzIEJyb3dzZXJTcHkuZGsgYWxsIGFib3V0PyI+QWJvdXQ8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvYmxvZy8iIHRpdGxlPSJUaGUgQnJvd3NlclNweS5kayBibG9nIHdpdGggbmV3cyBhbmQgcmVsZXZhbnQgaW5mb3JtYXRpb24iPkJsb2c8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvY29udGFjdC8iIHRpdGxlPSJIb3cgZG8gSSBjb250YWN0IEJyb3dzZXJTcHkuZGsiPkNvbnRhY3Q8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvZG9uYXRlLyIgdGl0bGU9IkhvdyBkbyBJIGRvbmF0ZSBtb25leSB0byB0aGUgZGV2ZWxvcG1lbnQgb2YgQnJvd3NlclNweS5kayI+RG9uYXRlPC9hPjwvbGk+PGxpPjxhIGhyZWY9Imh0dHA6Ly9icm93c2Vyc3B5LmRrL2ZhcS8iIHRpdGxlPSJMaXN0IG9mIEZyZXF1ZW50bHkgQXNrZWQgUXVlc3Rpb25zIG9uIEJyb3dzZXJTcHkuZGsiPkZBUTwvYT48L2xpPjwvdWw+Cg0KCQkJCTxkaXYgaWQ9InNlYXJjaCI+PGZvcm0gYWN0aW9uPSJodHRwOi8vYnJvd3NlcnNweS5kay9zZWFyY2gvIiBpZD0iY3NlLXNlYXJjaC1taW5pIj48ZGl2PjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImN4IiB2YWx1ZT0iMDAzNDg0MTMwNzIwOTExNjg2NDI1OmItcmNkX19uYmJ3IiAvPjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImNvZiIgdmFsdWU9IkZPUklEOjExIiAvPjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImllIiB2YWx1ZT0iVVRGLTgiIC8+PGlucHV0IHR5cGU9InRleHQiIG5hbWU9InEiIHNpemU9IjMwIiB0aXRsZT0iU2VhcmNoIHRoZSBCcm93c2VyU3B5LmRrIHNpdGUiIC8+PGlucHV0IHR5cGU9InN1Ym1pdCIgbmFtZT0ic2EiIGM="} +02373{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":814178,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"KM\/pITwrTBfruiThCABFAAXcZ\/pAADgGlc3A\/r2pwKgABABQ1EEDZuBgmuI0loAQAH0DVwAAAQEICjDNth8ffxRpbGFzcz0ic3ViIiB2YWx1ZT0iU2VhcmNoIFNpdGUiIHRpdGxlPSJEbyB0aGUgc2VhcmNoISIgLz48L2Rpdj48L2Zvcm0+PC9kaXY+DQoJCQk8L2Rpdj4NCgkJCTxkaXYgaWQ9ImNvbnRlbnQiPg0KCQkJCTxkaXYgaWQ9ImxlZnQiPg0KCQkJCQk8ZGl2IGNsYXNzPSJpbm5lciI+DQoJCQkJCQk8ZGl2IGlkPSJpbmZvIj48cD5Ccm93c2VyU3B5LmRrIHNob3dzIHlvdSBqdXN0IGhvdyBtdWNoIGluZm9ybWF0aW9uIGNhbiBiZSByZXRyaWV2ZWQgZnJvbSB5b3VyIGJyb3dzZXIganVzdCBieSB2aXNpdGluZyBhIHBhZ2UuPC9wPjxwPkF2YWlsYWJsZSB0ZXN0cyBhcmUgbGlzdGVkIGJlbG93LjwvcD48L2Rpdj4NCgkJCQkJCTx1bCBpZD0ibmF2Ij4KPGxpPjxhIGhyZWY9Imh0dHA6Ly9icm93c2Vyc3B5LmRrL2FjY2VwdC5waHAiIHRpdGxlPSJXaGF0IGZpbGV0eXBlcyBkb2VzIHlvdXIgYnJvd3NlciBhY2NlcHQ\/Ij5BY2NlcHRlZCBGaWxldHlwZXM8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvYWN0aXZleC5waHAiIHRpdGxlPSJEb2VzIHlvdXIgYnJvd3NlciBzdXBwb3J0IEFjdGl2ZVg\/Ij5BY3RpdmVYPC9hPjwvbGk+PGxpPjxhIGhyZWY9Imh0dHA6Ly9icm93c2Vyc3B5LmRrL2Fkb2JlcmVhZGVyLnBocCIgdGl0bGU9IklzIEFkb2JlIFJlYWRlciBpbnN0YWxsZWQ\/Ij5BZG9iZSBSZWFkZXI8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvYWpheC5waHAiIHRpdGxlPSJEb2VzIHlvdXIgYnJvd3NlciBzdXBwb3J0IFhNTCByZXF1ZXN0cyBhbmQgZG9jdW1lbnRzLiBYTUxIdHRwUmVxdWVzdCBpcyB1c2VkIGluIEFqYXggYmFzZWQgd2Vic2l0ZXMiPkFqYXggU3VwcG9ydDwvYT48L2xpPjxsaT48YSBocmVmPSJodHRwOi8vYnJvd3NlcnNweS5kay9iYW5kd2lkdGgucGhwIiB0aXRsZT0iV2hhdCBpcyB5b3VyIGludGVybmV0IGNvbm5lY3Rpb24gc3BlZWQ\/Ij5CYW5kd2lkdGg8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvYnJvd3Nlci5waHAiIHRpdGxlPSJXaGF0IGlzIHRoZSBuYW1lIGFuZCB2ZXJzaW9uIG9mIHlvdXIgYnJvd3Nlcj8iPkJyb3dzZXI8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvY2FwYWJpbGl0aWVzLnBocCIgdGl0bGU9IldoYXQgY2FwYWJpbGl0aWVzIGRvZXMgeW91ciBicm93c2VyIGhhdmU\/Ij5DYXBhYmlsaXRpZXM8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvY29sb3JzLnBocCIgdGl0bGU9IldoYXQga2luZCBvZiBzeXN0ZW0gY29sb3JzIGRvZXMgeW91ciBicm93c2VyIHN1cHBvcnQ\/Ij5Db2xvcnM8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvY29tcG9uZW50LnBocCIgdGl0bGU9IldoYXQgSW50ZXJuZXQgRXhwbG9yZXIgY29tcG9uZW50cyBjYW4gYmUgYW4="} +00428{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":814283,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"TBfruiThKM\/pITwrCABFAAA0zHdAAEAGLvjAqAAEwP69qdRBAFCa4jSWA2bmCIAQHxluagAAAQEICh9\/FgAwzbYf"} +00505{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":33,"source":"http_auth.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":33,"flow_first_seen":1381844050222,"flow_last_seen":1381844057320,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":18376,"flow_avg_l4_payload_len":556,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.4","dst_ip":"192.254.189.169","src_port":54337,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":33,"source":"http_auth.pcap","alias":"nDPId-test"} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 33/33 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 19452 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 1928505 bytes +~~ total memory freed........: 1928505 bytes +~~ total allocations/frees...: 35361/35361 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/http_ipv6.pcap.out b/test/results/http_ipv6.pcap.out index 32afc4cb3..cf12a4c5e 100644 --- a/test/results/http_ipv6.pcap.out +++ b/test/results/http_ipv6.pcap.out @@ -189,7 +189,7 @@ ~~ total detected protocols..: 7 ~~ total active/idle flows...: 15/15 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2046772 bytes -~~ total memory freed........: 2046772 bytes -~~ total allocations/frees...: 35625/35625 +~~ total memory allocated....: 2046670 bytes +~~ total memory freed........: 2046670 bytes +~~ total allocations/frees...: 35626/35626 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/iec60780-5-104.pcap.out b/test/results/iec60780-5-104.pcap.out index 4c4c02145..ca749b87b 100644 --- a/test/results/iec60780-5-104.pcap.out +++ b/test/results/iec60780-5-104.pcap.out @@ -113,7 +113,7 @@ ~~ total detected protocols..: 6 ~~ total active/idle flows...: 6/6 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1946769 bytes -~~ total memory freed........: 1946769 bytes -~~ total allocations/frees...: 35486/35486 +~~ total memory allocated....: 1947171 bytes +~~ total memory freed........: 1947171 bytes +~~ total allocations/frees...: 35487/35487 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/imaps.pcap.out b/test/results/imaps.pcap.out index df444f5e3..3fd9fe85d 100644 --- a/test/results/imaps.pcap.out +++ b/test/results/imaps.pcap.out @@ -27,7 +27,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1932197 bytes -~~ total memory freed........: 1932197 bytes -~~ total allocations/frees...: 35349/35349 +~~ total memory allocated....: 1932879 bytes +~~ total memory freed........: 1932879 bytes +~~ total allocations/frees...: 35350/35350 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/instagram.pcap.out b/test/results/instagram.pcap.out index 4699eba53..52de12196 100644 --- a/test/results/instagram.pcap.out +++ b/test/results/instagram.pcap.out @@ -507,7 +507,7 @@ ~~ total detected protocols..: 25 ~~ total active/idle flows...: 38/38 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 3304775 bytes -~~ total memory freed........: 3304775 bytes -~~ total allocations/frees...: 39058/39058 +~~ total memory allocated....: 2764060 bytes +~~ total memory freed........: 2764060 bytes +~~ total allocations/frees...: 39029/39029 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ip_fragmented_garbage.pcap.out b/test/results/ip_fragmented_garbage.pcap.out index 460581a67..9ba6e2537 100644 --- a/test/results/ip_fragmented_garbage.pcap.out +++ b/test/results/ip_fragmented_garbage.pcap.out @@ -18219,7 +18219,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 29/29 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2016027 bytes -~~ total memory freed........: 2016027 bytes -~~ total allocations/frees...: 35437/35437 +~~ total memory allocated....: 2015141 bytes +~~ total memory freed........: 2015141 bytes +~~ total allocations/frees...: 35438/35438 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/iphone.pcap.out b/test/results/iphone.pcap.out index 33becdbe6..04e2ca0ad 100644 --- a/test/results/iphone.pcap.out +++ b/test/results/iphone.pcap.out @@ -509,7 +509,7 @@ ~~ total detected protocols..: 52 ~~ total active/idle flows...: 53/53 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2544221 bytes -~~ total memory freed........: 2544221 bytes -~~ total allocations/frees...: 36242/36242 +~~ total memory allocated....: 2469986 bytes +~~ total memory freed........: 2469986 bytes +~~ total allocations/frees...: 36238/36238 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ipv6_in_gtp.pcap.out b/test/results/ipv6_in_gtp.pcap.out index 3a33093a1..aae2c681e 100644 --- a/test/results/ipv6_in_gtp.pcap.out +++ b/test/results/ipv6_in_gtp.pcap.out @@ -11,7 +11,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/irc.pcap.out b/test/results/irc.pcap.out index 7adb5a7d2..bc6d88f6c 100644 --- a/test/results/irc.pcap.out +++ b/test/results/irc.pcap.out @@ -7,7 +7,7 @@ 00419{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"irc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1387554241,"pkt_ts_usec":695656,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABNyxPHhANAr0XYACABFAAA0CCBAADIGK\/4m5UYUCrSc+R9As2GRFS02aTHw6YAQAFtTTgAAAQEICjBIJRa+wg9E"} 00443{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"irc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1387554241,"pkt_ts_usec":695673,"pkt_caplen":83,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":83,"pkt_l4_len":49,"pkt":"AAAMB6wBABNyxPHhCABFAABF\/+NAAEAGJikKtJz5JuVGFLNhH0BpMfDpkRUtNoAYAHMU3gAAAQEICr7CD2IwSCUWTklDSyBtb2xvY2h0ZXN0DQo="} 00504{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"irc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1387554241,"pkt_ts_usec":695929,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"pkt":"ABNyxPHhANAr0XYACABFAAByCCFAADIGK78m5UYUCrSc+R9As2GRFS02aTHw6YAYAFuk2AAAAQEICjBIJRa+wg9EOmNhcmQuZnJlZW5vZGUubmV0IE5PVElDRSAqIDoqKiogTG9va2luZyB1cCB5b3VyIGhvc3RuYW1lLi4uDQo="} -00598{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"irc.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":7,"flow_first_seen":1387554241634,"flow_last_seen":1387554241695,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":62,"flow_tot_l4_payload_len":114,"flow_avg_l4_payload_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.180.156.249","dst_ip":"38.229.70.20","src_port":45921,"dst_port":8000,"l4_proto":"tcp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port","22":"Unsafe Protocol"},"proto":"IRC","breed":"Unsafe","category":"Chat"}} +00628{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"irc.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":7,"flow_first_seen":1387554241634,"flow_last_seen":1387554241695,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":62,"flow_tot_l4_payload_len":114,"flow_avg_l4_payload_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.180.156.249","dst_ip":"38.229.70.20","src_port":45921,"dst_port":8000,"l4_proto":"tcp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port","22":"Unsafe Protocol","36":"Clear-text credentials"},"proto":"IRC","breed":"Unsafe","category":"Chat"}} 00419{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"irc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1387554241,"pkt_ts_usec":695943,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAMB6wBABNyxPHhCABFAAA0\/+RAAEAGJjkKtJz5JuVGFLNhH0BpMfD6kRUtdIAQAHNSyQAAAQEICr7CD2IwSCUW"} 00488{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"irc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1387554241,"pkt_ts_usec":726130,"pkt_caplen":115,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":115,"pkt_l4_len":81,"pkt":"ABNyxPHhANAr0XYACABFAABlCCJAADIGK8sm5UYUCrSc+R9As2GRFS10aTHw+oAYAFuqEAAAAQEICjBIJR2+wg9iOmNhcmQuZnJlZW5vZGUubmV0IE5PVElDRSAqIDoqKiogQ2hlY2tpbmcgSWRlbnQNCg=="} 00421{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"irc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1387554241,"pkt_ts_usec":726146,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAMB6wBABNyxPHhCABFAAA0\/+VAAEAGJjgKtJz5JuVGFLNhH0BpMfD6kRUtpYAQAHNScwAAAQEICr7CD4AwSCUd"} @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929595 bytes -~~ total memory freed........: 1929595 bytes -~~ total allocations/frees...: 35354/35354 +~~ total memory allocated....: 1930277 bytes +~~ total memory freed........: 1930277 bytes +~~ total allocations/frees...: 35355/35355 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ja3_lots_of_cipher_suites.pcap.out b/test/results/ja3_lots_of_cipher_suites.pcap.out index 3094d3b95..5d4d0aa6e 100644 --- a/test/results/ja3_lots_of_cipher_suites.pcap.out +++ b/test/results/ja3_lots_of_cipher_suites.pcap.out @@ -29,7 +29,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ja3_lots_of_cipher_suites_2_anon.pcap.out b/test/results/ja3_lots_of_cipher_suites_2_anon.pcap.out index d973e3400..a1830fdb1 100644 --- a/test/results/ja3_lots_of_cipher_suites_2_anon.pcap.out +++ b/test/results/ja3_lots_of_cipher_suites_2_anon.pcap.out @@ -51,7 +51,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1927489 bytes -~~ total memory freed........: 1927489 bytes -~~ total allocations/frees...: 35351/35351 +~~ total memory allocated....: 1928171 bytes +~~ total memory freed........: 1928171 bytes +~~ total allocations/frees...: 35352/35352 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/kerberos.pcap.out b/test/results/kerberos.pcap.out index 2efb78b14..1410c2720 100644 --- a/test/results/kerberos.pcap.out +++ b/test/results/kerberos.pcap.out @@ -192,7 +192,7 @@ ~~ total detected protocols..: 3 ~~ total active/idle flows...: 36/36 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2113267 bytes -~~ total memory freed........: 2113267 bytes -~~ total allocations/frees...: 35542/35542 +~~ total memory allocated....: 2111989 bytes +~~ total memory freed........: 2111989 bytes +~~ total allocations/frees...: 35543/35543 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/long_tls_certificate.pcap.out b/test/results/long_tls_certificate.pcap.out index 74128195e..90b06b772 100644 --- a/test/results/long_tls_certificate.pcap.out +++ b/test/results/long_tls_certificate.pcap.out @@ -27,7 +27,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2325337 bytes -~~ total memory freed........: 2325337 bytes -~~ total allocations/frees...: 35564/35564 +~~ total memory allocated....: 2326019 bytes +~~ total memory freed........: 2326019 bytes +~~ total allocations/frees...: 35565/35565 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/malformed_dns.pcap.out b/test/results/malformed_dns.pcap.out index 7412ee3df..842187d0d 100644 --- a/test/results/malformed_dns.pcap.out +++ b/test/results/malformed_dns.pcap.out @@ -19,7 +19,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926880 bytes -~~ total memory freed........: 1926880 bytes -~~ total allocations/frees...: 35330/35330 +~~ total memory allocated....: 1927562 bytes +~~ total memory freed........: 1927562 bytes +~~ total allocations/frees...: 35331/35331 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/malformed_icmp.pcap.out b/test/results/malformed_icmp.pcap.out index daa982165..1a61c0936 100644 --- a/test/results/malformed_icmp.pcap.out +++ b/test/results/malformed_icmp.pcap.out @@ -11,7 +11,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926735 bytes -~~ total memory freed........: 1926735 bytes -~~ total allocations/frees...: 35325/35325 +~~ total memory allocated....: 1927417 bytes +~~ total memory freed........: 1927417 bytes +~~ total allocations/frees...: 35326/35326 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/malware.pcap.out b/test/results/malware.pcap.out index a1053b7eb..77ebba3db 100644 --- a/test/results/malware.pcap.out +++ b/test/results/malware.pcap.out @@ -46,7 +46,7 @@ ~~ total detected protocols..: 4 ~~ total active/idle flows...: 5/5 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1979305 bytes -~~ total memory freed........: 1979305 bytes -~~ total allocations/frees...: 35423/35423 +~~ total memory allocated....: 1979763 bytes +~~ total memory freed........: 1979763 bytes +~~ total allocations/frees...: 35424/35424 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/memcached.cap.out b/test/results/memcached.cap.out index 0e1d26f56..363e1fc93 100644 --- a/test/results/memcached.cap.out +++ b/test/results/memcached.cap.out @@ -20,7 +20,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929044 bytes -~~ total memory freed........: 1929044 bytes -~~ total allocations/frees...: 35335/35335 +~~ total memory allocated....: 1929726 bytes +~~ total memory freed........: 1929726 bytes +~~ total allocations/frees...: 35336/35336 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/modbus.pcap.out b/test/results/modbus.pcap.out index 42d77a419..18bda77db 100644 --- a/test/results/modbus.pcap.out +++ b/test/results/modbus.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929664 bytes -~~ total memory freed........: 1929664 bytes -~~ total allocations/frees...: 35426/35426 +~~ total memory allocated....: 1930346 bytes +~~ total memory freed........: 1930346 bytes +~~ total allocations/frees...: 35427/35427 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/monero.pcap.out b/test/results/monero.pcap.out index 061073b9e..bc8c78f41 100644 --- a/test/results/monero.pcap.out +++ b/test/results/monero.pcap.out @@ -43,7 +43,7 @@ ~~ total detected protocols..: 2 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1951421 bytes -~~ total memory freed........: 1951421 bytes -~~ total allocations/frees...: 35650/35650 +~~ total memory allocated....: 1952047 bytes +~~ total memory freed........: 1952047 bytes +~~ total allocations/frees...: 35651/35651 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/mongodb.pcap.out b/test/results/mongodb.pcap.out index c799da3ed..57e519a4a 100644 --- a/test/results/mongodb.pcap.out +++ b/test/results/mongodb.pcap.out @@ -61,7 +61,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/mpeg.pcap.out b/test/results/mpeg.pcap.out index 564d5d109..788bb5a66 100644 --- a/test/results/mpeg.pcap.out +++ b/test/results/mpeg.pcap.out @@ -26,7 +26,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1927315 bytes -~~ total memory freed........: 1927315 bytes -~~ total allocations/frees...: 35346/35346 +~~ total memory allocated....: 1927997 bytes +~~ total memory freed........: 1927997 bytes +~~ total allocations/frees...: 35347/35347 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/mpegts.pcap.out b/test/results/mpegts.pcap.out index 37e92b71c..e864f1a1e 100644 --- a/test/results/mpegts.pcap.out +++ b/test/results/mpegts.pcap.out @@ -9,7 +9,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/mssql_tds.pcap.out b/test/results/mssql_tds.pcap.out index 502966783..57e53bfd4 100644 --- a/test/results/mssql_tds.pcap.out +++ b/test/results/mssql_tds.pcap.out @@ -79,7 +79,7 @@ ~~ total detected protocols..: 11 ~~ total active/idle flows...: 12/12 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2001401 bytes -~~ total memory freed........: 2001401 bytes -~~ total allocations/frees...: 35402/35402 +~~ total memory allocated....: 2001467 bytes +~~ total memory freed........: 2001467 bytes +~~ total allocations/frees...: 35403/35403 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/mysql-8.pcap.out b/test/results/mysql-8.pcap.out index 90a1c8e1e..221e5e880 100644 --- a/test/results/mysql-8.pcap.out +++ b/test/results/mysql-8.pcap.out @@ -14,7 +14,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926822 bytes -~~ total memory freed........: 1926822 bytes -~~ total allocations/frees...: 35328/35328 +~~ total memory allocated....: 1927504 bytes +~~ total memory freed........: 1927504 bytes +~~ total allocations/frees...: 35329/35329 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/nats.pcap.out b/test/results/nats.pcap.out index 90c9b2436..fcebe83e6 100644 --- a/test/results/nats.pcap.out +++ b/test/results/nats.pcap.out @@ -61,7 +61,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ndpi_match_string_subprotocol__error.pcapng.out b/test/results/ndpi_match_string_subprotocol__error.pcapng.out index b88e7becb..c2a97d746 100644 --- a/test/results/ndpi_match_string_subprotocol__error.pcapng.out +++ b/test/results/ndpi_match_string_subprotocol__error.pcapng.out @@ -28,7 +28,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1932391 bytes -~~ total memory freed........: 1932391 bytes -~~ total allocations/frees...: 35345/35345 +~~ total memory allocated....: 1933017 bytes +~~ total memory freed........: 1933017 bytes +~~ total allocations/frees...: 35346/35346 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/nest_log_sink.pcap.out b/test/results/nest_log_sink.pcap.out index 99854ce98..707001570 100644 --- a/test/results/nest_log_sink.pcap.out +++ b/test/results/nest_log_sink.pcap.out @@ -278,7 +278,7 @@ ~~ total detected protocols..: 16 ~~ total active/idle flows...: 17/17 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2026336 bytes -~~ total memory freed........: 2026336 bytes +~~ total memory allocated....: 2024074 bytes +~~ total memory freed........: 2024074 bytes ~~ total allocations/frees...: 36159/36159 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/netbios.pcap.out b/test/results/netbios.pcap.out index 6e5686778..4d4544d29 100644 --- a/test/results/netbios.pcap.out +++ b/test/results/netbios.pcap.out @@ -105,7 +105,7 @@ ~~ total detected protocols..: 15 ~~ total active/idle flows...: 16/16 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1983694 bytes -~~ total memory freed........: 1983694 bytes -~~ total allocations/frees...: 35630/35630 +~~ total memory allocated....: 1983536 bytes +~~ total memory freed........: 1983536 bytes +~~ total allocations/frees...: 35631/35631 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/netbios_wildcard_dns_query.pcap.out b/test/results/netbios_wildcard_dns_query.pcap.out index fa3444aa1..b3e507886 100644 --- a/test/results/netbios_wildcard_dns_query.pcap.out +++ b/test/results/netbios_wildcard_dns_query.pcap.out @@ -11,7 +11,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926735 bytes -~~ total memory freed........: 1926735 bytes -~~ total allocations/frees...: 35325/35325 +~~ total memory allocated....: 1927417 bytes +~~ total memory freed........: 1927417 bytes +~~ total allocations/frees...: 35326/35326 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/netflix.pcap.out b/test/results/netflix.pcap.out index 5bc49357d..078183f49 100644 --- a/test/results/netflix.pcap.out +++ b/test/results/netflix.pcap.out @@ -982,7 +982,7 @@ ~~ total detected protocols..: 60 ~~ total active/idle flows...: 62/62 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2738959 bytes -~~ total memory freed........: 2738959 bytes +~~ total memory allocated....: 2733371 bytes +~~ total memory freed........: 2733371 bytes ~~ total allocations/frees...: 42758/42758 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/netflow-fritz.pcap.out b/test/results/netflow-fritz.pcap.out index 45983aeea..cb273cfdd 100644 --- a/test/results/netflow-fritz.pcap.out +++ b/test/results/netflow-fritz.pcap.out @@ -11,7 +11,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926735 bytes -~~ total memory freed........: 1926735 bytes -~~ total allocations/frees...: 35325/35325 +~~ total memory allocated....: 1927417 bytes +~~ total memory freed........: 1927417 bytes +~~ total allocations/frees...: 35326/35326 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/netflowv9.pcap.out b/test/results/netflowv9.pcap.out index 151ae44a1..107ff41bd 100644 --- a/test/results/netflowv9.pcap.out +++ b/test/results/netflowv9.pcap.out @@ -20,7 +20,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926996 bytes -~~ total memory freed........: 1926996 bytes -~~ total allocations/frees...: 35334/35334 +~~ total memory allocated....: 1927678 bytes +~~ total memory freed........: 1927678 bytes +~~ total allocations/frees...: 35335/35335 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/nintendo.pcap.out b/test/results/nintendo.pcap.out index 96fcb1eed..53b50ff12 100644 --- a/test/results/nintendo.pcap.out +++ b/test/results/nintendo.pcap.out @@ -277,7 +277,7 @@ ~~ total detected protocols..: 14 ~~ total active/idle flows...: 21/21 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2030630 bytes -~~ total memory freed........: 2030630 bytes -~~ total allocations/frees...: 36393/36393 +~~ total memory allocated....: 2030192 bytes +~~ total memory freed........: 2030192 bytes +~~ total allocations/frees...: 36394/36394 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/no_sni.pcap.out b/test/results/no_sni.pcap.out index 363d7b098..52324b318 100644 --- a/test/results/no_sni.pcap.out +++ b/test/results/no_sni.pcap.out @@ -150,7 +150,7 @@ ~~ total detected protocols..: 7 ~~ total active/idle flows...: 8/8 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2015159 bytes -~~ total memory freed........: 2015159 bytes -~~ total allocations/frees...: 36561/36561 +~~ total memory allocated....: 2015449 bytes +~~ total memory freed........: 2015449 bytes +~~ total allocations/frees...: 36562/36562 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ocs.pcap.out b/test/results/ocs.pcap.out index 4af6d0c21..4404e0545 100644 --- a/test/results/ocs.pcap.out +++ b/test/results/ocs.pcap.out @@ -1899,7 +1899,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ookla.pcap.out b/test/results/ookla.pcap.out index 70d44a3c8..3864c27ca 100644 --- a/test/results/ookla.pcap.out +++ b/test/results/ookla.pcap.out @@ -43,7 +43,7 @@ ~~ total detected protocols..: 2 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2087632 bytes -~~ total memory freed........: 2087632 bytes -~~ total allocations/frees...: 40417/40417 +~~ total memory allocated....: 2088258 bytes +~~ total memory freed........: 2088258 bytes +~~ total allocations/frees...: 40418/40418 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/openvpn.pcap.out b/test/results/openvpn.pcap.out index 1e573ef0c..4014dc175 100644 --- a/test/results/openvpn.pcap.out +++ b/test/results/openvpn.pcap.out @@ -61,7 +61,7 @@ ~~ total detected protocols..: 3 ~~ total active/idle flows...: 3/3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1943716 bytes -~~ total memory freed........: 1943716 bytes -~~ total allocations/frees...: 35629/35629 +~~ total memory allocated....: 1944286 bytes +~~ total memory freed........: 1944286 bytes +~~ total allocations/frees...: 35630/35630 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/os_detected.pcapng.out b/test/results/os_detected.pcapng.out index 859669011..15c38d7c4 100644 --- a/test/results/os_detected.pcapng.out +++ b/test/results/os_detected.pcapng.out @@ -11,7 +11,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1932264 bytes -~~ total memory freed........: 1932264 bytes -~~ total allocations/frees...: 35338/35338 +~~ total memory allocated....: 1932946 bytes +~~ total memory freed........: 1932946 bytes +~~ total allocations/frees...: 35339/35339 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/pinterest.pcap.out b/test/results/pinterest.pcap.out index c9ef82e1b..5be533a16 100644 --- a/test/results/pinterest.pcap.out +++ b/test/results/pinterest.pcap.out @@ -221,6 +221,7 @@ 01994{"flow_id":16,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":877,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289714,"pkt_ts_usec":869585,"pkt_caplen":1219,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1219,"pkt_l4_len":1165,"pkt":"5EKm5WPyqtsDr8lkht1gAAAABI0GPSoETkIAHQAAAAAAAAAAByAqAcsBIEmLB5kd7IUo3\/YpAbve2qyyTgvOS7yogBgLMPFgAAABAQgKwrkkqnRgZRFhbFNpZ24gQ2xvdWRTU0wgQ0EgLSBTSEEyNTYgLSBHMyBPQ1NQIFJlc3BvbmRlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKqsozu9fkpn7\/6s9Cmu985JFgLKciPNzTDBR1Cuxfm9sVtQfvGUvJhw\/66IzOmsNT6BgfPnVoPEO8JURVBo2uKgoITrl37NCU8iu2mUgQ5DuZWT9rQNuus1S1cwEBkzIk\/1tLFninJjubpYbzrNtsDAQ2\/EVGfwU8gB7WoeGzhTCC\/7TWVTrRdr4\/A0UWbStH2uPrO2SMIcJPl5AanON\/kjCiirRWI4Yd697beejNWLSoKAvhF110W\/P+BWZnhEOe9ybf5pytqfE15qgfc3MrpIxJp1qYcmCrItkDqHjbPMil40ncSioOE4IteBpXiMZAj0MTEKoOTKLVy1HZ\/sd28CAwEAAaOBxzCBxDAfBgNVHSMEGDAWgBSpK4fhziRHOxu\/z4U3AlWdDZRY5jBMBgNVHSAERTBDMEEGCSsGAQQBoDIBXzA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzAPBgkrBgEFBQcwAQUEAgUAMBMGA1UdJQQMMAoGCCsGAQUFBwMJMB0GA1UdDgQWBBQnN6sZ+rEF+sP3dIHQ5lzluT6oizAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggEBAFit0xDesc68QNxD9heINJr5g4Yfm90pSyhjh0gTU46wpvORNzLRJCNdu7zzm\/0VTrf2KbrCNwzivjLTPZ2\/TBOHJB3kz47G42QbHHGGZInVgKJqUMI6aIG8IKgBSYcoSPDf4JMZNiN2q2yyPR3q92l8H0ETDSnz7PuW7IXwnWs6lpdJg82O0YLvDKaHgWePox20TV9NU+1M6roMGpN052hnfgMddF6AWPmQepq\/GSMqVaVNTEzctkdtT+ly6jv70c1hNUA1+1SrX9S9dO8WMTVXvSvNJ40VVtFR+YvHVmZQIej1jG9gNCk8GMMkZI5GJf3tvXb70artwY4pBiUj7mkWAwMBLAwAASgDAB0gFFUKdnXf6H\/bQKbBOVsVLf+EpejItdUw+Rb86its7QAIBAEAC0m9xsXnt+vZRRuBvJsq0lJq2I5svfbv44H+1CXX52wRKhf7pe9xjeWghbUEJCE0ZchWeyKgxxU78\/MlXUKbMA8EjXdbd3sZ+gKkwBKvaW+o3P3kYee6s4nzelB5cv9Iul2l\/Cu2+9zEfHiWltd6vhjyuoBbIbeGbXgX7nnFp9iQdld2c4\/QE0kAarXrmALYepinSLggY2Gxj+ANFqGeLPAKHkwbFX3JQnQGlZUb+nJNFtg60A9eSp26elWUvNLECpsox1S+tFQI5ojDxinI6qaA4uVcgn\/+u2ilpohXDC4JIi6O+0QNOd8g0UK7bOpJ5xLPxsttLdvO0whYpyC1zxYDAwAEDgAAAA=="} 00457{"flow_id":16,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":878,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289714,"pkt_ts_usec":869591,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gCp8uACAGQCoBywEgSYsHmR3shSjf9ikqBE5CAB0AAAAAAAAAAAcg3toBu85LvKissk4LgBAB9YkDAAABAQgKdGBlNcK5JKo="} 00457{"flow_id":16,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":879,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289714,"pkt_ts_usec":869602,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gCp8uACAGQCoBywEgSYsHmR3shSjf9ikqBE5CAB0AAAAAAAAAAAcg3toBu85LvKisslJ4gBAB8YSaAAABAQgKdGBlNcK5JKo="} +03113{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2181,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":255,"flow_first_seen":1605289714782,"flow_last_seen":1605289715109,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":6940,"flow_tot_l4_payload_len":389860,"flow_avg_l4_payload_len":1528,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::720","src_port":57050,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Media"},"tls": {"version":"TLSv1.2","client_requested_server_name":"images.unsplash.com","server_names":"imgix2.map.fastly.net,*.camp-fire.jp,*.carwow.co.uk,*.carwow.de,*.carwow.es,*.catchandrelease.com,*.dorothee-schumacher.com,*.footway.com,*.img-ikyu.com,*.imgix.drizly.com,*.instamotor.com,*.microdinc.com,*.msastaging.com,*.peddle.com,*.remax.ca,*.ustudio.com,*.vaping360.com,*.weber.com,article-image-ix.nikkei.com,assets.eberhardt-travel.de,assets.verishop.com,assets.verishop.xyz,cdn.airstream.com,cdn.elementthree.com,cdn.hashnode.com,cdn.naturalhealthyconcepts.com,cdn.parent.eu,cdn.phonehouse.es,cdn.shiplus.co.il,i.drop-cdn.com,i.upworthy.com,image.volunteerworld.com,imageproxy.themaven.net,images-dev.takeshape.io,images.101cookbooks.com,images.beano.com,images.businessoffashion.com,images.congstar.de,images.diesdas.digital,images.fandor.com,images.greetingsisland.com,images.malaecuia.com.br,images.omaze.com,images.roulottesgagnon.com,images.takeshape.io,images.thewanderful.co,images.unsplash.com,images.victoriaplum.com,images.vraiandoro.com,img-1.homely.com.au,img-stack.imagereflow.com,img.badshop.se,img.bernieandphyls.com,img.bioopticsworld.com,img.broadbandtechreport.com,img.broadwaybox.com,img.bygghemma.se,img.bygghjemme.no,img.byggshop.se,img.cablinginstall.com,img.dentaleconomics.com,img.dentistryiq.com,img.evaluationengineering.com,img.golvshop.se,img.grudado.com.br,img.industrial-lasers.com,img.induux.de,img.intelligent-aerospace.com,img.inturn.co,img.laserfocusworld.com,img.ledsmagazine.com,img.lightwaveonline.com,img.militaryaerospace.com,img.mychannels.video,img.officer.com,img.offshore-mag.com,img.ogj.com,img.perioimplantadvisory.com,img.plasticsmachinerymagazine.com,img.prevu.com,img.rdhmag.com,img.speedcurve.com,img.strategies-u.com,img.utilityproducts.com,img.vision-systems.com,img.waterworld.com,img.workbook.com,img.xlhemma.se,img1.nowpurchase.com,iw.induux.de,m.22slides.com,media.sailrace.com,media.useyourlocal.com,pictures.hideaways.dk,raven.contrado.com,resources.intuitive.com,static.doorsuperstore.co.uk","ja3":"b32309a26951912be7dba376398abc3b","ja3s":"16c0b3e6a7b8173c16d944cfeaeee9cf","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=BE, O=GlobalSign nv-sa, CN=GlobalSign CloudSSL CA - SHA256 - G3","issuerDN":"C=US, ST=California, L=San Francisco, O=Fastly, Inc., CN=imgix2.map.fastly.net","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1","fingerprint":"1F:BC:A1:79:48:96:70:32:B8:08:C1:38:D4:20:12:BE:D9:6F:14:B6"}} 00524{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2206,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1605289715133,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::2003","src_port":51582,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00469{"flow_id":17,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2206,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289715,"pkt_ts_usec":133578,"pkt_caplen":94,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":94,"pkt_l4_len":40,"pkt":"qtsDr8lk5EKm5WPyht1gAUyOACgGQCoBywEgSYsHmR3shSjf9ikqABRQQAcIFgAAAAAAACADyX4Bu+HPmfcAAAAAoAL9IJHxAAACBAWgBAIICjiITggAAAAAAQMDBw=="} 00470{"flow_id":17,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2778,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289715,"pkt_ts_usec":210396,"pkt_caplen":94,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":94,"pkt_l4_len":40,"pkt":"5EKm5WPyqtsDr8lkht1gAAAAACgGPSoAFFBABwgWAAAAAAAAIAMqAcsBIEmLB5kd7IUo3\/YpAbvJfoEpGV7hz5n4oBJXgLSTAAACBAV4AQMDAwQCCArCuSXYOIhOCA=="} @@ -357,6 +358,7 @@ 00459{"flow_id":27,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14838,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289718,"pkt_ts_usec":378827,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"5EKm5WPyqtsDr8lkht1gAAAAACAGPSoAFFBABwgMAAAAAAAAIAoqAcsBIEmLB5kd7IUo3\/YpAbvfKq3COfXNBVWYgBALvWWfAAABAQgKwrkyYVcQ4ow="} 00459{"flow_id":25,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14839,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289718,"pkt_ts_usec":378828,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"5EKm5WPyqtsDr8lkht1gAAAAACAGPSoAFFBABwgWAAAAAAAAIAMqAcsBIEmLB5kd7IUo3\/YpAbvJEPGplpSXUIMEgBALh6bdAAABAQgKwrkyYTiGPeg="} 00459{"flow_id":26,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14840,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289718,"pkt_ts_usec":378828,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"5EKm5WPyqtsDr8lkht1gAAAAACAGPSoAFFBABwgGAAAAAAAAIA4qAcsBIEmLB5kd7IUo3\/YpAbvUJMtvpLavZCWagBAL1W6tAAABAQgKwrkyYnBykDw="} +02684{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":14860,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":255,"flow_first_seen":1605289713743,"flow_last_seen":1605289719719,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1388,"flow_tot_l4_payload_len":145253,"flow_avg_l4_payload_len":569,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:7854","src_port":33262,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Pinterest","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.pinterest.fr","server_names":"*.pinterest.com,pinterest.in,*.pinterest.co,pinterest.co,*.pinterest.pe,pinterest.pe,*.pinterest.be,pinterest.be,*.pinterest.in,*.pinterest.ph,*.pinterest.ec,pinterest.ph,*.pinterest.cl,*.pinimg.com,*.pinterest.es,pinterest.es,*.pinterest.nz,pinterest.nz,pinterest.ec,pinterest.hu,pinterest.ca,pinterest.id,*.pinterest.nl,pinterest.nl,*.pinterest.tw,pinterest.tw,*.pinterest.th,pinterest.th,*.pinterest.id,*.pinterest.vn,*.pinterest.hu,pinterest.vn,*.pinterest.uk,pinterest.uk,*.pinterest.ru,pinterest.ru,*.pinterest.it,pinterest.it,pinterest.fr,pinterest.cl,*.pinterest.fr,*.pinterest.jp,*.pinterest.ca,pinterest.com,pin.it,*.pinterest.se,*.pinterest.pt,*.pinterest.mx,*.pinterest.kr,*.pinterest.ie,pinterest.engineering,*.pinterest.dk,*.pinterest.de,*.pinterest.ch,*.pinterest.at,*.pinterestmail.com,*.pinterest.engineering,*.pinterest.info,pinterest.info,pinimg.com,pinterestmail.com,pinterest.de,pinterest.dk,pinterest.ie,pinterest.jp,pinterest.kr,pinterest.mx,pinterest.pt,pinterest.se,pinterest.at,pinterest.ch,pinterest.co.at,*.pinterest.com.uy,pinterest.co.kr,pinterest.co.uk,*.pinterest.com.au,pinterest.com.au,pinterest.com.mx,*.pinterest.co.nz,pinterest.co.nz,pinterest.com.pe,pinterest.com.uy,*.pinterest.co.in,pinterest.com.py,*.pinterest.com.py,pinterest.com.bo,*.pinterest.com.bo,pinterest.com.ec,*.pinterest.com.ec,pinterest.co.in,*.pinterest.com.pe,*.pinterest.com.mx,pinterest.com.vn,*.pinterest.com.vn,*.pinterest.co.uk,*.pinterest.co.kr,*.pinterest.co.at,*.testing.pinterest.com","ja3":"b32309a26951912be7dba376398abc3b","ja3s":"16c0b3e6a7b8173c16d944cfeaeee9cf","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA","issuerDN":"C=US, ST=California, L=San Francisco, O=Pinterest, Inc., CN=*.pinterest.com","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1","fingerprint":"1E:D0:5D:9F:0D:82:46:B3:60:5F:11:FB:64:D5:28:35:37:40:7A:4E"}} 00517{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":14887,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1605289720502,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::84","src_port":38402,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00458{"flow_id":28,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14887,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289720,"pkt_ts_usec":502835,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gDE+lACAGQCoBywEgSYsHmR3shSjf9ikqBE5CAB0AAAAAAAAAAACElgIBuwZ3AS1n9K5wgBAD7qJGAAABAQgK1mI428K4iuQ="} 00459{"flow_id":28,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14888,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289720,"pkt_ts_usec":592524,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"5EKm5WPyqtsDr8lkht1gAAAAACAGPSoETkIAHQAAAAAAAAAAAIQqAcsBIEmLB5kd7IUo3\/YpAbuWAmf0rnAGdwEugBAMdPzqAAABAQgKwrk63tZgJbc="} @@ -464,7 +466,7 @@ 00537{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":15,"flow_first_seen":1605289714142,"flow_last_seen":1605289714259,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1388,"flow_tot_l4_payload_len":5839,"flow_avg_l4_payload_len":389,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::84","src_port":38522,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00540{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":52,"flow_first_seen":1605289732959,"flow_last_seen":1605289733342,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1388,"flow_tot_l4_payload_len":26978,"flow_avg_l4_payload_len":518,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::84","src_port":38546,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00547{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":55,"flow_first_seen":1605289715966,"flow_last_seen":1605289733391,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1208,"flow_tot_l4_payload_len":6358,"flow_avg_l4_payload_len":115,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::200a","src_port":47790,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00546{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":808,"flow_first_seen":1605289714782,"flow_last_seen":1605289715303,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":16656,"flow_tot_l4_payload_len":1781636,"flow_avg_l4_payload_len":2204,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::720","src_port":57050,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00544{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":255,"flow_first_seen":1605289714782,"flow_last_seen":1605289715303,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":6940,"flow_tot_l4_payload_len":389860,"flow_avg_l4_payload_len":1528,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::720","src_port":57050,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00551{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1605289714251,"flow_last_seen":1605289714288,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::acd9:13e2","src_port":34626,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} 00532{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1605289714251,"flow_last_seen":1605289714288,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::acd9:13e2","src_port":34626,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00557{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1605289718347,"flow_last_seen":1605289718378,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:806::200e","src_port":54308,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} @@ -477,7 +479,7 @@ 00557{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1605289714250,"flow_last_seen":1605289714288,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80b::2002","src_port":58726,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} 00538{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1605289714250,"flow_last_seen":1605289714288,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80b::2002","src_port":58726,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":171,"flow_first_seen":1605289715782,"flow_last_seen":1605289724655,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":12420,"flow_tot_l4_payload_len":150127,"flow_avg_l4_payload_len":877,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a03:2880:f11f:83:face:b00c::25de","src_port":60340,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00547{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2804,"flow_first_seen":1605289713743,"flow_last_seen":1605289734948,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":13624,"flow_tot_l4_payload_len":3671715,"flow_avg_l4_payload_len":1309,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:7854","src_port":33262,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00543{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":255,"flow_first_seen":1605289713743,"flow_last_seen":1605289734948,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1388,"flow_tot_l4_payload_len":145253,"flow_avg_l4_payload_len":569,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:7854","src_port":33262,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00541{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":33,"flow_first_seen":1605289714658,"flow_last_seen":1605289714873,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1048,"flow_tot_l4_payload_len":7307,"flow_avg_l4_payload_len":221,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:7854","src_port":33280,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00557{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1605289728586,"flow_last_seen":1605289728804,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::2004","src_port":40560,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} 00538{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1605289728586,"flow_last_seen":1605289728804,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::2004","src_port":40560,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -496,7 +498,7 @@ ~~ total detected protocols..: 20 ~~ total active/idle flows...: 37/37 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 3582347 bytes -~~ total memory freed........: 3582347 bytes -~~ total allocations/frees...: 54300/54300 +~~ total memory allocated....: 3581013 bytes +~~ total memory freed........: 3581013 bytes +~~ total allocations/frees...: 54301/54301 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/pps.pcap.out b/test/results/pps.pcap.out index 54be0d684..92d3e60b9 100644 --- a/test/results/pps.pcap.out +++ b/test/results/pps.pcap.out @@ -72,7 +72,6 @@ 01834{"flow_id":7,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":129,"source":"pps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467353136,"pkt_ts_usec":502118,"pkt_caplen":1107,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1107,"pkt_l4_len":1073,"pkt":"ABxCjnAxTF4M6gNlCABFKARFVcMAAGURgIvb5GucwKhzCATiWQkEMaUgy4SeuLhTQ\/YgLLahHBwYWVuQ5kkBty+goaGhoe2hoaGhoaGhpVtCDzcSFnRRQvOg2Cxt9NzQBAxveNk9pvrdff9azkfiMGP\/A3khjBffNjPR0BTt\/ejnHt+AtW9psN7TYASCH3fRXOFHakDxaXLu2AftrQYVLIozp33LEaV8ueI0edSknR\/BlFVLRXTRfZzRAZdXIHXxhKrUNatXZHckq1BQTgPIS0MbEDAJVHTbj6Ut27ugClZdjQMGSsINOasCPfkEBiXAULWvSTn5pRCpWWVuGU+jhCaul\/hDu6843OW6lEPrQkrZR+J6tv+Cj42S09V8WOJXm\/kUAsmkJtJMFRAB98Txt+Y\/2hxSNKcIcYTjdlgu9bAgcZQf2E3G5eGNf6aZ1RV9DM8tg2Bqqesbnqe3tWJJskWl4vAa8j7dr2ImN1+3LAG5bweOB9hBcF4V1eAzZ8HJnfKug70BGAYUEILMc1GrWdfqukQz0nHi7i2T0ciCYQbwI0tZ2xA0Axk3TWr86cHcsNXUUWrO7sshol+HeGx1j0dogz2mTf6ffVa+5Xcxt39KpZbKdNbqAYYKCuWTEmn5JGPFUB4kza21tIyFdRkuQXnCmsBDOrcY8lwyiqipAvCHUgcUQdqeXHE8UT9CHb42z4KZucJw40qeoVIGbrcUloJFx93ZzVq5TlSYDmjpAlSPUshc8eN\/v2YTlKNqkrrnmZGIcIBoF\/nWtR+t+vZdcsnOusYUlvDvaFeewPc0oHDgGXRpOv577Yl\/L49UAxqe0oYq3z0SoK0i6wN1krHCXx73evOSnwejQ7UTwZbUNz\/6bkjgZ65RCue6dUqhnelh9KzX3s9yeYvln35tx1aAuHXHBvkxTi6gPdhP56m1ya\/lmVZZGfMoL5n+j7Y8VUI3xbFdhcaBAEdAsBvFIFb9B48Mo+2zbymNPaI\/bf20djVYgxHOh850hb382H6h7cEKo7ugxmmNSZezUBeE81Sxc12dEzSH4OK3NcFS9OMdJZO8bqnkxxwXy8cM2dzX5Ya8YGHT+Wgu5Ptgf\/9jpIgOoOCKzrGz8FUfBAyqYRrLoWNq3aBiSmgrYapYwVVMXnnn8F+0\/0vjQjsFuTW\/0mD3nVyI8M5nbsOUIQWA9q2QDohwow4CHRLfuN0UP6CvbZ7oqxK41aPQSlWpkitRQKap3tKRTiIZqHbp7H7DHFADRUZyIsVmIYDh84sLy35q\/tjrqxuGd2FqAer3XsfE3i+Zrouwd7+0RYT5Akpaj6d\/9lGfLTGBXkZWqJF6lNarDZGSCqSRGJMzb88PW+DZlxlnoASoJfi0xCjvq6vAi68U\/b8PqUssurn7rGxnlryxgGmYfB10IjhKIHAFa6KRS\/T23jKI4skgmIg1zszMSAmayDZnHUF0UeZunPlx3uDZwJIAAAAA"} 00441{"flow_id":7,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":131,"source":"pps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467353136,"pkt_ts_usec":503195,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"TF4M6gNlABxCjnAxCABFAABBf2MAAIARQBfAqHMI2+RrnFkJBOIALV9e2oCeu7tQQPUjL7WiHx8fHhoTStzd3d3dqeXl5eXl5eXhId4h\/w=="} 00441{"flow_id":7,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":132,"source":"pps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467353136,"pkt_ts_usec":503493,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"TF4M6gNlABxCjnAxCABFAABBf2MAAIARQBfAqHMI2+RrnFkJBOIALV9e2oCeu7tQQPUjL7WiHx8fHhoTStzd3d3dqeXl5eXl5eXhId4h\/w=="} -00531{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":149,"source":"pps.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":53,"flow_first_seen":1467353136432,"flow_last_seen":1467353136508,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":1065,"flow_tot_l4_payload_len":20465,"flow_avg_l4_payload_len":386,"midstream":0,"l3_proto":"ip4","src_ip":"1.173.5.226","dst_ip":"192.168.115.8","src_port":22636,"dst_port":22793,"l4_proto":"udp","ndpi": {"proto":"RTP","breed":"Acceptable","category":"Media"}} 00442{"flow_id":4,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":206,"source":"pps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467353136,"pkt_ts_usec":548544,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"TF4M6gNlABxCjnAxCABFAABBf30AAIARHqzAqHMI3sWKDFkJGywALRrY2oCeu7uZyeHbHHqdq6urqq6n\/srLy8vLD3FxcXFxcXF19Qp1\/w=="} 00442{"flow_id":4,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":210,"source":"pps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467353136,"pkt_ts_usec":548611,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"TF4M6gNlABxCjnAxCABFAABBf30AAIARHqzAqHMI3sWKDFkJGywALRrY2oCeu7uZyeHbHHqdq6urqq6n\/srLy8vLD3FxcXFxcXF19Qp1\/w=="} 00442{"flow_id":7,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":211,"source":"pps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467353136,"pkt_ts_usec":549208,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"TF4M6gNlABxCjnAxCABFAABBf34AAIARP\/zAqHMI2+RrnFkJBOIALZy92oCeu7tQQPUjL7WiHx8fHhoTSt3c3NzcpOjo6Ojo6OjsbJNs\/w=="} @@ -99,6 +98,7 @@ 00518{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":587,"source":"pps.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":255,"flow_first_seen":1467353136439,"flow_last_seen":1467353136732,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":1065,"flow_tot_l4_payload_len":94759,"flow_avg_l4_payload_len":371,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"114.42.0.158","src_port":22793,"dst_port":7716,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":644,"source":"pps.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1467353136757,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.5.15","dst_ip":"68.233.253.133","src_port":65125,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00421{"flow_id":10,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":644,"source":"pps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467353136,"pkt_ts_usec":757007,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"TF4M6gNlKDc3Alz6CABFAAA0AHFAAEAGMi3AqAUPROn9hf5lAFBsGPTh5ZgTx4AREAFu8AAAAQEICiYbPvkrIgZe"} +00518{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":693,"source":"pps.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":255,"flow_first_seen":1467353136432,"flow_last_seen":1467353136783,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":1065,"flow_tot_l4_payload_len":94759,"flow_avg_l4_payload_len":371,"midstream":0,"l3_proto":"ip4","src_ip":"1.173.5.226","dst_ip":"192.168.115.8","src_port":22636,"dst_port":22793,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":765,"source":"pps.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1467353136833,"flow_last_seen":0,"flow_min_l4_payload_len":108,"flow_max_l4_payload_len":108,"flow_tot_l4_payload_len":108,"flow_avg_l4_payload_len":108,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"218.61.39.103","src_port":22793,"dst_port":17788,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00537{"flow_id":11,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":765,"source":"pps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467353136,"pkt_ts_usec":833095,"pkt_caplen":150,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":150,"pkt_l4_len":116,"pkt":"TF4M6gNlABxCjnAxCABFAACIADsAAIARBNXAqHMI2j0nZ1kJRXwAdM6LbABEsXEiUCg6x2bnNgAAAQADAAAAwKhzCAlZCtIsqwEGdAZ0b\/pmQpw8UwQ938xDXiteKyTtmkXcENwQJOknUZ5InkhvdWVRsieyJz3jqlgDTwNPynAfWaJVkHF5+IVd1THVMQGvgGhBFEEU"} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":766,"source":"pps.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1467353136833,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"210.44.171.1","src_port":22793,"dst_port":29702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -735,7 +735,7 @@ 00515{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.117.101.81","src_port":22793,"dst_port":10162,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.117.101.81","src_port":22793,"dst_port":10162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":9,"flow_first_seen":1467353197131,"flow_last_seen":1467353203157,"flow_min_l4_payload_len":123,"flow_max_l4_payload_len":133,"flow_tot_l4_payload_len":1161,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.1","dst_ip":"239.255.255.250","src_port":50945,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":400,"flow_first_seen":1467353136432,"flow_last_seen":1467353136981,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":1067,"flow_tot_l4_payload_len":148446,"flow_avg_l4_payload_len":371,"midstream":0,"l3_proto":"ip4","src_ip":"1.173.5.226","dst_ip":"192.168.115.8","src_port":22636,"dst_port":22793,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":255,"flow_first_seen":1467353136432,"flow_last_seen":1467353136981,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":1065,"flow_tot_l4_payload_len":94759,"flow_avg_l4_payload_len":371,"midstream":0,"l3_proto":"ip4","src_ip":"1.173.5.226","dst_ip":"192.168.115.8","src_port":22636,"dst_port":22793,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00517{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":5,"flow_first_seen":1467353136439,"flow_last_seen":1467353136660,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":1067,"flow_tot_l4_payload_len":3271,"flow_avg_l4_payload_len":654,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.198.7.89","src_port":22793,"dst_port":16039,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":5,"flow_first_seen":1467353136439,"flow_last_seen":1467353136660,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":1067,"flow_tot_l4_payload_len":3271,"flow_avg_l4_payload_len":654,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.198.7.89","src_port":22793,"dst_port":16039,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":2,"flow_first_seen":1467353172446,"flow_last_seen":1467353172450,"flow_min_l4_payload_len":235,"flow_max_l4_payload_len":785,"flow_tot_l4_payload_len":1020,"flow_avg_l4_payload_len":510,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"23.41.133.163","src_port":50500,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -747,10 +747,10 @@ ~~ packets captured/processed: 2557/2557 ~~ skipped flows.............: 0 ~~ total layer4 data length..: 2159666 bytes -~~ total detected protocols..: 71 +~~ total detected protocols..: 70 ~~ total active/idle flows...: 110/110 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2383301 bytes -~~ total memory freed........: 2383301 bytes -~~ total allocations/frees...: 38336/38336 +~~ total memory allocated....: 2377879 bytes +~~ total memory freed........: 2377879 bytes +~~ total allocations/frees...: 38337/38337 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ps_vue.pcap.out b/test/results/ps_vue.pcap.out index 31a1dca63..ef4acec4a 100644 --- a/test/results/ps_vue.pcap.out +++ b/test/results/ps_vue.pcap.out @@ -63,7 +63,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 8/8 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 3492899 bytes -~~ total memory freed........: 3492899 bytes -~~ total allocations/frees...: 37141/37141 +~~ total memory allocated....: 2649135 bytes +~~ total memory freed........: 2649135 bytes +~~ total allocations/frees...: 37125/37125 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic-23.pcap.out b/test/results/quic-23.pcap.out index 28af0e362..20da1a77b 100644 --- a/test/results/quic-23.pcap.out +++ b/test/results/quic-23.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1932736 bytes -~~ total memory freed........: 1932736 bytes -~~ total allocations/frees...: 35356/35356 +~~ total memory allocated....: 1933418 bytes +~~ total memory freed........: 1933418 bytes +~~ total allocations/frees...: 35357/35357 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic-24.pcap.out b/test/results/quic-24.pcap.out index 7034581c7..afd69e2c4 100644 --- a/test/results/quic-24.pcap.out +++ b/test/results/quic-24.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1932563 bytes -~~ total memory freed........: 1932563 bytes -~~ total allocations/frees...: 35351/35351 +~~ total memory allocated....: 1933245 bytes +~~ total memory freed........: 1933245 bytes +~~ total allocations/frees...: 35352/35352 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic-27.pcap.out b/test/results/quic-27.pcap.out index 829552da1..484b3d789 100644 --- a/test/results/quic-27.pcap.out +++ b/test/results/quic-27.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1932839 bytes -~~ total memory freed........: 1932839 bytes -~~ total allocations/frees...: 35357/35357 +~~ total memory allocated....: 1933521 bytes +~~ total memory freed........: 1933521 bytes +~~ total allocations/frees...: 35358/35358 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic-28.pcap.out b/test/results/quic-28.pcap.out index 13fadaecd..315fd1117 100644 --- a/test/results/quic-28.pcap.out +++ b/test/results/quic-28.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1939419 bytes -~~ total memory freed........: 1939419 bytes -~~ total allocations/frees...: 35589/35589 +~~ total memory allocated....: 1940101 bytes +~~ total memory freed........: 1940101 bytes +~~ total allocations/frees...: 35590/35590 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic-29.pcap.out b/test/results/quic-29.pcap.out index a3e9f5c6e..727564bef 100644 --- a/test/results/quic-29.pcap.out +++ b/test/results/quic-29.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1932563 bytes -~~ total memory freed........: 1932563 bytes -~~ total allocations/frees...: 35351/35351 +~~ total memory allocated....: 1933245 bytes +~~ total memory freed........: 1933245 bytes +~~ total allocations/frees...: 35352/35352 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic-33.pcapng.out b/test/results/quic-33.pcapng.out index 96b585583..182b58196 100644 --- a/test/results/quic-33.pcapng.out +++ b/test/results/quic-33.pcapng.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1960966 bytes -~~ total memory freed........: 1960966 bytes -~~ total allocations/frees...: 36328/36328 +~~ total memory allocated....: 1961648 bytes +~~ total memory freed........: 1961648 bytes +~~ total allocations/frees...: 36329/36329 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic-mvfst-22.pcap.out b/test/results/quic-mvfst-22.pcap.out index 5dce4f7f3..5d1b44082 100644 --- a/test/results/quic-mvfst-22.pcap.out +++ b/test/results/quic-mvfst-22.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1946344 bytes -~~ total memory freed........: 1946344 bytes -~~ total allocations/frees...: 35826/35826 +~~ total memory allocated....: 1947026 bytes +~~ total memory freed........: 1947026 bytes +~~ total allocations/frees...: 35827/35827 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic-mvfst-22_decryption_error.pcap.out b/test/results/quic-mvfst-22_decryption_error.pcap.out index dd595dc70..ebe44de7f 100644 --- a/test/results/quic-mvfst-22_decryption_error.pcap.out +++ b/test/results/quic-mvfst-22_decryption_error.pcap.out @@ -713,7 +713,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic-mvfst-27.pcapng.out b/test/results/quic-mvfst-27.pcapng.out index 5514e8462..6528ddfe1 100644 --- a/test/results/quic-mvfst-27.pcapng.out +++ b/test/results/quic-mvfst-27.pcapng.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1932707 bytes -~~ total memory freed........: 1932707 bytes -~~ total allocations/frees...: 35356/35356 +~~ total memory allocated....: 1933389 bytes +~~ total memory freed........: 1933389 bytes +~~ total allocations/frees...: 35357/35357 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic-mvfst-exp.pcap.out b/test/results/quic-mvfst-exp.pcap.out index 9ebf86d44..56770a099 100644 --- a/test/results/quic-mvfst-exp.pcap.out +++ b/test/results/quic-mvfst-exp.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1932997 bytes -~~ total memory freed........: 1932997 bytes -~~ total allocations/frees...: 35366/35366 +~~ total memory allocated....: 1933679 bytes +~~ total memory freed........: 1933679 bytes +~~ total allocations/frees...: 35367/35367 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic.pcap.out b/test/results/quic.pcap.out index 5a3d3a98f..db0a9eb01 100644 --- a/test/results/quic.pcap.out +++ b/test/results/quic.pcap.out @@ -103,7 +103,7 @@ ~~ total detected protocols..: 9 ~~ total active/idle flows...: 10/10 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1970425 bytes -~~ total memory freed........: 1970425 bytes -~~ total allocations/frees...: 35877/35877 +~~ total memory allocated....: 1970603 bytes +~~ total memory freed........: 1970603 bytes +~~ total allocations/frees...: 35878/35878 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic046.pcap.out b/test/results/quic046.pcap.out index 097c72dad..87d48409e 100644 --- a/test/results/quic046.pcap.out +++ b/test/results/quic046.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929654 bytes -~~ total memory freed........: 1929654 bytes -~~ total allocations/frees...: 35425/35425 +~~ total memory allocated....: 1930336 bytes +~~ total memory freed........: 1930336 bytes +~~ total allocations/frees...: 35426/35426 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic_0RTT.pcap.out b/test/results/quic_0RTT.pcap.out index a1bd38595..533ffd822 100644 --- a/test/results/quic_0RTT.pcap.out +++ b/test/results/quic_0RTT.pcap.out @@ -12,7 +12,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1931510 bytes -~~ total memory freed........: 1931510 bytes -~~ total allocations/frees...: 35338/35338 +~~ total memory allocated....: 1932192 bytes +~~ total memory freed........: 1932192 bytes +~~ total allocations/frees...: 35339/35339 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic_frags_ch_in_multiple_packets.pcapng.out b/test/results/quic_frags_ch_in_multiple_packets.pcapng.out index 28da1a5fd..766e453d2 100644 --- a/test/results/quic_frags_ch_in_multiple_packets.pcapng.out +++ b/test/results/quic_frags_ch_in_multiple_packets.pcapng.out @@ -15,7 +15,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1941860 bytes -~~ total memory freed........: 1941860 bytes -~~ total allocations/frees...: 35351/35351 +~~ total memory allocated....: 1942542 bytes +~~ total memory freed........: 1942542 bytes +~~ total allocations/frees...: 35352/35352 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out b/test/results/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out index e77da4069..50308a500 100644 --- a/test/results/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out +++ b/test/results/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out @@ -530,7 +530,7 @@ ~~ total detected protocols..: 113 ~~ total active/idle flows...: 113/113 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 3734563 bytes -~~ total memory freed........: 3734563 bytes -~~ total allocations/frees...: 37757/37757 +~~ total memory allocated....: 3728973 bytes +~~ total memory freed........: 3728973 bytes +~~ total allocations/frees...: 37758/37758 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic_interop_V.pcapng.out b/test/results/quic_interop_V.pcapng.out index d1c4f4d73..7c07a0919 100644 --- a/test/results/quic_interop_V.pcapng.out +++ b/test/results/quic_interop_V.pcapng.out @@ -31,7 +31,7 @@ 00795{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":10,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1603816434528,"flow_last_seen":0,"flow_min_l4_payload_len":1252,"flow_max_l4_payload_len":1252,"flow_tot_l4_payload_len":1252,"flow_avg_l4_payload_len":1252,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"202.238.220.92","src_port":38366,"dst_port":4433,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {"client_requested_server_name":"mew.org","version":"TLSv1.3","alpn":"hq-30,h3-30,hq-29,h3-29,hq-28,h3-28,hq-27,h3-27","ja3":"7d9e7f6dec1cb1dd8b79d72b1366b6cf","tls_supported_versions":"TLSv1.3"}} 00460{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":11,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1603816434530,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"3.121.242.54","dst_ip":"192.168.1.128","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} 01147{"flow_id":11,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":530418,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"PKn0qB\/spJGxgjQ5CABFwAJA69kAACYB7ksDefI2wKgBgAMDt3gAAAAARQAFALRdQAAhEei3wKgBgAN58ja3ogG7BOzsKsYKCgoKCHUJ14NKwS2PAABE0nUjXqgo3Pq+h\/Bzi9p31\/TZeG7dv7XIf5N1hruOb+rMEEShGYweXC+T8EETUns4xE1pcJfcd9QxJWLz4mk48BM1d7sz6D0g90Q7A6DSDnSX8zPHnk\/mBfB7WcT8ZfCXzHAFhGGnFcwiEQYipESmQ6UeXUdKLkbZVdxhnu5LdA7U8ofrC97xC4VdpB8+pct9Ef44k+OzR1LZByriJ678sYxqlbwGB9+J+7VwgUOg\/gH2R9dX6bQQUO7rTCoyUHrYGZ5osp+I31JLOOQ0C6bZs5jO72nIFTNVF37w0TIl1hS5YHNmjLHkXmrNxza9D1NWHtYItabi0jdmvYKXEW\/jtGDBbNI5Spt\/DdSwahkwacog7vEBAslclMpeaBEdIll7ht0275DdkEE5wCpSaptHi1ZfzWLt8\/3zVoN9gllA09tedp3dfnrCs3MbxDshoV7lFoWGdn\/dNMr60Cx3AUMtm2P3NvJ\/wl+FPKcSOjciGrJox3eMTCqBEuAzJo0ymq8aqrjO3V0G12SwfBJ9tJCn3UEWBx4Pq3qlqktq2\/Fy+CDEiIPPlLGrnjA5s631GXf+eke3F40ZavlVJrfNauZzZygjAUP+676+Kjhjmdgh5vVfrgA0zW4b73tJevIq4He558UKRJU4CMox8hYb3fCj6C3dh7FjwxE="} -00492{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1603816434530,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"3.121.242.54","dst_ip":"192.168.1.128","l4_proto":"icmp","ndpi": {"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1603816434530,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"3.121.242.54","dst_ip":"192.168.1.128","l4_proto":"icmp","ndpi": {"flow_risk": {"35":"Suspicious entropy"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} 00538{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":12,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1603816434535,"flow_last_seen":0,"flow_min_l4_payload_len":1232,"flow_max_l4_payload_len":1232,"flow_tot_l4_payload_len":1232,"flow_avg_l4_payload_len":1232,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2606:4700:10::6816:826","src_port":32957,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02110{"flow_id":12,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":535255,"pkt_caplen":1294,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1294,"pkt_l4_len":1240,"pkt":"pJGxgjQ5PKn0qB\/sht1gAJBbBNgRQCABCwcKydWupNP+R2kegH0mBkcAABAAAAAAAABoFggmgL0RUQTYhUTOCgoKCggKh53oSKcUIwAARL7ptyuGj3sWoCfzmGYT9c5knffzFTiJ5lVJXbpctUGbKL5ySK19+FWpax4\/nAYQUfvCM\/bhsgFtS9G+ZFtPXpli7k9OwELHwQ20mBGQWbjmI7hP6morZpTeRWxaKack+BC0iQiX9\/LIrfrGdoT1oDoUDperL3\/EWfbsAzs51Fr37OKsXNxMOnNCWganJYQDoS1NHvgUii8j2RT7vFE3V9d23tm2baG7XTpJE\/KumpBsVLcT3VzQxufgdMiVwmhOfmQTPXaJDGA\/jRTiFeXg7nXwXEtAxzBQgrLuBhQxPykcUp0c2\/phwIU04regmPrsDteoZwKZzuohFTkgaiJgBEO37GhILvwwBeV77OMpz83mtpaFJrhJUhOB5vM0\/RgcMPtcx4bSZUJUYD6nBLhQJ\/GvQEu7UlOsfkiIrZE+ZKc7Xlk9faNEXsEX+cAq53XDHpAkkbtjxhoLLEgwqg9w2+pJHK905szCqPYz1ey662LeHpygS8mmmH\/gOERXnPY24ktfjRbIPk+3jjlRJg9AEQHddCfLs\/0YynFjxEK6SkUDk3GOa0sGfGsU7zt7rbEh4JS4h\/\/R08A7nHPChHXr\/7ZgHR966vNTPtSXBteBzHwou8p5yVwauN1gN5GaWb31oFnrNAxiwuz4e2fwfa69YtXI4XWHFBvj4iNrdRBF9sHDZoob5bniwmHivCxgMW4+Jtbnaqfrv4Sp3dq00y6\/ur4ZEHV5m4FIMmbgmAyq9vvgmIFyJKBMGegGOoZYhISRV4ufDNEsgtjnm1Ha96l8R2gH9UD5FvAjfB\/ZwRBGmgFyc1RY+15Vl0HTZ4Rr+yCWwF2I4UFS+jzuwD+H6WEkNUgBjeLztMlKSo7QMs7PpOgFdZAlYejckZA1WodUw\/1bgj\/U6KGLbos4yPh+0rFNO0QtSRdW2TgBAAQucKeIvxgOUjTBEAP34nCw3lpKpedULlo5yFoLMltnNpkze\/b+9gBG8\/1mSO3ivzeDC3y6mANlLBm2iJns641SQdnTkf3L8X6YeBJsMYcaaiKYOyuuOiyeZy0YQZa4g5mFBz1gCqnQwBTBq6z8JWs1a\/iBlFkdzl55MjJD1jFCxVWdLyjInYMNmKxijI+ky9lNUsSaDzc5mgZpk3C0ZBbV058wqQx49fSF44m14OWseuaF+VY+qapJWKKL5t18OkWciu9MrAdQ4l66KAXEOIsGmkn8zlOyO4gaBESlpwfIO6YAp9wh9uTR9L+wkJgDcSe\/JWX30SUzbiRxqTmU9\/OJu2YJTPKi8wBs0qops1o6F9bQ4myo5lBZyqDquGfUWvrEXAbX82yldqPSTFnXWZt1UdImRyp1aGJVLjK7WjTb+ZSUcMVvxEHERZUt6VlUBe9SscDBCFdepioRLv56MnqrV+s4p\/g3CZ2sX0A9nX\/xgQxdccpjrif7tgBq+g7rjwIDWgS4NTZeETjOCtp53wYAhZZ32G\/hgRuBjIwqGUhTXHOoeOasvV+WD6Qh9WG\/ZAOn3eXObqDuYhD21bQbu7H9CTSFHgZo5\/P4wYz2WlEjbWMiQ9K7B5MQdxXUQYTDHm1OtDv1m9inaq9E9Mp1YP37ABzmfZ+XPVEzLA7x\/VqZvQgYfBYQAA=="} 00839{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":12,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1603816434535,"flow_last_seen":0,"flow_min_l4_payload_len":1232,"flow_max_l4_payload_len":1232,"flow_tot_l4_payload_len":1232,"flow_avg_l4_payload_len":1232,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2606:4700:10::6816:826","src_port":32957,"dst_port":4433,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {"client_requested_server_name":"cloudflare-quic.com","version":"TLSv1.3","alpn":"hq-30,h3-30,hq-29,h3-29,hq-28,h3-28,hq-27,h3-27","ja3":"7d9e7f6dec1cb1dd8b79d72b1366b6cf","tls_supported_versions":"TLSv1.3"}} @@ -92,7 +92,7 @@ 00808{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":33,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1603816434606,"flow_last_seen":0,"flow_min_l4_payload_len":1252,"flow_max_l4_payload_len":1252,"flow_tot_l4_payload_len":1252,"flow_avg_l4_payload_len":1252,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"131.159.24.198","src_port":41587,"dst_port":4433,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {"client_requested_server_name":"pandora.cm.in.tum.de","version":"TLSv1.3","alpn":"hq-30,h3-30,hq-29,h3-29,hq-28,h3-28,hq-27,h3-27","ja3":"7d9e7f6dec1cb1dd8b79d72b1366b6cf","tls_supported_versions":"TLSv1.3"}} 00461{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":34,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1603816434609,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"51.158.105.98","dst_ip":"192.168.1.128","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} 01149{"flow_id":30,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":609154,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"PKn0qB\/spJGxgjQ5CABFAAJA990AAC0BNLcznmliwKgBgAMKP5oAAAAARQAFAKEiQAAwEUWiwKgBgDOeaWLKrwG7BOynncIKCgoKCBGs9QKfvVcQAABE0lvluJrmL\/hMeUw3YRhBIJ\/7gLtKpaIz\/yfYSAz6s8M\/iZU1xT7UiPmoiPsMT3FCwMnulK4pxlFMwSTfXCJHpc614jjRRPQY0r4A52kRAqbpnpm4pGdhwJNk2VhjYh04QB+ATZnDkcsklWaxwa1n6YHU9l\/hwXdVfRMJRZaRjlnNVjFzYTJDWF1bqR3R+8VW0waOTiwhJbmwo0jy0HGIxrRni0iCPehpoLwTjyK71TyZayvNhxdtGvZzTbpHaeAT15y\/CNrfq29HSv4IbvE0UmtwPnAkf\/K1m2amootTqW7mZ0NRHFK3HiA6yyoxrFYKU9\/CqXLS00PyxBFYvXIH8JHdvMhif7EW2Q2vZzfwwkJPwkHVXd+ngfY6wGLILtNDXV2ivGtdy3XuvH2ccmQEKSFZ73Hx9iHdBl6qjfCYRhGp6e+IEQqSNu4vIjwJrHd1DI7AFuP5HVV3t0uwiRNlmNLYg\/\/iQ8SXBZOZZXE4JJ7SqpmG4T8bxGnZ3BCjiEFishkM4w78EsJooOt\/y+Ru+rpDXeXF0DEDfcvmU78O5MK3Ul65ZjzZQp5A08B7wuQCd5NseMaqkP4jaydGTyiWvmW0mmoH\/qDqrJMH+DDDY2TMH7n1pK4uNzfng27Vymwlz4bVFY+NOz3R05sw0AhIXP9mFCKSmts="} -00493{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":34,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1603816434609,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"51.158.105.98","dst_ip":"192.168.1.128","l4_proto":"icmp","ndpi": {"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":34,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1603816434609,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"51.158.105.98","dst_ip":"192.168.1.128","l4_proto":"icmp","ndpi": {"flow_risk": {"35":"Suspicious entropy"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} 00472{"flow_id":19,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":35,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":622862,"pkt_caplen":89,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":89,"pkt_l4_len":35,"pkt":"PKn0qB\/spJGxgjQ5ht1gDsWjACMR8CoF0BgM6YEAzSri\/bO+xasgAQsHCsnVrqTT\/kdpHoB9EVGcCQAjCvHgAAAAAAAIawwAN\/DoMJL\/AAAd\/wAAHP8AABs="} 00505{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":36,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1603816434628,"flow_last_seen":0,"flow_min_l4_payload_len":1252,"flow_max_l4_payload_len":1252,"flow_tot_l4_payload_len":1252,"flow_avg_l4_payload_len":1252,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"202.238.220.92","src_port":38933,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02100{"flow_id":31,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":36,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":628754,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAUAStBAAEARganAqAGAyu7cXJgVAbsE7FzZxgoKCgoISaS\/HP4FIE0AAETS8b\/jD+OLMZ5ZfmIPp7wLwtSW\/3e3V56tG1ccXR3vL4iMRvcTifVjxLwR1VEj5kxXicua4ELuOiBh14YJiINigpT2w+4dKhfV++T2HAdDXb9HRo8Wp5\/Q2I0xH7P0GEZjVSlxh\/KVM7Q8JSVkblMvtsmlTbMHoKyKgv5ZVuhR9rKzyWjc0bDTpihNkKGhI2W23K8YpCOo163pvnpUs8vCjpMKx6Y+XLOjz86VHxZ\/dSIUgwZkfU3hXvxraGDqsOM6nk2BsxRj6ED+eksutrG0VvP5Wbl\/nwohJ3snk4n+kCBY8+CDoT5Q6xIqcKNeqA91veY6WDNW65NdLK9tq0Kt6NyRCQ0iHC1fm8oqxzK49Xy9Yr2klZXjGA6Wb9UmYx6KSJdvg6i+UYQf+hP3vTAcVrvclwQjn1Ttts6+sIXx63DdYoKsDizIkqnYCVuj0roAtIdLG95OmHxjKHrmpsQyLltGhTZMsYJQRCx5M8PpL+vjXo6pu+GHq\/GNM20vpbcH4SfliMSbdeHv4qviRxdJ9R8w9OkBT6XZozO3wWdBmA6PqET53j\/ug0iSc1MIiO+\/q4LSySrTDiP2OBzfwZT7hTAaYz1DN1CxY6wbbPEjnyqCdpqZ1PaOkaWb8OYt7bm6J9VMzWbMZaVbajU0njanBfI51vKbom0V4qvMvcrqXEEunVPVtjgIskNplvDAftVJ2vZJjRMGUEv2c4SLniMT\/gRm2OeeaPXHe1brAnbRvP5KwVwSyHq8W08M66VBt+caimizIdJuqJqF1FGzRpHgQJNETaOqosq4CaLQrU1BEEg3UbRSYSWKj7OLTgEqG1JOZb\/nz1GI+TfOOMiy+107aqM+S\/i3Tju69xYk1X3WP1Ozrd6Wj6AC50FxHQQFSXlNPa5e\/vjVo4rFyU+uJE9u8JoYphh7MyJDB1VngH+kgiqxcBa2QBM5E51d4uR1hQLe+c6gd3MDh43gdsQryQiQifYdGhNRWZZaw2p8fRtUP4Uwyq\/B0bHFpZ4t6PuvIBU1+212nGGZUAL7j3HFR48RnO1qbO+GAhey5N9lWYMlU5tavGiXfOhlX6cAsUEQ2Q6TLV\/ZCB5CQG5QDTtdPH0QZSPPPDEVyy6HE2QB0rH4vjru2j5voDUPBjLlpBQ\/NL5R+mTgOnDFh7tGqQnBHhyDGFO\/50NeIGNTAc07+9N1IfFyQChGLc3grwS1SkOgfURlQLF+0ioikEL5irbMrmWTd851GONI9exui+8KOT8c959NcGrcyY1CIpxJc6JPQNgq4cGI4ljycOhrXFfcY+tJlEO3E0yGYN4gMAGSars7BkXFZLPWbZY+Sb4jXpDImxv+f95nzmTySeAQGcAaOitCLcJ318ljtkj4SzzBlngK7\/jHpA1EPvZ2SJKmWjryUfQf4JJVEzK0DHUTA6qLYV+785FtwR53Rvcfx8ZKasxHIdWmDmMQfSDcjCfFkiPKXadftOSR0e\/XsF34XRoyBUx5eKGVWThXeNxNkMdpKbVofP1BRG3kl02O63aebe4V6uZI5YzyQUh4Dl097fgC5KIZDSXh1zEWqkg2eojIxOsLE8glsZ++gAFLU+Q749QmZTjBy2vyjMlxdSRKWMC6H66lOKBGFFFOZV6nr8Cmiz6E4iT7yg=="} @@ -105,7 +105,7 @@ 00853{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":38,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1603816434628,"flow_last_seen":0,"flow_min_l4_payload_len":1232,"flow_max_l4_payload_len":1232,"flow_tot_l4_payload_len":1232,"flow_avg_l4_payload_len":1232,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2604:a880:800:a1::1279:3001","src_port":51040,"dst_port":4433,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {"client_requested_server_name":"http3-test.litespeedtech.com","version":"TLSv1.3","alpn":"hq-30,h3-30,hq-29,h3-29,hq-28,h3-28,hq-27,h3-27","ja3":"7d9e7f6dec1cb1dd8b79d72b1366b6cf","tls_supported_versions":"TLSv1.3"}} 00462{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":39,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1603816434629,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"131.159.24.198","dst_ip":"192.168.1.128","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} 01146{"flow_id":34,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":39,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":629806,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"PKn0qB\/spJGxgjQ5CABFAAJAgVoAADQBpNWDnxjGwKgBgAMDhTkAAAAARQAFAE67QAA0EZSkwKgBgIOfGMaicxFRBOyPwMEKCgoKCAqQphKlf+flAABE0q1MzAF7B\/pTV0kG5xawMpe3HkhLaz5LmMUUyw3WhYoi5nbpPV7NpV4GM27AXpOgHO\/SzLtIdktFTC4TCKMp7m9qMnCbweSvMGChHkpC5U7w60\/uPzwGl47ucIe9rYiZgKyYjN+8oftGbKB4AlEqhdFs2MoFYovXtoKkQBN7VSB0IxvuY2TC3GidshXx3wTMXfzuo1\/6i1KLTmmNbxSq1CGPdP1PQ24uDLBbi+meANNn06rbl+K9tUdkmsxH+USREu4XCkprwqJDGZjipci4pVwimHHp5mYTfFDWt8XxRCHJmOScE5wt7DLDqP6wUv\/R9RjuGRN\/nD4BOc5F4KnrlgXBSjWA8uw\/1hUs9cHVpYBS0ltoa5wxXIx++EBaRxTWEi36GVZ65l2iVnWKkd\/xq7p88n0OTSzw9MX6zL1vpn8Q3b5hVpTOfk0XSi5xbalOfjBvaK425FOHISkLRT4hHBTrZPDUxwxwBg08G2H36nvO3sZ2DqZCH92UgDfl3OrnJTQ5kZer0RXiGe8JxWv76LxDqR1kJ0SXR282tjRVBUWk2yeunxwz3vNCj4omHVmk44mRi251cY+XJzT44HEva4iNMf74w7Rm7ot9s3dpNfVwJPF0r16L56vzdWhG5cGOJ1D+VSlbkJMR4r0BQwF2\/eCtSeTN+rk="} -00494{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":39,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1603816434629,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"131.159.24.198","dst_ip":"192.168.1.128","l4_proto":"icmp","ndpi": {"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":39,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1603816434629,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"131.159.24.198","dst_ip":"192.168.1.128","l4_proto":"icmp","ndpi": {"flow_risk": {"35":"Suspicious entropy"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} 00505{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":40,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1603816434640,"flow_last_seen":0,"flow_min_l4_payload_len":1252,"flow_max_l4_payload_len":1252,"flow_tot_l4_payload_len":1252,"flow_avg_l4_payload_len":1252,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"51.158.105.98","src_port":45250,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02106{"flow_id":35,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":40,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":640692,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAUAXZdAAEAReS3AqAGAM55pYrDCEVEE7CF4zAoKCgoI\/WffY03wSeUAAETSMHofJsIVRtpuQGVddBW97CfvMNh6FstJkOMpUt\/yyfMol2NH\/cmw9076\/GVp8Jiw6RRO55nAlaDXRKDx+fRRFB3MWLmB\/9BdlA7rKSF+bxrlmvb7IG3rx2evLnOEA295WB7h7yye\/Yb8SM1ckobonKrZZ3VSIcOyeDvx1To8yKU8S+qgO5UB6V6j3ZR4z8tia9hoRBaJuuWjnRXPIzRC\/Y4Ty4G0TTfbVLamm4ej+5tVGNr3TS7pN2Xzt9lr5OogvAmipVfcrFQmzNA\/+bixOvtJICDh3fR9sII+Aa6F3m95yiDF8HdhXx8TxWV640MZkTOca5MbcwS+YPz+INAIjF0s2owurg4clHkrQ\/h1vY9wfL8cau+doFTFKxQWkVu3t2i\/+mAsWEv1COMBJgtwWY\/1oMYnha9PWceb7bjtXvQ0AFrjBC2iUpE8uKG2lpMj3vw++EDHs4D8UOswAsYKSR3QKTNy5\/n9F2K6wbOe4lbPp1tEUC9i4BjrP65N5Jjd4whCLlWExxdcuUiqmeRWX1rLfPxynJrkw7vqaREC00sCdzi7Lh2rgh1ZgrEUMSznXgMtkuiWXjnmdl6yNUvpIov2oxF5IIqE7+inmRUO\/4bFKluz0rJxSvweOGUOG06qc89\/fVfEYvQVfSGie\/2jaZPAoa73lw60ChYZL5W8YQTUE+iYwCEs\/LrU43Io05inp4fW99XL+dqJLeBaKkadyRCr+ZlWnxdK3SIVAKssrqk8c+dwBP8Ga9TvI0fwtqyE9zLeGdLLth+UrgzbKZkjPtZvumQptE3y8vzXm3rNGckk+s+tH5kfuTErhMMgcEqqghapUSbghSKFnvd8KXrp5I5dImNV23VsAFnZphiNdSMrAO\/5tN9cHTB5kZFEzKzu5mIwtp39YSpIVho1618W4woojYayBTAYGdCFJnsdHAOWZ0YNc9fXqn3t7pH0RfvXqhkQ14VLJ65JuJqy\/Qz9StzBGBZch\/xsRQnL8tGwRc9QlrXGc3QWq7muqAOCyzpHoMChq2oTRE\/8HPgudmPNkrAf\/ScwBASioyMRhmPXbQOnz8kpZqhiLFLzbv+SqaBxgR+bgVYn1+3zxEWz0OQ7t81FdQLiQ\/r7o1w\/5GTxaT2UQy4+HSu3XgrEmc70xQDowI3TS6l1xbMtq6G0wpiqDxghwCsLBT2Jp0llaTYvV20z5T8ax80YSjv99Judp7QAD+5ZWDqxTHKL7rG3JmR6R8uIhzq4m21IYTygNOeNDTZrVPa3NY1BluNOiJM0ojQMwAtKPXhJSECktSWYBn4OIxP0YP6tXleYVmyb\/7bsrgrloCmarQYyCzGzZUopQB5p32ofLV7NTKVj48TfiOfWu7G7+u2kMk6czrGQwjYr399xRe06yg2sy+HVyEgd6XGMtNrXxL3I24LS63NRpc2fVvxrjZFP5bKendh2XIq59I5JF37M+rn6izwnuj0OrSHOnrx4VNLacB+DNwcXJTwF6fVCp5WfoIclvXXgD5bQwPAiNcduRQACIAJ6RQmeAmxrOjgDcNXfvMKHilUpISNlFeHOjhQMA+MiaVzNspXJLCod8B953YO\/H92LBu4hBpcVIl5YP489aYAYtVAU\/QpiEmGNr0vZKsef4Zb9RxDNgQgxIA=="} 00802{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":40,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1603816434640,"flow_last_seen":0,"flow_min_l4_payload_len":1252,"flow_max_l4_payload_len":1252,"flow_tot_l4_payload_len":1252,"flow_avg_l4_payload_len":1252,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"51.158.105.98","src_port":45250,"dst_port":4433,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {"client_requested_server_name":"quic.seemann.io","version":"TLSv1.3","alpn":"hq-30,h3-30,hq-29,h3-29,hq-28,h3-28,hq-27,h3-27","ja3":"7d9e7f6dec1cb1dd8b79d72b1366b6cf","tls_supported_versions":"TLSv1.3"}} @@ -248,14 +248,14 @@ 00473{"flow_id":46,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":107,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":802819,"pkt_caplen":89,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":89,"pkt_l4_len":35,"pkt":"PKn0qB\/spJGxgjQ5ht1gDen3ACMRMCABSAB4FwEBvnZO\/\/4EYx0gAQsHCsnVrqTT\/kdpHoB9EVLCfAAjD9qPAAAAAAAIIsGdLtPZLyX\/AAAd\/wAAGxoqOko="} 00463{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":108,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":71,"flow_packet_id":1,"flow_first_seen":1603816434806,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"202.238.220.92","dst_ip":"192.168.1.128","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} 01147{"flow_id":71,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":108,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":806510,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"PKn0qB\/spJGxgjQ5CABFAAJA3rwAADIBPo3K7txcwKgBgAMDrQAAAAAARQAFAOUCQAAtEfp2wKgBgMru3FyV3hFRBOy8bMIKCgoKCDeSrwfZ37epAABE0hxlYo43miI9fcBT4NXlNvUyuqRzjALgZuz5ZEFwqFAJHCLIyiKMek3pvG1TfFtz+5dPcMlRmn1CpjYaJxtvjy1D8CXnaCGG32gK7yv0bsGVDyQR4j6nJT4\/BgeG5XzS2QksROzvNGVoOiM5mh9Gcivemi\/Ltw3i6ZMLxPmYmJjzRy5MQrmw7yWShK3Q0gjXLf\/AtAzYy4CwwNnnbu4HeZWuRph4yFsqigrFQzQiWW5R3FQS9VXQNOqcmpoWiLrZR6ybbeDMER5x2lrIuMbSZiBdtZBwZCB3UjQ8D6WXWUDqOreiLaatWU6Uu1Td\/atS+bPWsWkMIdZrEKUJ78RDCkU46YaC6J9gteAdBR7kDvpyMncXYbFq+wnVLl7bEkkrsFjuC3evFwokMfctXgYgQAfhg9lrv5W\/V8C8b+SLLGJ1OLOrQb7nrBWiHG6ErtKg2rmOgmj5TlcyL7QCWDLLcB4wY4DlINVS1W1uHvEQAamMqwBYJNWP\/j7R3\/z2LLwmYTggeZKmyJokcN4daQ+u2GrxKAd9n8ootJ6q14bjsfNDrGHdfa2X78HqV8e67EzuwM679YHyVDVcjdxmRT1W7vvW2odG2VW9n2hGz7F7x1SewA4VbmCgaMBt\/706B\/PIDrHOTJjIgOwT5HqHFLiW3qe6lZFlcg8="} -00495{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":108,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":71,"flow_packet_id":1,"flow_first_seen":1603816434806,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"202.238.220.92","dst_ip":"192.168.1.128","l4_proto":"icmp","ndpi": {"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":108,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":71,"flow_packet_id":1,"flow_first_seen":1603816434806,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"202.238.220.92","dst_ip":"192.168.1.128","l4_proto":"icmp","ndpi": {"flow_risk": {"35":"Suspicious entropy"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} 01156{"flow_id":30,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":109,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":806535,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"PKn0qB\/spJGxgjQ5CABFAAJA9\/UAAC0BNJ8znmliwKgBgAMK13gAAAAARQAFAGANQAAwEYa3wKgBgDOeaWKq1xFSBOwXccwKCgoKCNp6o2ufRw8jAABE0iMFIf440snHtaQbpLTAJ\/\/X0Fab87I\/F+H+s8yGuc1DMj7IRCVccfx4Cactg6LpwLVqjp+zMpHzZNYgE+iBS5eSSQ5R1VIB3pIpWgR10BZu4jbgQ9OaBdQdBe6vEK8fOHQlW4z6tk88yOBPCZ9MOnhihM498wDmMjf47XEsFDB\/7XQLydimXkVgGcIAWfjRxaXaSbJMTKKvAYms0ejZnQnA1ViSWn1r\/yep9jMB4Ha216Bw+8\/bwb+zk8NWbJkU1joIp6LywbS8BKMNdkB8CvtxCpRm+uw4pI4+h7Ir2vhBxo8l109zWnww9jHcvrRJCAiVTzHX0IEoiynIkV5hfnomioZ+rfmWQ18DCMdbTm0g8xPqOvlcFJ4riKg6eD9T\/06FbQ\/gfMez3fH3QaSeBi2r\/TOHCN1q7d2RWFd\/zfCVFlJ5yK8kQ\/oLJ\/FOsWcUoocGzw5wDW2ZJKlMLUQVjXb6yA+tyXiZShAlzoYqYN0T4FvgLVOww\/BRgkMCtO+yhyv+IhNBUZ7HwVrODYj2Fkrg4imzgs1D4nwXIka\/LTCNZAzA2HaoTn\/7dnEMFUXWjYgl6Vcr7VmuvChO2Lk2W46SOWZvSzgpXd4SdNTImeyxURq7mYLuukLenDSue9Jo+fNHodI6Y4FhBpA6\/I5BPKpcZmf\/iYU="} 02108{"flow_id":42,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":110,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":806673,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAUAlgRAAEARiNnAqAGAhfLO9LMfEVIE7M5rxAoKCgoIJ05Q063kdsUAAETSbVS8wmTCayioaeEDJ0E7Ag7cjypWJklnY03J30b1mdxIVOpIcCjzHgeNDAUeVGYchax6RLhjbFwwP3C\/qxh1OO8O83qldI1OYg6x3GPEV9dhbYkGdVcPi3mfVEvzh3eS8WnvbGq3a4H9q5E9mDKl7buMufgYFu2sl2hZ01ag0mTo116H4e6bMaTreq2mI8kmjdhWNv55TN2Tbo0qvafHS0QviZ2QSLwEnQh4J+FGfyqh3grvQtfWOnpdR8XEyF6DDe7LL\/KlLa4NwBuxumU\/mO\/SIZ8t8LmkA6HXglfpy4tEgA4X4H4bW8fdrEeEGZwPR7eDrKq9RqBC5oKz7o\/7sHblT4DHTu2jye83jOCQIrWBGQDr5qMowkCj2D+qE7I8qnehPTO3H56afZrW0y49JxTPEZjoHsKNr9nvjAleyeYuaG86WZoQwGHWl1q\/do2IozVSEZwB4ZhhqabxXQE\/bLsaV5zpA9VarwnHFfuqnigS8SW0VNHxqwF42AsxDhJ1ZhApy7feoO0PJvvB2oMY1tQHPKfitH7JeAITAfnhaBY2YdONDcZk5oBrPbcpcIaGvU\/fGwgBQ3eir6s7iNWqBonZzNxwiJDZOCaLqzesvSlVLwJWfVmI2gbBdEGORyuW8xbxQbWWWdwZ2ECu1W5iPFYWZNmDQ5+p+xP+v2p\/q9Zri2SEgtxNFAlFqBgYJSEcW+nfhelld\/8X+b4MFcnpWATco0d+cUaZqJ4oe\/SV5lTkb+r+kBl4Fi8vLnITjPgbX+wBQtuHCeIhIpPSGbKfX0e3KDUQANebIeZRTrYcajrn1fFRlg2x0mgRQZE3eh9zOE\/6NevPmRKd3whKrB4OrWwNw\/SlNsbpFrYxTvS9sFHtHn\/Uuh9Itnw6lb7ILr8jkDVyk4MOLQUBCbcYUCUwkQa6hAPdxDGJGAORwPlVdN1voToAmZpSEQkdedqob3cIiQWZE5mZWy5zSP4b+LhOHf9ORwzuNzfdlhFMGkZsYkTm4i9Glf9wL0Xp7g4iBWo1g\/ERgUa+jz9aU\/5pM9Q2WKNxTb0oWtxniWBS8Lxmsp0IiDMHvpKQ3FN7FMkHusFent8sdfLu8GN0db\/htJ0tYyNHKrn+\/ukQfcuGZu1CZ8pcapnxZCaWzdysytGbuUF0sN2\/rXvBKbrUoGOi\/yQYHoSWzZe4tWPuiFsnEL3ZfeQW8rimwLD7SocitIb0a8vtHdDj\/GmOBVkGDMBGCNjj8XxF6Z2FQBo+4oYwGZuGhSsfMXRlNNFIfFsIHDW9OAdCunv3+x5JsDNF8ukUbcH9anX6B8hHXxQel+qabQ+aJWYsgcN\/hIaoFyjxqHkiZZ0o818BWeuCXCM0HKhfsQvXHf4ucJSBS8pc2EzJ5EUcQ\/dllBKRQbIrXCSSmkQFN4Gab363GSeUDA3rD\/GBoK5b27D4o8WAAnT3izN4JAXB+H9hgMX9A0cMJMRRasU585OfR07ntlSr7v2dExw66EL\/j1gd3QFNGbnOWToZJQicIfGV\/RtMUnXQYizsWgjoqWOPbw2wWrCqJhhbkxH+WHFJq0Mlwe32rpddmRI7+CtcRWBotdeJJ3xxfL7AYrxPw3cctN1iTAucOHdUCyCwYu\/wN2z2Li9nrj7J9G4sQVWMiuNy4Q=="} 02103{"flow_id":44,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":111,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":812388,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAUAqqBAAEAR4XfAqAGAKHC\/PNIfEVIE7NGPyAoKCgoIcBuNCNTaAX0AAETSdrPs58Nd4whderbUQKKE9lqbT2Q5dWXTzCU30Nuk49rwMOYzrP9hqurmfQzCfogq7GSDP2MPa19fV3S+tzaflHzUKhrCPd4WQ1zA7H6cNQz\/lRUSpnQOWA0uQAhhAk+IZiglMuTPFh7AnCe7BzheAkGio7m9ekHUnqgl2NpmpwBBQY2oKhqJXzck7whQvip39IREDqyYyokoeQbGf08lhmJrRyewd07SbXyZCbXrujwWAH9r0NguWbmeWQiWcLTQKzzy4g6sxprDxKvBtQqoDYhvf3TyqAO0JNQb6gL5PnsCQpPHeNU738v6N2EJwaCYld1aJc1nCH2E7UBhR1ArdPBQvdD2ti3qSdfkpRxzBao2iX1sHBqDyALe5QD\/8T0uZDT7mlUSPcUSCQVDdwUfo1H5Gw1rANt1KrnL+D7EeJEt30JdQogzd+25oyRRh\/N33koVbRPkvhHtyEiSOAqUcF2k5Cww7VSNAXDrSWJ3nfwrxyNNGcTk1vbfU9FQjS7xTsCs1DcL3tIwTh\/F\/WqE0Qefzo3L9DVZUBF95w+x+NrXTVfTMFyerU2W9IiTbdFPifHfNydqoB4UA6KdAkF420byZMA9uYn1eronWwg6zZLfNiMThXS7INZHCSmquoQM48twpJMiC8QLa2BKxvBs5MAXCaES3COreo36bEsm9T7MBNPrIFP83x9oS3Dwv962KtUHkL2c7dl+XXAGkrol0zp9I4duf7jIdkEwKt6bINytvQ7NOpnpqMe2V\/od99AzLNPugOYXhVlxSXXrKEIlIoBOH\/vFhTYqHBMHhKDUlY83Lqn6rlae+5ldEt\/PYxQqh9RlSvlTKizFbfa1Pqv6mluoxnZYLP\/Q1ytoMX++Rq54VSapX63zxer6E2Fc0D7Z6VXClsXzgGzvHubNlFS8CT4jYJOejwFK\/O29QfOBILbMoFfrRtMOMvJfvtl8oUyriiHZ+EYZfkq6QJnQfCI7a6a+eQggExHpUAScmRSiTG+IYeca3pfV6WTNGjJdxkNLPzA1Z5SNnLP6zTKrtTQschUTrKbBMGzeDxKanuLhkyCaGkNHJ+E9jo1kVSKyouGn1Xz0RovKIuTZdoKvIiFgJRBRTx8b8VxdFjPJBtQkuwYKYuNAT\/hv6yiy\/pQHRSFz+yZmlAIEJ6DuwyjItKkBePqNsaDsx8Am8smaYhsjEC8vmWFe5WEi20pG0HiVg5O5kSIY5y\/ziwUKkKhqlYGirFSKeTAYJVJpGBDrmIOk\/QXL5fYdpveFiq0l+piS3JuL7TGHxf5NvUDjc8PuuHAyslhM7YLSZqEKmlqBzNKi4Z+4Im8\/q3Qs2A9hPYC\/n9KxnKOeVVg7MxmNr3suDiWJ08nJtK7eU\/3Dvj\/ONoqM5exqmHYkJmeB\/i3BYkfgX807asMnZtideGvH\/mPNTuLBycK5oBic1paBSf3T6UKDwFomFMK4zRvQ2RTDSsREhwoKBAz9DUi22uSOarNzx4IBJQAnBsKlI7YkUFuQf2bHXLeTlc3sjH22aTbkcpuNQVPhD3jsXLo+uLTFSabB0ejUHrkQJu7N55kc5Hjl\/l+it9+skmXrEhRgrnh+Crc2M75SVQkMGW4nqifvwIUFkprpgBKS3scwqrMQ4XMu9+qfHYRTYA=="} 02098{"flow_id":45,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":112,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":815809,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAUAv\/VAAEAR567AqAGAwb4KYuh7EVIE7CoKxAoKCgoIhDOd38iF14kAAETSuj\/6PpYLanmhufRbzBfIfJWqpHveuI64\/eSlK93oC4y6GPXD69PeaFagOPTyFkLIpcEu43y7OCQ1Z35Isk5hak2XHZkMptd7KrQ0EFnJR20xJ\/8s4Hh47hOyrjz0Tb8KAyxJMBwDu01llmEO1Z0EcUEdsorSKLQ\/VLYtmHdEq54kYxwJK6cbambFBrjQfMNHN\/UVp0rFqJczDmgAC1L2e2MT22BlqqRvoo0urlHqeJYQ0fzf9Ma12psTRriGSLqomnfjAnDrYcUuJXKUNEdXIMo0IvCKK8Z2qE53aAwCfpEoAKMk5gq0fRGK85o3RF+aZZt44gpgPnPnQ3e3amJGJyTfNiB0r1\/n8TxhrJAQSkdTnqq4YW8ifhktYPIg4kTB2ijlN5mXKs6fM7HXB7edk1jJ2vRSPS\/Sd1iJC6K7IVGG+b05Hvoqeh26GxYLnmUShKxodNsm5bqP4KQTECZRHJGO5bC3iH2e9AmHFRtcJuV0TEnymRBdJso15Mw5WSKs6MiqZOUVTNhH\/pBSIvkiB59cpoQ2kryiNnrZYHeBm0GW1xHBJINLpHgWU+YOcS01DrnAzJKiAR++TsJqZLlDgEWdgltoevZ9gIp62LQq23k1aN8sOGWxJHB6SR2oFKCim70PXdVeVV2H14toHpbqvnGJ5OQ5TAo9F8H1kILTASoi7zMbCXU+ihgxAsvPHQ0ma57WHD5eEfq+qwnIiOkWrwxRNyE378pWGBYwI8oYScRtd2e51pW5YbrsHNUZOF1BRwr4kRNdeYmvBnBCWqp1oBtltIzrn\/Gfcg3DcXmKdv+wNqmSl5ckBYOsYJvjs7+A0lZkaQsFSCJS6cHnp21uzZtbuJMxnGuFlucbDvkJrbZFiIDRi1zfBizG5xYGqI2LuZiKga47IwNdNLC8VwTruNg1oItufwg14MMC+X8kARERXQPJMtpnlcPMl3ZXZ+eP3TlPgYKElfm8xvSbmiMo\/gyHVDPysxCqGIaONg8hr1XRFRbXCrsQZqBHdR1BEHr2erluZx33TA9nEW4ljFgCY54FmKcPcThHKkex0pfCGVG0rDwn5CMiYlKCqMkq82agukv3RtcLDwavHHxrRJ4GFUlIajj9luP5Su+tOXWCKfvD7RL2peHKYq0oE1i9rkQ3J+6rPx1pfTLMCYUSGyR2ULLEVyAXotaIxy15QIlAlmWMZrgC+hXiaIxq+hUyINFVkc4FAkBBRAU3EDU5yTv1VQUZR++HeJPUvDn0Ly7STUB7C9GMGsanejmwI9FYR1azwvEiMPzo62YRjgMbM2H450bCbY\/ihQkhW6vCoJACsZGMust90L1tttL0aGDUuM2ekxmmP2SR2XGKJhksWGNk4Qk8NcSbtQGw4rBlTHKDoA+TNa0noiVD30cGIgXZvR4LzxoKJTHmmdOUfJnlbktOUO+L10wT6chVbloEO7Gl6LmuuY63cBoGIu\/9oxZ1fVnf\/qtqp4c5WdmDqlzryd3pEbe\/IAUHs50fQBLfKzcvYMcdoYWKI2XujLzx99HtpnCDcHHfIGi2GBE7lCFUhpHVx\/3REbGwPNIrR5hVqLd9oAN0IWu46FpJq5LdwUTeovYvLw5NA\/DiXOdXc+4fQx+cmbBq4bCo5iPDOTurjVG+AT6KDA=="} 00462{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":113,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1603816434818,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"18.189.84.245","dst_ip":"192.168.1.128","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} 01154{"flow_id":72,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":113,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":818859,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"PKn0qB\/spJGxgjQ5CABFAAJAOvYAABwBN+0SvVT1wKgBgAMDupoAAAAARQAFABYUQAAeERf\/wKgBgBK9VPXVKhFSBOwZ0sAKCgoKCEMxhVUtcFhGAABE0qWeLu1BQPCrvaqmOZLxcjaUsYk9VVde3D76gcDL+4IVysNvEgASSqVVEGYaLPIGcbZ3HxJwj7UTPMN9ktHDGQ7OWCRzA6fqhalBV5YwIQEg3hVGDI6qpqitsVwDd8\/MN70IjnRYlLSnGFiFQz\/+37tcMd3B47Z3XUJqAC2gmAtiiG7FB9bVCqu70\/\/gVbe+y8Aiq8lY3pgapL115bg44IU5ONIr0kPIychpXhB4nGil5WtRlR+PfDZaCteJDe8INKJO7W9rCoQHxbJrdHcgp7qNCAvNvwYE3E7IaJzWzZ\/MoUUAYGiQDU5QZNqlmNLsfw7HRz7KL6RKhXKo6arbCoyf+aekhlzkYvXUC6YXLfcX9b\/uhdcExVVj3t3h3bEjsqfwcBC2sK\/3+ftXoClqu\/uJmzlR\/hQg2UZDVSBch9t4LjNi+WntvWr6v5Vi\/KVQ7U43\/Gm4H1rcanEorBOGJAHhmqtXhOThueWcgpRyjQ5+C\/V2Y42zfQkNRgnvzhVV6TCNj3xIlnBpiCnjYGEauIM5QGTgy7j1eEARKu2SqfuTVUmi6oEn63B+sVeMBPtI+6+VRIb69rup\/\/2zzUrMqEGl1Ofqu0NMNJUBI++5TMEJqz8PBpY7++PNBvTXVMJHf\/6eUtUbUHVIf6h+Omvu2jYTq0R6BWM="} -00494{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":113,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1603816434818,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"18.189.84.245","dst_ip":"192.168.1.128","l4_proto":"icmp","ndpi": {"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":113,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1603816434818,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"18.189.84.245","dst_ip":"192.168.1.128","l4_proto":"icmp","ndpi": {"flow_risk": {"35":"Suspicious entropy"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} 02112{"flow_id":48,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":114,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":820874,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAUApCNAAEARDmLAqAGAjOM0XK5LEVEE7GREwQoKCgoIlk3\/sw8\/b8wAAETS7HTMpNcxINQW3ZN+iCGS1z1IAElwdp\/JkpB1113BzMoCCRTe4FQcqzRNlPfFUuL337y9c\/m0xOQ2BSNabPaJGHp30QAKNdTWLRiE0u0lhDN37WkJ3a18g080qiPj3NOKBzBb6Q2R2eP+Tu5VAgK0JBnSSQxscnBGZYx8erjfdk\/KfB+k80tJ23vgNCBrw5\/QJHyIKFr6T5gcmaoduB6MP68CbMsVTh+UudjvNuCb47BBuKD37H0qZ3vrzszhEdCnaBPaTgDC+BRg\/7zjd8y+\/IMXoc4lcJ6yCEUNd5PMsCArc8JfRjxmtTjKsNnWLKbOCz7De91KYHmwGYzaF+m0hYb600XnI1+GfBH+Yt7Rmih6ZJFb61s4n\/p947s86kVOIDjkRzXFc5rj\/5TsZlNwMgHK1trFOYKfIQD\/nGNPAy3b1yszE1t6bon4A+5+sfdvgO3Pb0vQv7a2RjiEoNWsOgLHHYRaOns5wLvhGDh7p2oiwYoA0dOQULiPA3oPFIYn3l5BexqjNtcP9rDwal7aPEC5NULq7Zmi8SqPrNQKrHxduW\/ejURdhLL6oGYtylwTjf6fFdLzV74euKvQMJtzqOmUVsGs7ytHwIW0zUSVdcXZXNdfHTIBhQmt1LEXywwM9sEku5ONFT5vw3iqnJaeuQ3Z9RVWM6JVZBIIyhtRHSHLMWoMYyVHbzNHU6KHtgRqx4XiFpODAS4ZKLu+YaxH\/jgJPdH9GCKqWFOo09L\/MFa9JOyzZTBHgPL9\/n6dV\/AjYlz2WHUbgl4B47TvtoGesKFiqCifWwa9T\/QAs6VqSsxDxakmj9BwRcyJY9Fh+S0GJgfOD3vdFv7r+qe3nnZPXIMdHvVuagTE0AYBONNrKgYdX4Ky4qhLEEd5cE9ERtsD2WvjOGP2X1nIyl6Z5fwtC4lFzD4HiYxcWYOwEoRb4XOLMLjHU1VRqf56Q7VOoNVljrqpfUTD3\/kymwOaOw9lLI9P78KYSDd0ItN84RFi9m1ZATEA4B8xDEQ0xgm7gZL75Bj+DcL6tIj3M5q5t+D3grLTkPWXTTA36Ac5nJ553GrmMeyNqRY+oz7\/jmpae2pHhn5y5a\/JNHh99ySrjiURwgTDidnXFv\/avhfUTEIKYf9vmF1mBR2BjGIWblU\/xSsHPpQooMBCE1pv+edhptbedN01raww3dKDhm8PKg0\/39zcyjrIDUoGuCyt7fcWYxL1rSfHDWFvTo3rOPuLREGMhWKH0rTw1rfsvP7pj9wRWFuq+5bjg1YEYzOa+4ow\/G36iMyOEYXSETkFxk1k9PKRQcdv+hmZ7Yysh6jGqSQYubSckYOn7rzqjXzTbZJ4cVerQWc6vzgu\/f8kKoOJaHeHCNS3S8Ih7LoFy\/3HhVH9BOwbPs1b8AjTnrabB9wJd2L4xt25UkVcDS6dONKmrmw3h\/i2PdMTiY3wE4W1wVKTbunysVPKp2ppBpsra6Hdm1iIJV6HfCSSXwO8AyqeAGhx5QFqNqN2LYiejuoyXFW2FmijSjtLOK+Ec8dkYkpgamnxA4iCyf\/yyvNIxQuF3Qi\/hZNj\/3Ane7tlBEi6cG9xsu3lWfzaAh0Qz\/MZBLCWHCiMGpcbinSxoJxeieJR4hwsH6aIGBBARlcM87JIeY9evAugxQ=="} 02110{"flow_id":47,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":115,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":821128,"pkt_caplen":1294,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1294,"pkt_l4_len":1240,"pkt":"pJGxgjQ5PKn0qB\/sht1gDnzNBNgRQCABCwcKydWupNP+R2kegH0mAB8YIxDSMFEDfZ59dTdPtKIBuwTYf3DECgoKCgiO5tu+VRPaUgAARL4uI1WmPGK3DVcwUtE9UzI\/fGSOKvWUIfYmoO3D6w75gyG6cAgBjzUk1WiaTNGr26SzX\/zj3x5ZOIMX2zmIddjoIJovY\/VksJrC3pfUCteiUGgedji71vrrn0fRMQEFiIkPaa+o8LGRwzZKy8VL3G9cV5Q0+xLvukUHxPfTXr+qeeoAkO2JrC0axiSb2dt+XmaJ0v8nr3ud+va3668mZsfa5EeFafHaj8m49xF7nuzVpSiWax1aZSZzIz6eskzoc+1ob4msOELhchJT5jSTUaY4j8tszC8K1inc5HuVJQLo8TDvFonmdmM0XKQKaWAqfBpL0CUAHrxZaa7bFxHWCI+KCUFVNkIiEsJLT7NG1KiOxkI4gvAPMqLHQoSqFHaylCrhyi1kFotT2StbIZXec2UmPZu2coK0kaliS7gU+LJp4Q8aOd\/VQfT+XwTsJ91oSb1hOc3RVgo0quwGh5ZyNdKZAdfV8mq\/WMkDj4BcFPubTYXGgusxS\/MyTqzT1EFGuLIWfyAbYZyodoA4VbTOGXJwfjifkHUQ+UF72jq+Pt7WCCIYrTBJQnTBEUt2MXfl7vDq69U1d9nIXWmxmxitkWebhf3a424eVpSg7vx40Hu84MnwnUTI47yC+ao94ZGXsWQUy81CB15Bxl9YeNY2dJgyiP+5AD9Mhxzqup58xGvvgfzwiN+8b9hNWQCIXG3bcsVJVlFTJ+jyJ9stfjENb7psSrJSchNgxcdmCDy8kzTYUD7r2Kyu23la\/A94iZaAc3a3efSo5IpoqV3d1rp5ZAXMrr7FuDpbBbwpjWOv21FHy9XJpndYMkbIqf\/7foTiABMd4OD5ZERwg0xFUm2\/h9OWCHJH83WAL\/V5NLmuNQVhvxqDt4v9kRbwpq1I6YlY65WMno6Jktn5XADL\/7yB9qcTbstxiHDTP9HA52vwZywCZsUeMNyVpwbs6++IutqZF2u1m5rA1TU892YkmC4kF\/6hNawh4kh9uCP\/dmrEgG3fl\/J1TK58qG0QytYAfCJ0cQ5JLCxfl\/NL8mZSVRO1SYiuLHK3ygtYTMGI6vHbmzBIw7efY9+H20\/n9OdFhPZypP\/u3dYpp4p\/C2O0s6ViK29wOFT+K2UH57w75L7qCQIQY8Jmg4QscecIv0AWmnfsG6wos8x03+j\/JR8bgGEsH1SV8kBWJgmpv\/L4R9h36Dkk7I7wbtNl01psL0lyiPNL+Ovmtqzx+\/3Q62hpJ76z0PUEL8rN8W\/mbea\/y56YejegoW0NiHWhNlluWfwxxnN42q0YVuXvbq45KHAswsaiAvSLHS1\/Hfet1IEJQbT92EAZjtTIJs1ukk6S8C7JBdY2mP1nien9nfYAxxwA\/H5mWvSq0j8RX\/AxShyK\/7L5A8yyjy03hGEmr9rECJ4SlYdMS5IlK68iFiJ4CMvIJ+6AyWXezGevi+5ey4ofkQCxFpY1W0uO7lu7+1aV90Ifn3KxnAwNm6+ry4yHqk6IaT4+FTyUTD70bZ5KtnE5J0z9NnVQAnXfMQNLWwACkQ3k4t1jyk2PI9+I4B+PL+e\/IT7Vzp7naSY2nO4exFruJXfEn4uVZmLymCx9K0eX21XvezrLYl21gesFXXXoMBP7pIhtLQ=="} 00473{"flow_id":70,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":116,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":822027,"pkt_caplen":89,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":89,"pkt_l4_len":35,"pkt":"PKn0qB\/spJGxgjQ5ht1gCEs0ACMR8CoF0BgM6YEAzSri\/bO+xasgAQsHCsnVrqTT\/kdpHoB9EVKuPQAj8mT+AAAAAAAIITUj3tZzyB\/\/AAAd\/wAAHP8AABs="} @@ -279,7 +279,7 @@ 02104{"flow_id":58,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":130,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":880489,"pkt_caplen":1294,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1294,"pkt_l4_len":1240,"pkt":"pJGxgjQ5PKn0qB\/sht1gAgKbBNgRQCABCwcKydWupNP+R2kegH0mBkcAABAAAAAAAABoFggmo4ERUgTY5TrBCgoKCghziEmCXfFrHwAARL5LtYR3ejPf\/p3z4CC05PowI2I8\/yhShfm5nPX+w2RMm09Epp7xl+kBRRhqGjOWMvDuvKtjnCZP4h43yInAnyoQy6CqAqM2X0CJjYqFRLzhwJbIqw2DVbxOowFB4MPGm0ZSauJhv35hdaMdrkpEWiZjZxAcIt9QXdAe3ei5ci4QFJrTlck2vWOijZIoEgmR7v8f3b2ShmI6CdJBBEhbx7x+xdhmvF7QyLqpOKHrLTEfG+pOv4\/x0hdm8B4rKN9lYhLlGSoGddMbooBzzRUA7p16+7rbjImGPkS1MotpttG8+odH6+SDLBY+X3GstYZ1FO\/bzamHEZxYZMgP1ghrma\/s7dEMtCivJ8V9DDtANnntchI6kgniK9bzzOeDCsdM9ITRIlN2z\/Af3okU9roB71yq\/9DX\/TdkJvaU2WO+UeMMmr8r9mAF+UKfPefAvtmM4XpTI7S0sOggW9+ylbRk868BabyiGaalY7v6ElyxYQX5Lm+7f22jDAR\/1Rxw+pqMGJoYSAUT0vcKEq7ImLo5wdD1HbPPsQSmOUj6sUs4CO\/fnKY8anJpGjgDy0aXUYk8jHpkks0Ogglg+nRuCH++j5UW1f7ZAEpNa9vxdlT60Esd66TkVHOw+4sOrTBkOSin7f9JufqnL0\/oha9fVnFNoEifDQokis3kLSU3qOhha5NehjGyqXC4mPnsRXhV1FSJLx2VGefOAKopFDtlBUj77lmzpE4bT3pVw7XDcnU98fJgVGUI0JycRmnYXeBdfKKKe\/C3yD3TJtdWJpUxFWlLU5JBLw1DK7Jaeoa2CHR+Mm+Uos1NDX1p\/Tae7YJ3QTohWBSmBEM8sQU24dwTVN4u9NduhdNUw4abqXZHWWatpGkhOGi+ztCmJQyFuKmz76ia0aYCpdIQEteOm4a+0nCcqQW98i\/PWMOzXN5N4iJBlj7Z1kEIRjKqOh15d3MSiivlm0kY3uvwpzNG6z\/mG64H\/Ch0ZjLDFL0Lh7Mq4u7sR0TzJNJGk7sVaiEPpK8iv5ewweeTFC5Rl0GpKG2cTtrRDh3Jlv0fDheeAqwjrpXOD7ekCHhXvPoBEqPIW59s0aKn33+\/B+x4kneJZP\/w76GqJhpArO5oYmd2nyPv2SM++J5j4el8Gz8DMsGeqEBtxHDWRjkM1rYAvTzN5xb8x5DuFADLFqHlRDraOgEM0xdsEf3hQUK7mhuUCaQGZBsNRdHnNvZL2CgICOnYLx\/yP6eBn+tj4fdyypHuoUxCV0l91OyAz1zzMppQmM\/MZw4IjgKddLGGzkfD9eH5L2StADzoe\/+tl+Vy4q2cConEMFDs6PaRjEIki+cwlbYxOX5IGAOH+nU45b+AhHH3CTnzqcfB1hVJ27u+6GOUu8zMsLgjDTrc3Bi318\/NgqlATYv79utqKeVxozT3TLQMpSZijN7B8+4KqJeZKEmn2cSaCzlZY7LsE5mGMSEER6hyX0D9p3bjlWs1ZL9V6nrrfHoSzPveONxywVsTghmtxCvne0EGPCkAlJjIUsDS0C0WhRU05kFBDzqpkLuoJAtfN6wRz1A7m00svwCrcx6jydEIcQPaUg5llHIZhpOg+oB895RjVpCjMpMpvctTtfDIJJw1H3cf+g=="} 00464{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":131,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":75,"flow_packet_id":1,"flow_first_seen":1603816434886,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"133.242.206.244","dst_ip":"192.168.1.128","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} 01151{"flow_id":75,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":131,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":886049,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"PKn0qB\/spJGxgjQ5CABFAAJAYQkAAC0BE6WF8s70wKgBgAMDPAcAAAAARQAFAILLQAApEbMSwKgBgIXyzvS\/\/xFRBOzO1McKCgoKCBW0hlcD4wtQAABE0o5ETsyCKfAiv3GjrhWWAHytWjhKjuCcE8PQ+8\/rlGyAU8f1x+Mk3FCdRieZy\/gIKc\/JJBqsu6Id+Y5I6UUEss09jcswdjUwYmczoGMjYqPo0TgEgq07LxXN2ezzpPgN8+p4f8xWtCxwb8JafjHIFjRWKZy5A\/ktd7oDLtros16gjzk4ANxurCLBEjXn1mc4A1OkxNBYnuq2VBy6bBpOv61yDRD8YC\/\/cKt+DeKlIab2wioxKuuqTJaa6bcvjsxaGxss1fmXynI35PYXkvPyrb+OmmsPeoZV51Hz2RzGwPglrJrYbrEQT\/ivLiFpZ023Tc\/UX5\/6yEdVpklz8RpLexVa6Bn2z1jbV1c+PvjbnEyP4B3XT1q2R1U8Zg+Hg2foBKQpPal7OLyEEZLoYQ0+yrbDuTkJcdCxkssUJpGttMtaDpOYAt3rqklkL5jPHrEd1C+FSNb\/c7TK\/C4zJ9DojLveQhKMASAjgDcBaayNHzmzBxrLpcHuZ77JWq9eQca55sxDzWYh2vyNpayRp3s936eLgTzDYJED3HFsEu7Un7VVKrpKCJGjDAw7oK0mEPfQD9p25UX36n9yQOALJibj1tF+6rPwcqd1enHsqJO2F24HI5WHL0GiGGP5cRaXpNzZ+ijbLCxtX7NKJN8+IHswHT8wg8Yb1lU="} -00496{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":131,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":75,"flow_packet_id":1,"flow_first_seen":1603816434886,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"133.242.206.244","dst_ip":"192.168.1.128","l4_proto":"icmp","ndpi": {"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":131,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":75,"flow_packet_id":1,"flow_first_seen":1603816434886,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"133.242.206.244","dst_ip":"192.168.1.128","l4_proto":"icmp","ndpi": {"flow_risk": {"35":"Suspicious entropy"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} 00440{"flow_id":31,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":132,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":890937,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA3dApAADIRazjK7txcwKgBgAG7mBUAI5npkwAAAAAACEmkvxz+BSBNGio6Sv8AACD\/AAAd"} 02103{"flow_id":62,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":133,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":894238,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAUAwXZAAEARa1\/AqAGAilu8k6XkEVEE7KGrwQoKCgoIR0aH1pvahxkAAETSKZaHE9N9GtJMYvv9ifpVeuysckzKOAoBynmJqbZIyXXd6Q0OaiDA1+eXkNpoukJH66d1qZWl2up+oJkJlE2iNPjRL4rTXi4tGFWkOc7OU1ijBfm7sZPOTclysKOTLlG\/wLwmM+4bmiv8t1VJI8ny49KjxXkbGme9dgA0bkSUFasSUnlJAUa50AK97fShfQXzqeK5Dg+WXkJ5xuGOQHrunpIaEPTkH8dZAQC0kgGeFDv4HG0pqkwbzV+IYkH7SmFammklwji5+p3TbOylB01wJbffLThybxWnDqogivkmpQmkVpMhBwMu\/9xKEoVlmIM6B4v9QOFFHqhSd9Fs3q++BMu\/YhweSpnGUx72yfkjBJM\/IRzi1GX4pw11eJz1\/3qBdeWldk+sRUQcox4In2qe+wuxVw2osgoNlI9YvrG4D8P\/zIyWUtdNaLtHhPMgDgiAC91NDmgmJENXcA\/RXPQYvhOdBOfaMfqQoVoSR7Q4FTIccfFsCF+5xHFnMAndfXwOCyIdbeaeIVCpMSQ3bCvvDIsU716Wq\/5J449XPD5T8+ox9fqnlN0Jxyqab0XJ72k9txuNkHNYBZFINRTioCXl6izgIEtcruHCYZt+ILtV2gUUjuR8FtecwJtSSrY5wTZrfp6mz9U9VqFe6kCmkDBYZVE9CTSh5jPIMshdFPvlPyb9jOL5Oce8EEmxF50G+MImURL0E5jw4S6VFP1JWS9s3SOl2ok90TOvvWFQkYQVIGjzaMpXtyBqGjbtpCnFbad8ojifR\/YqGipZKY7YjkWGjouJV\/EDirr0Js9ZOS2bLt0d5OKTRnFRrYMUX7KY8zvzFslodkxSsLJ9F5kbgxZelMuuAZS\/WjzvvYQWm+fu6fqiOFgxzt4cf5I3rtZr1vhb\/mlhSZdfx+5dh2+Bw05\/c+ZhZcGWQVWlIJoLVTK8wVhhxCprdVxcD8azYdyGHI2yjdhdg8y5T1SHS+wMUv3TrTEkgaPMJSS\/bG830bq4zk9YF1gPTLVzdsj3uGV0Cb2GuAxyajIFBjWG43Q+tx8KNtdSeW621EE8H3LtU5Co2FzEFLWry1aFgbJB2zQ2iUthr7o+cxvl+I9ObWsbtyiFbbosM9ubsa940D830mP6uzArtiDHR\/\/tFLOFL88JLiryCWee0dBawNwyN0l3KoWaf0+xrkvJmDrQtP2edAcztmf7vS5YtS7p+DLQu7CH9K63Utaw3a3fUEMW7mKw5KR+OTvLaDXf+fl5pRlYNEqDRWXH4I909g6Vz4OrKab3fRk6tpbyc6YOZkWMRgcj4QWKv9Jjdy\/GO0VWic\/I9O\/C9pHvyAImGRQQ3Dlm9KvoTkJ8oWVAyBE0qeiaF6eLmq95FTaIvn+MgWKZGoMFAxQpObBG41iLXc68P\/q28rKfRP2cjjT0E2a5yH6RR4ZhTZalehf32S79m5P3+jb7+Xyy8XIUQjKRHLykyRjpXm2fvzGkfd\/uvjbx1WH97nbN6TLHvxcWmIC9p8hr1ew6jGo88bbJUcg867GJeVKG4nDMxlqcviS+1Hf8Ar25WRbo1aTF5rpBjU67mAtQodxvng7drgHRjfXYl0zhU6OqWR+vayEfq8beOLohWXa2bFgOH+TtDLfzLUWOS7634STReD98JKgMwA=="} 00473{"flow_id":65,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":134,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":897001,"pkt_caplen":89,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":89,"pkt_l4_len":35,"pkt":"PKn0qB\/spJGxgjQ5ht1gCwDeACMRMCABSAB4FwEBvnZO\/\/4EYx0gAQsHCsnVrqTT\/kdpHoB9EVHPlAAjX2HlAAAAAAAIQNHw6Rif2eH\/AAAd\/wAAGxoqOko="} @@ -484,7 +484,7 @@ ~~ total detected protocols..: 77 ~~ total active/idle flows...: 77/77 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2517632 bytes -~~ total memory freed........: 2517632 bytes -~~ total allocations/frees...: 36554/36554 +~~ total memory allocated....: 2514058 bytes +~~ total memory freed........: 2514058 bytes +~~ total allocations/frees...: 36555/36555 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic_q39.pcap.out b/test/results/quic_q39.pcap.out index e3ea742c9..09b2d1a1e 100644 --- a/test/results/quic_q39.pcap.out +++ b/test/results/quic_q39.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1928492 bytes -~~ total memory freed........: 1928492 bytes -~~ total allocations/frees...: 35385/35385 +~~ total memory allocated....: 1929174 bytes +~~ total memory freed........: 1929174 bytes +~~ total allocations/frees...: 35386/35386 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic_q43.pcap.out b/test/results/quic_q43.pcap.out index 402bf6c3b..6a9225e6b 100644 --- a/test/results/quic_q43.pcap.out +++ b/test/results/quic_q43.pcap.out @@ -12,7 +12,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926764 bytes -~~ total memory freed........: 1926764 bytes -~~ total allocations/frees...: 35326/35326 +~~ total memory allocated....: 1927446 bytes +~~ total memory freed........: 1927446 bytes +~~ total allocations/frees...: 35327/35327 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic_q46.pcap.out b/test/results/quic_q46.pcap.out index 1484c1ba3..8e98e5302 100644 --- a/test/results/quic_q46.pcap.out +++ b/test/results/quic_q46.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1927330 bytes -~~ total memory freed........: 1927330 bytes -~~ total allocations/frees...: 35345/35345 +~~ total memory allocated....: 1928012 bytes +~~ total memory freed........: 1928012 bytes +~~ total allocations/frees...: 35346/35346 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic_q46_b.pcap.out b/test/results/quic_q46_b.pcap.out index 89ab34b5b..2a1a2d59b 100644 --- a/test/results/quic_q46_b.pcap.out +++ b/test/results/quic_q46_b.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1927332 bytes -~~ total memory freed........: 1927332 bytes -~~ total allocations/frees...: 35345/35345 +~~ total memory allocated....: 1928014 bytes +~~ total memory freed........: 1928014 bytes +~~ total allocations/frees...: 35346/35346 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic_q50.pcap.out b/test/results/quic_q50.pcap.out index 45d879da5..ddd4cefba 100644 --- a/test/results/quic_q50.pcap.out +++ b/test/results/quic_q50.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1932836 bytes -~~ total memory freed........: 1932836 bytes -~~ total allocations/frees...: 35355/35355 +~~ total memory allocated....: 1933518 bytes +~~ total memory freed........: 1933518 bytes +~~ total allocations/frees...: 35356/35356 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic_t50.pcap.out b/test/results/quic_t50.pcap.out index 26561870b..f9f192127 100644 --- a/test/results/quic_t50.pcap.out +++ b/test/results/quic_t50.pcap.out @@ -22,7 +22,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1932623 bytes -~~ total memory freed........: 1932623 bytes -~~ total allocations/frees...: 35349/35349 +~~ total memory allocated....: 1933305 bytes +~~ total memory freed........: 1933305 bytes +~~ total allocations/frees...: 35350/35350 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quic_t51.pcap.out b/test/results/quic_t51.pcap.out index abe871696..9e08292ce 100644 --- a/test/results/quic_t51.pcap.out +++ b/test/results/quic_t51.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1950896 bytes -~~ total memory freed........: 1950896 bytes -~~ total allocations/frees...: 35979/35979 +~~ total memory allocated....: 1951578 bytes +~~ total memory freed........: 1951578 bytes +~~ total allocations/frees...: 35980/35980 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/quickplay.pcap.out b/test/results/quickplay.pcap.out index 44cb44a37..37b67829a 100644 --- a/test/results/quickplay.pcap.out +++ b/test/results/quickplay.pcap.out @@ -165,7 +165,7 @@ ~~ total detected protocols..: 21 ~~ total active/idle flows...: 21/21 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1999419 bytes -~~ total memory freed........: 1999419 bytes -~~ total allocations/frees...: 35581/35581 +~~ total memory allocated....: 1998981 bytes +~~ total memory freed........: 1998981 bytes +~~ total allocations/frees...: 35582/35582 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/rdp.pcap.out b/test/results/rdp.pcap.out index e8e417743..2fdc30dd7 100644 --- a/test/results/rdp.pcap.out +++ b/test/results/rdp.pcap.out @@ -4027,7 +4027,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/reasm_crash_anon.pcapng.out b/test/results/reasm_crash_anon.pcapng.out index 1368c215a..c4102a6da 100644 --- a/test/results/reasm_crash_anon.pcapng.out +++ b/test/results/reasm_crash_anon.pcapng.out @@ -43,7 +43,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1946369 bytes -~~ total memory freed........: 1946369 bytes -~~ total allocations/frees...: 35530/35530 +~~ total memory allocated....: 1942247 bytes +~~ total memory freed........: 1942247 bytes +~~ total allocations/frees...: 35529/35529 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/reasm_segv_anon.pcapng.out b/test/results/reasm_segv_anon.pcapng.out index 784be3623..c2920b9b1 100644 --- a/test/results/reasm_segv_anon.pcapng.out +++ b/test/results/reasm_segv_anon.pcapng.out @@ -81,7 +81,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929084 bytes -~~ total memory freed........: 1929084 bytes -~~ total allocations/frees...: 35406/35406 +~~ total memory allocated....: 1929766 bytes +~~ total memory freed........: 1929766 bytes +~~ total allocations/frees...: 35407/35407 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/reddit.pcap.out b/test/results/reddit.pcap.out index 0b5fdbe32..6cf3c7b4e 100644 --- a/test/results/reddit.pcap.out +++ b/test/results/reddit.pcap.out @@ -85,6 +85,7 @@ 00465{"flow_id":9,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":283,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291686,"pkt_ts_usec":35833,"pkt_caplen":94,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":94,"pkt_l4_len":40,"pkt":"qtsDr8lk5EKm5WPyht1gB\/ybACgGQCoBywEgSYsHmR3shSjf9ikAZP+bAAAAAAAAAACXZXmM3PoBu\/q4YysAAAAAoAL9ICkLAAACBAWgBAIICql05ecAAAAAAQMDBw=="} 00514{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":284,"source":"reddit.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1605291686035,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56572,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00464{"flow_id":10,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":284,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291686,"pkt_ts_usec":35852,"pkt_caplen":94,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":94,"pkt_l4_len":40,"pkt":"qtsDr8lk5EKm5WPyht1gAreKACgGQCoBywEgSYsHmR3shSjf9ikAZP+bAAAAAAAAAACXZXmM3PwBu8WSVasAAAAAoAL9IGuvAAACBAWgBAIICql05ecAAAAAAQMDBw=="} +01163{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":338,"source":"reddit.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":255,"flow_first_seen":1605291684452,"flow_last_seen":1605291686054,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":6245,"flow_tot_l4_payload_len":187363,"flow_avg_l4_payload_len":734,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56558,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Reddit","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.reddit.com","server_names":"reddit.com,*.reddit.com","ja3":"b32309a26951912be7dba376398abc3b","ja3s":"16c0b3e6a7b8173c16d944cfeaeee9cf","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA","issuerDN":"C=US, ST=California, L=San Francisco, O=Reddit Inc., CN=*.reddit.com","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1","fingerprint":"DB:E9:D5:FE:EB:EF:68:34:55:FD:62:BA:C9:BB:04:D4:E3:22:18:81"}} 00514{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":417,"source":"reddit.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1605291686060,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56574,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00464{"flow_id":11,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":417,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291686,"pkt_ts_usec":60608,"pkt_caplen":94,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":94,"pkt_l4_len":40,"pkt":"qtsDr8lk5EKm5WPyht1gBKPwACgGQCoBywEgSYsHmR3shSjf9ikAZP+bAAAAAAAAAACXZXmM3P4Bu+9x1NYAAAAAoAL9IMKJAAACBAWgBAIICql05gAAAAAAAQMDBw=="} 00514{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":418,"source":"reddit.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1605291686060,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56576,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -597,6 +598,7 @@ 00453{"flow_id":32,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3151,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291688,"pkt_ts_usec":36432,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gBZTsACAGQCoBywEgSYsHmR3shSjf9ikmIAEWgA0AIfkWUEn4fxCOvggBu9JG6lC2IhkCgBAB9azgAAABAQgK14pi4sLXQFA="} 00454{"flow_id":32,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3153,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291688,"pkt_ts_usec":36448,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gBZTsACAGQCoBywEgSYsHmR3shSjf9ikmIAEWgA0AIfkWUEn4fxCOvggBu9JG6lC2Ih5ugBAB8Kd5AAABAQgK14pi4sLXQFA="} 00454{"flow_id":32,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3154,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291688,"pkt_ts_usec":36451,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gBZTsACAGQCoBywEgSYsHmR3shSjf9ikmIAEWgA0AIfkWUEn4fxCOvggBu9JG6lC2IiC6gBAB7KUxAAABAQgK14pi4sLXQFA="} +01229{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":3157,"source":"reddit.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":255,"flow_first_seen":1605291687514,"flow_last_seen":1605291688036,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":6288,"flow_tot_l4_payload_len":239041,"flow_avg_l4_payload_len":937,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:789d","src_port":48240,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Twitter","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"platform.twitter.com","server_names":"platform.twitter.com","ja3":"b32309a26951912be7dba376398abc3b","ja3s":"16c0b3e6a7b8173c16d944cfeaeee9cf","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA","issuerDN":"C=US, ST=California, L=San Francisco, O=Twitter, Inc., OU=Twitter Security, CN=platform.twitter.com","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1","fingerprint":"2B:30:10:3B:07:2F:F2:EB:3D:08:E3:BB:45:61:F7:A3:9F:4C:A7:92"}} 00627{"flow_id":32,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3162,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291688,"pkt_ts_usec":40331,"pkt_caplen":212,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":212,"pkt_l4_len":158,"pkt":"qtsDr8lk5EKm5WPyht1gBZTsAJ4GQCoBywEgSYsHmR3shSjf9ikmIAEWgA0AIfkWUEn4fxCOvggBu9JG6lC2IiC6gBgB9RmeAAABAQgK14pi5sLXQFAWAwMARhAAAEJBBDU74BzP7Q6RSVUWj9cO2lqHkgsYnntO0GBgQsjeKNHhq\/FvR0aI5ELRFHDlX\/LMaAcnsUWjczn1FadPzDGyymUUAwMAAQEWAwMAKAAAAAAAAAAAaH1na1yJCdmPc5LOW+GXQI2W4akRkKbxfXNj7hRma5U="} 00589{"flow_id":32,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3164,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291688,"pkt_ts_usec":40696,"pkt_caplen":185,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":185,"pkt_l4_len":131,"pkt":"qtsDr8lk5EKm5WPyht1gBZTsAIMGQCoBywEgSYsHmR3shSjf9ikmIAEWgA0AIfkWUEn4fxCOvggBu9JG6s62IiC6gBgB9ZCCAAABAQgK14pi5sLXQFAXAwMAXgAAAAAAAAABhTe2kqaTLlAAr1bUYq0xjWqOf93ObH7BnPvCaaDcXr7U21czVub80rrckE2NlQCoHD7g9B+xs8G9tNwpWj4ElxeKVkwXL8dqAWqp8Dluss2bvuLPnXQ="} 00807{"flow_id":32,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3165,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291688,"pkt_ts_usec":40821,"pkt_caplen":344,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":344,"pkt_l4_len":290,"pkt":"qtsDr8lk5EKm5WPyht1gBZTsASIGQCoBywEgSYsHmR3shSjf9ikmIAEWgA0AIfkWUEn4fxCOvggBu9JG6zG2IiC6gBgB9Sw8AAABAQgK14pi5sLXQFAXAwMA\/QAAAAAAAAAC9pMun1ZqAdTi1F1kreffo29Ey700P\/1LxMn1WNIVaNH360u7qDLCs\/IdEMxFqj6MX5gwsKWlJpCdeeb1mXwtDV43E67V7Hvk0e7+IeYzBlROgwWrNJnpq70HiOHdVMaUa+yyKyfdo6W2KeMEedpBecer6+JlP2GKN58yOO0v0\/1nrhSb\/FJkQdAEqYJc1NSpkT8E9wRtf+gNDwG00+IGUrl\/FfIaitfxPWUn+flW35wuLjHv5lngue8VUBVFqhFj61eBdi3zXrykyFq1Iqyo6fUrWlPwkDT0pXBFhMCB91j0RhGkwQR5JLSluMEyKzXvzAiPQxk="} @@ -680,6 +682,7 @@ 00904{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":3999,"source":"reddit.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":6,"flow_first_seen":1605291688611,"flow_last_seen":1605291688705,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":616,"flow_avg_l4_payload_len":102,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2606:2800:134:1a0d:1429:742:782:b6","src_port":39736,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Twitter","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.3","client_requested_server_name":"cdn.syndication.twimg.com","ja3":"b32309a26951912be7dba376398abc3b","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} 00456{"flow_id":37,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4002,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291688,"pkt_ts_usec":705748,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gDEO\/ACAGQCoBywEgSYsHmR3shSjf9ikmBigAATQaDRQpB0IHggC2mzgBu\/F3aZSUttIogBAB+0KFAAABAQgK9jYFfMLXQuk="} 01158{"flow_id":37,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4008,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291688,"pkt_ts_usec":706148,"pkt_caplen":609,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":609,"pkt_l4_len":555,"pkt":"qtsDr8lk5EKm5WPyht1gDEO\/AisGQCoBywEgSYsHmR3shSjf9ikmBigAATQaDRQpB0IHggC2mzgBu\/F3aZSUttIogBgB+0VNAAABAQgK9jYFfcLXQukUAwMAAQEWAwMCAAEAAfwDA46RLPCXby2v1fhhEaIIot6g8XiGmSWLgLgejrMgyw66ICkvsU+x9q1tILELIWe9u4V18z4rsB3VSuGPlE2gOpFxACAKChMBEwITA8ArwC\/ALMAwzKnMqMATwBQAnACdAC8ANQEAAZMKCgAAAAAAHgAcAAAZY2RuLnN5bmRpY2F0aW9uLnR3aW1nLmNvbQAXAAD\/AQABAAAKAAoACNraAB0AFwAYAAsAAgEAACMAAAAQAA4ADAJoMghodHRwLzEuMQAFAAUBAAAAAAANABIAEAQDCAQEAQUDCAUFAQgGBgEAEgAAADMARwBFABcAQQQoq6JKIUvCtQW2WM1f4kzEM2qRGZR3XMSMFgQvtdw8atTqTTNmLv+cYw\/FXvi413mjUEBKzwg+syy8Gu7YXHbVAC0AAgEBACsACwpaWgMEAwMDAgMBABsAAwIAAtraAAEAABUApwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} +01157{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":4029,"source":"reddit.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":255,"flow_first_seen":1605291686064,"flow_last_seen":1605291688712,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":4192,"flow_tot_l4_payload_len":148115,"flow_avg_l4_payload_len":580,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56582,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Reddit","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"preview.redd.it","server_names":"redd.it,*.redd.it","ja3":"b32309a26951912be7dba376398abc3b","ja3s":"16c0b3e6a7b8173c16d944cfeaeee9cf","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA","issuerDN":"C=US, ST=California, L=San Francisco, O=Reddit Inc., CN=*.redd.it","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1","fingerprint":"3D:15:31:F3:94:55:33:92:88:5C:61:40:B0:FD:ED:27:6D:29:3A:12"}} 00521{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4030,"source":"reddit.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1605291688712,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:808::2006","src_port":54726,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00466{"flow_id":38,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4030,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291688,"pkt_ts_usec":712501,"pkt_caplen":94,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":94,"pkt_l4_len":40,"pkt":"qtsDr8lk5EKm5WPyht1gBqw+ACgGQCoBywEgSYsHmR3shSjf9ikqABRQQAcICAAAAAAAACAG1cYBu1QhHQQAAAAAoAL9IGnKAAACBAWgBAIICoWLJ5EAAAAAAQMDBw=="} 00456{"flow_id":37,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4079,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291688,"pkt_ts_usec":744114,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"5EKm5WPyqtsDr8lkht1gAAAAACAGPSYGKAABNBoNFCkHQgeCALYqAcsBIEmLB5kd7IUo3\/YpAbubOJS20ijxd2ufgBALcjbcAAABAQgKwtdDD\/Y2BX0="} @@ -1092,7 +1095,7 @@ 00455{"flow_id":60,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11242,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291697,"pkt_ts_usec":34499,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gDNdJACAGQCoBywEgSYsHmR3shSjf9ikAZP+bAAAAAAAAAAA006zst54Bu3jHKhofTkDKgBAB3F9gAAABAQgKUiG5+cLXY3s="} 00545{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":39,"flow_first_seen":1605291688749,"flow_last_seen":1605291688963,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1208,"flow_tot_l4_payload_len":10966,"flow_avg_l4_payload_len":281,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::2004","src_port":57282,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00544{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":33,"flow_first_seen":1605291690384,"flow_last_seen":1605291690520,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1208,"flow_tot_l4_payload_len":6642,"flow_avg_l4_payload_len":201,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80b::2002","src_port":59336,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00541{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":782,"flow_first_seen":1605291687514,"flow_last_seen":1605291688963,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":6288,"flow_tot_l4_payload_len":596288,"flow_avg_l4_payload_len":762,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:789d","src_port":48240,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00541{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":255,"flow_first_seen":1605291687514,"flow_last_seen":1605291688963,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":6288,"flow_tot_l4_payload_len":239041,"flow_avg_l4_payload_len":937,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:789d","src_port":48240,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00545{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":85,"flow_first_seen":1605291690926,"flow_last_seen":1605291691284,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2470,"flow_tot_l4_payload_len":37085,"flow_avg_l4_payload_len":436,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80f::2001","src_port":36964,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00543{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":20,"flow_first_seen":1605291690926,"flow_last_seen":1605291691053,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1208,"flow_tot_l4_payload_len":3817,"flow_avg_l4_payload_len":190,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80f::2001","src_port":36966,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00543{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":19,"flow_first_seen":1605291690926,"flow_last_seen":1605291691064,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1208,"flow_tot_l4_payload_len":3815,"flow_avg_l4_payload_len":200,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80f::2001","src_port":36968,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -1100,7 +1103,7 @@ 00554{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":3,"flow_first_seen":1605291690992,"flow_last_seen":1605291691029,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80f::2001","src_port":36972,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} 00534{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":3,"flow_first_seen":1605291690992,"flow_last_seen":1605291691029,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80f::2001","src_port":36972,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00538{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":27,"flow_first_seen":1605291687934,"flow_last_seen":1605291688340,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1388,"flow_tot_l4_payload_len":6623,"flow_avg_l4_payload_len":245,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::1736:86f1","src_port":44264,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00540{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":847,"flow_first_seen":1605291684452,"flow_last_seen":1605291698703,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":6245,"flow_tot_l4_payload_len":482020,"flow_avg_l4_payload_len":569,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56558,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00540{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":255,"flow_first_seen":1605291684452,"flow_last_seen":1605291698703,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":6245,"flow_tot_l4_payload_len":187363,"flow_avg_l4_payload_len":734,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56558,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00546{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":114,"flow_first_seen":1605291688843,"flow_last_seen":1605291691232,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2416,"flow_tot_l4_payload_len":69230,"flow_avg_l4_payload_len":607,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80c::2003","src_port":47302,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00537{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":17,"flow_first_seen":1605291684481,"flow_last_seen":1605291684654,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1048,"flow_tot_l4_payload_len":4527,"flow_avg_l4_payload_len":266,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56560,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00543{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":19,"flow_first_seen":1605291688843,"flow_last_seen":1605291689005,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1208,"flow_tot_l4_payload_len":3846,"flow_avg_l4_payload_len":202,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80c::2003","src_port":47304,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -1114,7 +1117,7 @@ 00537{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":23,"flow_first_seen":1605291686060,"flow_last_seen":1605291686196,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1048,"flow_tot_l4_payload_len":4573,"flow_avg_l4_payload_len":198,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56576,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00541{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":133,"flow_first_seen":1605291686060,"flow_last_seen":1605291697854,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":10480,"flow_tot_l4_payload_len":99015,"flow_avg_l4_payload_len":744,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56578,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00537{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":17,"flow_first_seen":1605291686060,"flow_last_seen":1605291686196,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1048,"flow_tot_l4_payload_len":4191,"flow_avg_l4_payload_len":246,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56580,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00544{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":5480,"flow_first_seen":1605291686064,"flow_last_seen":1605291695840,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":9432,"flow_tot_l4_payload_len":5723539,"flow_avg_l4_payload_len":1044,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56582,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00541{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":255,"flow_first_seen":1605291686064,"flow_last_seen":1605291695840,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":4192,"flow_tot_l4_payload_len":148115,"flow_avg_l4_payload_len":580,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56582,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00537{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":23,"flow_first_seen":1605291686064,"flow_last_seen":1605291686203,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1048,"flow_tot_l4_payload_len":4547,"flow_avg_l4_payload_len":197,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56584,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00537{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":15,"flow_first_seen":1605291686064,"flow_last_seen":1605291686203,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1048,"flow_tot_l4_payload_len":4165,"flow_avg_l4_payload_len":277,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56586,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00537{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":15,"flow_first_seen":1605291686064,"flow_last_seen":1605291686203,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1048,"flow_tot_l4_payload_len":4165,"flow_avg_l4_payload_len":277,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56588,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -1159,7 +1162,7 @@ ~~ total detected protocols..: 59 ~~ total active/idle flows...: 60/60 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 3178116 bytes -~~ total memory freed........: 3178116 bytes -~~ total allocations/frees...: 47611/47611 +~~ total memory allocated....: 3045779 bytes +~~ total memory freed........: 3045779 bytes +~~ total allocations/frees...: 47598/47598 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/rtsp.pcap.out b/test/results/rtsp.pcap.out index 7a48f305b..19942e9b6 100644 --- a/test/results/rtsp.pcap.out +++ b/test/results/rtsp.pcap.out @@ -130,7 +130,7 @@ ~~ total detected protocols..: 7 ~~ total active/idle flows...: 7/7 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1976526 bytes -~~ total memory freed........: 1976526 bytes -~~ total allocations/frees...: 35918/35918 +~~ total memory allocated....: 1976872 bytes +~~ total memory freed........: 1976872 bytes +~~ total allocations/frees...: 35919/35919 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/rtsp_setup_http.pcapng.out b/test/results/rtsp_setup_http.pcapng.out index 6a4726c95..cabfc288d 100644 --- a/test/results/rtsp_setup_http.pcapng.out +++ b/test/results/rtsp_setup_http.pcapng.out @@ -11,7 +11,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1928835 bytes -~~ total memory freed........: 1928835 bytes -~~ total allocations/frees...: 35327/35327 +~~ total memory allocated....: 1929517 bytes +~~ total memory freed........: 1929517 bytes +~~ total allocations/frees...: 35328/35328 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/rx.pcap.out b/test/results/rx.pcap.out index 972210006..473ac5538 100644 --- a/test/results/rx.pcap.out +++ b/test/results/rx.pcap.out @@ -73,7 +73,7 @@ ~~ total detected protocols..: 5 ~~ total active/idle flows...: 5/5 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1943174 bytes -~~ total memory freed........: 1943174 bytes -~~ total allocations/frees...: 35468/35468 +~~ total memory allocated....: 1943632 bytes +~~ total memory freed........: 1943632 bytes +~~ total allocations/frees...: 35469/35469 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/s7comm.pcap.out b/test/results/s7comm.pcap.out index b0db8c43c..e52f64513 100644 --- a/test/results/s7comm.pcap.out +++ b/test/results/s7comm.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1928301 bytes -~~ total memory freed........: 1928301 bytes -~~ total allocations/frees...: 35379/35379 +~~ total memory allocated....: 1928983 bytes +~~ total memory freed........: 1928983 bytes +~~ total allocations/frees...: 35380/35380 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/safari.pcap.out b/test/results/safari.pcap.out index 2d3cd450a..d6c4ed06f 100644 --- a/test/results/safari.pcap.out +++ b/test/results/safari.pcap.out @@ -108,6 +108,7 @@ 02374{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":149,"source":"safari.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620898025,"pkt_ts_usec":371857,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUIZ1AADQGkOqSMDoSwKgBsgG71+H+Sk8TyvoNPoAQAfkUTwAAAQEICjpWr3IzMMo6rboAiOYGBtKbjWDMWZRfNRPxvopwAoawXvnkeSSf7q1l8bLAlKo93udldTodezm4D3CcVbt3Whd1jU+TQrbaU9+K3LsIeZYlpuatNslQKRiy+u2LD+plWfvfVL8CqRV8DU0Div8JUwXNnpfEPg5D+z5zcuvKY46JegCSNDTAEh0GtVjhuDd8QV5f0Cnf3vHeF\/Bl2SMysyydNv1WVF5ZEIfNZeCVSVndRGsehnMq4BzbQvpOV\/BI+tPiHXa4RChn9zNxEGievRGdAn0Qb13IXY1m6fXvq\/cZAyatmWsccoOv\/Nrj3NVygPMCpBpQQu3Yb2bHD8QYPLiAmFokrFKxD5PZUJL9OV9blJ7mCwoydfNn3IlW5l+Y+gmQ4K9IFEqmqnM5pSNYFt2G5l864a10XHWb+dTB\/aU9D0PcRAmB9KHpASHtHIhgRQzHgOiyYgOyLDXMFwqY0OpUZDqnmNi+A9c6FCkhcVwUoc3xDwwr3gQ5\/WIHSUfuz1naE8p9PEl3OVwIBusEswrdLsPcVERUqbkauAooNSWhgROyIz\/yBD5383VUboWl+ITMmA5rGj2FkKJSFG3khTfJgoC5hlxpM41YbY9WtwxMBSvf9uXC26SMrNSatsh670\/wceeE0YCdjMPjwRSoBy5bLYDMaJskxEAf0SfxFjsugnf8JfeYjkpE6X1Kg62WSw\/CYJNUPdRSq1NCxwsrXwC4AEplnT6r6apteQfwp456Jdv8ac1PZYVA2rnm\/apiUMXVHE2XXu5GzozOOaSUCF8vaKohn8UO1sRBD8mDEsh8LoxsnrnQq5+2Uk+2OzsxsBxrQQRqC+\/Qs90B9Q3VfevR3EzJ968Oj\/30eLUJjHzTHcXIRvWyx3s5sAthlhRPxQmAE6Vmz2R21\/doJ7PatDcOoSSINZkl8umOQ9uLLYJSlhzSYbppZS6QwEIV3QEUj16Kdmg8XKwms39lrCLtggnEMeXhOA8cBTEn1q7f1dFjIxl+q5hi8tIWmfcec\/kZYRY3BH8qZ9IS6EDGCvo4TDMAVShZkvBj\/VmftPkEzBdzuWglX1diTJFlqeSI1SMOHZVabe\/Buw\/HxyzNedRdi7KxbVKzFI7c38cMiK4zgvKpr4DDPSTMIP5wPo3XgycMaaghY7X8pU0CzqE+viYE2FAzOGoemq5zwvR2jrBDqrrHs03aorru2Zcdh1f8U6pIcLUiTYEF+\/a8nmcJpv9uFy6nT1XaVcP4YKF5RFo63DOT4p2NV1nEu23SEBbG+5F0iUH2rtOF4YaVHGdCNhotS2t6OsI4hoZWDeyUBpSRWCrvXavLgDxs+yNrGInRBEYE1uQkx5SUR0dEePBlVCc0R2e6RMCH\/9uZFokCMXxV3CYVXl5p7nbQ15j3wX6qIcy14IpSF8dlBoC+cPb6ddsEyMKbyzKwLC7NTWArvHkenwDHQJprUJK3\/WFy6aYxtNDoxuOtBvswCl+A1LBxAxS6iWjLC+HxKpXAS3dOoYeT6pmHmyrA6DCiXwlffmmoJlNCRk7DOR6EHdtUeyEsFdqFSflae2HZNAM2XEy9BFY2rQRvEmqukDtpDLTOVFWn3X1fwPGuSms6ToGEKe1\/PZir9VZFrwic\/dV98ajv1rVh5qCZA6r6LHGXPEl3x34UgMwxg\/djIJLhPm+P6dMWi1pA+6b577SJHqs2Xv0IF42LrOIyWMEG3FsY91TcNDXn66u3m2CoVkGtrDB+vNDCyJqOJ\/fbyJUOE2j5SK+1UJW9fzUoCod9xmCS5bDOKdurK3RFS9EiKHDDqTr067QpdRXXNntYp5H32QwgeYLF0JJ3Q63sgiuVCeEbwTCEgTE6DqzDNSCPqObKNKmIKiCRyhqJma0jiuNYOT16NqoKho7fdxyd8zxkpVQNccNR2Q3MaxcD7xAvZTpbDZPQ"} 01009{"flow_id":5,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":175,"source":"safari.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620898025,"pkt_ts_usec":483096,"pkt_caplen":497,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":497,"pkt_l4_len":463,"pkt":"EBMx8Tl2KDc3AG3ICABFAAHjAABAAEAGqnjAqAGykjA6EtfkAbuNFQlRWZkG\/YAYEAD+UQAAAQEICjMwyrw6Vq9wFwMDAaoAAAAAAAAAAkK2MkM9Ny49jA2qHxHIi8zPEw5ch2nszEGVQNBn\/Ifc7zGbiWS7qtm8euzhIXwBmfy7ktdlEL1uOIfVzgYYBTAGUA6UzDkb60gerG3CAQ4Kbsz1o4lMC9VNM4rEKXz+1EhICv55wq+aDVPEaXGUYQzMZvawx7xbLh0KrkXIxnCSkIk5IAm7SnYUqFU0fpoUc3MkoD11jBR3Mtx\/mkLHJVKl5HyA3JcdUjbT189eLiGN77bk\/YLpGhQljABKbCPIaK3Rk9jMoa39PZt+sR8OZ13GuCAnTYUDaLA3hEJZ31qAkhjvrDiELgrGwwqV1rj1uV8GwrKB4CBXJizoDask41FK1D5b+uFWEUlPZ7M2g+XOH5goEmYn9+\/hMRMe9w+OUXg6r5cNulH1RWn+yt2EExCXeFY5lOzYvy5qbomPwdUci0lM6nYbYPTXFD7+3Jej1LxFeIqwcY\/JKg+jrO4wmcvhSSiZfvW4F4qSzPc2UAZtV722O78WwOqkA9z7iUfH5PgT4kNu7B6CsUPVnQC86hSgoG++7+unflEEary2DzLutHU="} 00424{"flow_id":5,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":198,"source":"safari.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620898025,"pkt_ts_usec":512858,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA072JAADQGyMSSMDoSwKgBsgG71+RZmQb9jRULAIAQAfYrmwAAAQEICjpWsAAzMMq8"} +01107{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":923,"source":"safari.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":255,"flow_first_seen":1620898024056,"flow_last_seen":1620898025641,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":205796,"flow_avg_l4_payload_len":807,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":55262,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.iit.cnr.it","server_names":"www.iit.cnr.it","ja3":"a69708a64f853c3bcc214c2c5faf84f3","ja3s":"263c859c5391203d774bc0599793d915","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=NL, ST=Noord-Holland, L=Amsterdam, O=TERENA, CN=TERENA SSL CA 3","issuerDN":"C=IT, ST=Lazio, L=Roma, O=Consiglio Nazionale delle Ricerche, OU=IIT, CN=www.iit.cnr.it","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1","fingerprint":"C4:F6:98:75:7E:20:5C:B6:33:14:59:3F:CF:26:96:38:D0:4B:73:69"}} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5392,"source":"safari.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1620898027036,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":55285,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":7,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5392,"source":"safari.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620898027,"pkt_ts_usec":36438,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGrBvAqAGykjA6Etf1AbvGGXtuAAAAALAC\/\/+JoQAAAgQFtAEDAwUBAQgKMzDQVQAAAAAEAgAA"} 00437{"flow_id":7,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5393,"source":"safari.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620898027,"pkt_ts_usec":65042,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8AABAADQGuB+SMDoSwKgBsgG71\/XZbafoxhl7b6AS\/ogqVAAAAgQFrAQCCAo6VrYRMzDQVQEDAwc="} @@ -127,7 +128,7 @@ 00497{"flow_id":7,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5404,"source":"safari.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620898027,"pkt_ts_usec":137146,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnApBAADQGtWSSMDoSwKgBsgG71\/XZbbVoxhl8t4AYAfxuXAAAAQEICjpWtlkzMNCbFAMDAAEBFgMDAChG7Yuecuxj9\/f8DAAn+WUYe1pqJuV11zsYwYq7up8geYP54YCdtVMI"} 00426{"flow_id":7,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5405,"source":"safari.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620898027,"pkt_ts_usec":137225,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGrCfAqAGykjA6Etf1AbvGGXy32W21m4AQD\/44BAAAAQEICjMw0LI6VrZZ"} 00939{"flow_id":7,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5406,"source":"safari.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620898027,"pkt_ts_usec":138264,"pkt_caplen":444,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":444,"pkt_l4_len":410,"pkt":"EBMx8Tl2KDc3AG3ICABFAAGuAABAAEAGqq3AqAGykjA6Etf1AbvGGXy32W21m4AYEAC0wwAAAQEICjMw0LM6VrZZFwMDAXUAAAAAAAAAAbXn4Bs15DzzoVAkZQwC0ykWdQoWjH+D7gOdmMTHj1zHDB7rmU6aMQbrkJ0ucGMp8XOjqguJiLQ3WqA6O2BHDWATP+aOa7MtKyrMluHRtZ\/H79HwCA+jMo+8QY3rbrULeN0pJyQCkOJILM\/LsUOaS5biUi9fJVxSiZnOgZQ1Su\/NNv+IBHFWthmZtfcS2PIqoj2DZH44360rqb7NcShlwsYFH\/3H8oyxVbDj5kgB1riWY8PvjjHEye9fsBDEiFZ\/KrDc3jzOBaVhQRxuXh3UM51mS8+P4Ebe58F2kPh9wty4hWyMJwoDdXhXCsU92v6Azn9dKChqIsKGxkOK764NTCZjQuN2Gh5SfKX5v+\/AraTxsASc6AWnWcHQw2L6RXCs9LkETGwLGWxSIWq4ud9FPDdtRlH+ogljoZck5xg\/wArwlFWg6LM1oLUZngVEEe8J1kXcHbet22uI9kSpWKGiRsZWNWfCeLo44EEChC72"} -00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6019,"source":"safari.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2083,"flow_first_seen":1620898024056,"flow_last_seen":1620898029980,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1877633,"flow_avg_l4_payload_len":901,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":55262,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6019,"source":"safari.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":255,"flow_first_seen":1620898024056,"flow_last_seen":1620898029980,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":205796,"flow_avg_l4_payload_len":807,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":55262,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6019,"source":"safari.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":801,"flow_first_seen":1620898025216,"flow_last_seen":1620898026198,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":648336,"flow_avg_l4_payload_len":809,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":55265,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6019,"source":"safari.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":621,"flow_first_seen":1620898025216,"flow_last_seen":1620898026065,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":509563,"flow_avg_l4_payload_len":820,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":55266,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6019,"source":"safari.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":927,"flow_first_seen":1620898025216,"flow_last_seen":1620898026187,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":807134,"flow_avg_l4_payload_len":870,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"146.48.58.18","src_port":55267,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -142,7 +143,7 @@ ~~ total detected protocols..: 7 ~~ total active/idle flows...: 7/7 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2171149 bytes -~~ total memory freed........: 2171149 bytes -~~ total allocations/frees...: 41384/41384 +~~ total memory allocated....: 2171495 bytes +~~ total memory freed........: 2171495 bytes +~~ total allocations/frees...: 41385/41385 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/selfsigned.pcap.out b/test/results/selfsigned.pcap.out index 06b84b7c8..41c6e75e6 100644 --- a/test/results/selfsigned.pcap.out +++ b/test/results/selfsigned.pcap.out @@ -47,7 +47,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 0/0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1923546 bytes -~~ total memory freed........: 1923546 bytes -~~ total allocations/frees...: 35321/35321 +~~ total memory allocated....: 1924284 bytes +~~ total memory freed........: 1924284 bytes +~~ total allocations/frees...: 35322/35322 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/signal.pcap.out b/test/results/signal.pcap.out index 579193bd7..15580e3e8 100644 --- a/test/results/signal.pcap.out +++ b/test/results/signal.pcap.out @@ -306,7 +306,7 @@ ~~ total detected protocols..: 16 ~~ total active/idle flows...: 19/19 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2273237 bytes -~~ total memory freed........: 2273237 bytes -~~ total allocations/frees...: 36129/36129 +~~ total memory allocated....: 2215559 bytes +~~ total memory freed........: 2215559 bytes +~~ total allocations/frees...: 36126/36126 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/simple-dnscrypt.pcap.out b/test/results/simple-dnscrypt.pcap.out index b5b5b5b54..728010fec 100644 --- a/test/results/simple-dnscrypt.pcap.out +++ b/test/results/simple-dnscrypt.pcap.out @@ -87,7 +87,7 @@ ~~ total detected protocols..: 4 ~~ total active/idle flows...: 4/4 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2028853 bytes -~~ total memory freed........: 2028853 bytes -~~ total allocations/frees...: 35486/35486 +~~ total memory allocated....: 2029367 bytes +~~ total memory freed........: 2029367 bytes +~~ total allocations/frees...: 35487/35487 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/sip.pcap.out b/test/results/sip.pcap.out index 12d1a3fc6..42d9a2ca2 100644 --- a/test/results/sip.pcap.out +++ b/test/results/sip.pcap.out @@ -77,7 +77,7 @@ ~~ total detected protocols..: 5 ~~ total active/idle flows...: 5/5 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1942594 bytes -~~ total memory freed........: 1942594 bytes -~~ total allocations/frees...: 35448/35448 +~~ total memory allocated....: 1943052 bytes +~~ total memory freed........: 1943052 bytes +~~ total allocations/frees...: 35449/35449 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/skype-conference-call.pcap.out b/test/results/skype-conference-call.pcap.out index fc067f91e..0ddcf3d59 100644 --- a/test/results/skype-conference-call.pcap.out +++ b/test/results/skype-conference-call.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1940714 bytes -~~ total memory freed........: 1940714 bytes -~~ total allocations/frees...: 35526/35526 +~~ total memory allocated....: 1941396 bytes +~~ total memory freed........: 1941396 bytes +~~ total allocations/frees...: 35527/35527 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/skype.pcap.out b/test/results/skype.pcap.out index 917431321..dc658821d 100644 --- a/test/results/skype.pcap.out +++ b/test/results/skype.pcap.out @@ -2620,7 +2620,7 @@ 00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":265,"flow_packet_id":10,"flow_first_seen":1431969717949,"flow_last_seen":1431969723488,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":181,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":50125,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":20,"flow_first_seen":1431969717949,"flow_last_seen":1431969750910,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":332,"flow_tot_l4_payload_len":3826,"flow_avg_l4_payload_len":191,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.23","src_port":50126,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00505{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":20,"flow_first_seen":1431969717949,"flow_last_seen":1431969750910,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":332,"flow_tot_l4_payload_len":3826,"flow_avg_l4_payload_len":191,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.23","src_port":50126,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":270,"flow_packet_id":10,"flow_first_seen":1431969719561,"flow_last_seen":1431969727878,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":1,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":50129,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":270,"flow_packet_id":10,"flow_first_seen":1431969719561,"flow_last_seen":1431969727878,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":1,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":50129,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":270,"flow_packet_id":10,"flow_first_seen":1431969719561,"flow_last_seen":1431969727878,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":1,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":50129,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":7,"flow_first_seen":1431969643972,"flow_last_seen":1431969670410,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57726,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":8,"flow_first_seen":1431969642087,"flow_last_seen":1431969695591,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":312,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55711,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -2775,7 +2775,7 @@ ~~ total detected protocols..: 224 ~~ total active/idle flows...: 317/317 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5605082 bytes -~~ total memory freed........: 5605082 bytes -~~ total allocations/frees...: 39601/39601 +~~ total memory allocated....: 3333703 bytes +~~ total memory freed........: 3333703 bytes +~~ total allocations/frees...: 39492/39492 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/skype_no_unknown.pcap.out b/test/results/skype_no_unknown.pcap.out index 077a75b1c..b6158b14b 100644 --- a/test/results/skype_no_unknown.pcap.out +++ b/test/results/skype_no_unknown.pcap.out @@ -2175,7 +2175,7 @@ 00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":6,"flow_first_seen":1431970690890,"flow_last_seen":1431970691584,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":107,"flow_tot_l4_payload_len":107,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51296,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00551{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":15,"flow_first_seen":1431970690890,"flow_last_seen":1431970705762,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":335,"flow_tot_l4_payload_len":2522,"flow_avg_l4_payload_len":168,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.24","src_port":51297,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00517{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":15,"flow_first_seen":1431970690890,"flow_last_seen":1431970705762,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":335,"flow_tot_l4_payload_len":2522,"flow_avg_l4_payload_len":168,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.24","src_port":51297,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00550{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":11,"flow_first_seen":1431970691584,"flow_last_seen":1431970703178,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51299,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":11,"flow_first_seen":1431970691584,"flow_last_seen":1431970703178,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51299,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00511{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":11,"flow_first_seen":1431970691584,"flow_last_seen":1431970703178,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51299,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00138{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test"} ~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ @@ -2185,7 +2185,7 @@ ~~ total detected protocols..: 198 ~~ total active/idle flows...: 272/272 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4046145 bytes -~~ total memory freed........: 4046145 bytes -~~ total allocations/frees...: 38373/38373 +~~ total memory allocated....: 3058105 bytes +~~ total memory freed........: 3058105 bytes +~~ total allocations/frees...: 38323/38323 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/skype_udp.pcap.out b/test/results/skype_udp.pcap.out index bb22937d6..0d429f645 100644 --- a/test/results/skype_udp.pcap.out +++ b/test/results/skype_udp.pcap.out @@ -16,7 +16,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926851 bytes -~~ total memory freed........: 1926851 bytes -~~ total allocations/frees...: 35329/35329 +~~ total memory allocated....: 1927533 bytes +~~ total memory freed........: 1927533 bytes +~~ total allocations/frees...: 35330/35330 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/smb_deletefile.pcap.out b/test/results/smb_deletefile.pcap.out index a4719ed72..e8ea0180a 100644 --- a/test/results/smb_deletefile.pcap.out +++ b/test/results/smb_deletefile.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929635 bytes -~~ total memory freed........: 1929635 bytes -~~ total allocations/frees...: 35425/35425 +~~ total memory allocated....: 1930317 bytes +~~ total memory freed........: 1930317 bytes +~~ total allocations/frees...: 35426/35426 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/smbv1.pcap.out b/test/results/smbv1.pcap.out index f2eb4d386..b2dad3e23 100644 --- a/test/results/smbv1.pcap.out +++ b/test/results/smbv1.pcap.out @@ -17,7 +17,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1928957 bytes -~~ total memory freed........: 1928957 bytes -~~ total allocations/frees...: 35332/35332 +~~ total memory allocated....: 1929639 bytes +~~ total memory freed........: 1929639 bytes +~~ total allocations/frees...: 35333/35333 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/smpp_in_general.pcap.out b/test/results/smpp_in_general.pcap.out index 7ac41d388..35a5eab8c 100644 --- a/test/results/smpp_in_general.pcap.out +++ b/test/results/smpp_in_general.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929247 bytes -~~ total memory freed........: 1929247 bytes -~~ total allocations/frees...: 35342/35342 +~~ total memory allocated....: 1929929 bytes +~~ total memory freed........: 1929929 bytes +~~ total allocations/frees...: 35343/35343 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/smtp-starttls.pcap.out b/test/results/smtp-starttls.pcap.out new file mode 100644 index 000000000..817d8adce --- /dev/null +++ b/test/results/smtp-starttls.pcap.out @@ -0,0 +1,31 @@ +00481{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"smtp-starttls.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} +00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"smtp-starttls.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1388017124762,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"173.194.68.26","src_port":57406,"dst_port":25,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00440{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":762850,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AAAMB6wBABNyxPHhCABFAAA8JqtAAEAGeocKAAABrcJEGuA+ABlXuT72AAAAAKACOQgLsAAAAgQFtAQCCAraWRhdAAAAAAEDAwc="} +00440{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":774018,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABNyxPHhANAr0XYACABFAAA8X3cAAC4Gk7utwkQaCgAAAQAZ4D6dvxfqV7k+96ASpiw5gwAAAgQFlgQCCAoS8Zx72lkYXQEDAwY="} +00428{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":774043,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAMB6wBABNyxPHhCABFAAA0JqxAAEAGeo4KAAABrcJEGuA+ABlXuT73nb8X64AQAHMN3wAAAQEICtpZGGgS8Zx7"} +00498{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":785875,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABNyxPHhANAr0XYACABFAABnX3gAAC4Gk4+twkQaCgAAAQAZ4D6dvxfrV7k+94AYApkYXgAAAQEIChLxnIfaWRhoMjIwIG14Lmdvb2dsZS5jb20gRVNNVFAgczRzaTk2OTYzNThxY2MuNjMgLSBnc210cA0K"} +00567{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"smtp-starttls.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1388017124762,"flow_last_seen":1388017124785,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"173.194.68.26","src_port":57406,"dst_port":25,"l4_proto":"tcp","ndpi": {"proto":"SMTP.Google","breed":"Tracker\/Ads","category":"Web"},"smtp": {"user":"","password":""}} +00428{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":785892,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAMB6wBABNyxPHhCABFAAA0Jq1AAEAGeo0KAAABrcJEGuA+ABlXuT73nb8YHoAQAHMNlAAAAQEICtpZGHQS8ZyH"} +00468{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":785971,"pkt_caplen":94,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":94,"pkt_l4_len":60,"pkt":"AAAMB6wBABNyxPHhCABFAABQJq5AAEAGenAKAAABrcJEGuA+ABlXuT73nb8YHoAYAHOZzAAAAQEICtpZGHQS8ZyHRUhMTyB4eHh4eHh4eHh4eHh4Lnh4eC5jb20NCg=="} +00429{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":797027,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABNyxPHhANAr0XYACABFAAA0X3kAAC4Gk8GtwkQaCgAAAQAZ4D6dvxgeV7k\/E4AQApkLRwAAAQEIChLxnJLaWRh0"} +00640{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":836196,"pkt_caplen":220,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":220,"pkt_l4_len":186,"pkt":"ABNyxPHhANAr0XYACABFAADOX3oAAC4GkyatwkQaCgAAAQAZ4D6dvxgeV7k\/E4AYAplRBQAAAQEIChLxnLnaWRh0MjUwLW14Lmdvb2dsZS5jb20gYXQgeW91ciBzZXJ2aWNlLCBbMTAuMDAwLjAwMC4wMV0NCjI1MC1TSVpFIDM1ODgyNTc3DQoyNTAtOEJJVE1JTUUNCjI1MC1TVEFSVFRMUw0KMjUwLUVOSEFOQ0VEU1RBVFVTQ09ERVMNCjI1MC1QSVBFTElOSU5HDQoyNTAgQ0hVTktJTkcNCg=="} +00444{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":853043,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"AAAMB6wBABNyxPHhCABFAAA+Jq9AAEAGeoEKAAABrcJEGuA+ABlXuT8Tnb8YuIAYAHuZugAAAQEICtpZGLcS8Zy5U1RBUlRUTFMNCg=="} +00471{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":864365,"pkt_caplen":96,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":96,"pkt_l4_len":62,"pkt":"ABNyxPHhANAr0XYACABFAABSX3sAAC4Gk6GtwkQaCgAAAQAZ4D6dvxi4V7k\/HYAYApny0gAAAQEIChLxnNbaWRi3MjIwIDIuMC4wIFJlYWR5IHRvIHN0YXJ0IFRMUw0K"} +00585{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":864532,"pkt_caplen":178,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":178,"pkt_l4_len":144,"pkt":"AAAMB6wBABNyxPHhCABFAACkJrBAAEAGehoKAAABrcJEGuA+ABlXuT8dnb8Y1oAYAHuaIAAAAQEICtpZGMMS8ZzWFgMBAGsBAABnAwFSu3XkToct4u4Ps9S7W6Ru+EX7VI43UluVI7uO+ANq3QAAOgA5ADgAiACHADUAhAAWABMACgAzADIAmgCZAEUARAAvAJYAQQAFAAQAFQASAAkAFAARAAgABgADAP8BAAAEACMAAA=="} +02338{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":876575,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"pkt":"ABNyxPHhANAr0XYACABFAAW+X30AAC4GjjOtwkQaCgAAAQAZ4D6dvxjWV7k\/jYAQApgc0gAAAQEIChLxnOHaWRjDFgMBADUCAAAxAwFSu3XkARcJvpFXnTc1nYEuiHlpA1F\/0UviQaEzzcVWRwAABQAACf8BAAEAACMAABYDAQ4hCwAOHQAOGgAGiDCCBoQwggVsoAMCAQICCDJdgpeYfVCwMA0GCSqGSIb3DQEBBQUAMEkxCzAJBgNVBAYTAlVTMRMwEQYDVQQKEwpHb29nbGUgSW5jMSUwIwYDVQQDExxHb29nbGUgSW50ZXJuZXQgQXV0aG9yaXR5IEcyMB4XDTEzMDkwOTExMzIzNVoXDTE0MDkwOTExMzIzNVowZzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEzARBgNVBAoMCkdvb2dsZSBJbmMxFjAUBgNVBAMMDW14Lmdvb2dsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkJoNKt2yJkW+Nz\/IWimznV0H7v+9G\/GwKHA82+hJm8EsUNuk8ZHpIcjD1eovng\/yyrjoTmWqU5VhBfFrcfjnj5oUjUGpR5zOlKDhF7ff9maWXDEMU2FCPjFjwzG2J1NxxdY+i\/AfNSHp+H70SZCoTkSBJC0basaO48brJsPNjnI48fFmSDQSQeUOY3F9hSlzGTFo9MDs3xpiMG\/6pa3+JyhzqcGZhm5L6sPcWJXfpZ2K8\/wUWCCdGEFsexOZAqeAOMprA6Rs2oMvlImFS7uJYfKzzmCWuBbdbKXpY\/zyf8m+Of6BTUrOj9swXyWizfeRWuTprzGMryHCnNNbJTLyhAgMBAAGjggNQMIIDTDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwggImBgNVHREEggIdMIICGYISYXNwbXgubC5nb29nbGUuY29tghdhbHQxLmFzcG14LmwuZ29vZ2xlLmNvbYIXYWx0Mi5hc3BteC5sLmdvb2dsZS5jb22CF2FsdDMuYXNwbXgubC5nb29nbGUuY29tghdhbHQ0LmFzcG14LmwuZ29vZ2xlLmNvbYIaZ21haWwtc210cC1pbi5sLmdvb2dsZS5jb22CH2FsdDEuZ21haWwtc210cC1pbi5sLmdvb2dsZS5jb22CH2FsdDIuZ21haWwtc210cC1pbi5sLmdvb2dsZS5jb22CH2FsdDMuZ21haWwtc210cC1pbi5sLmdvb2dsZS5jb22CH2FsdDQuZ21haWwtc210cC1pbi5sLmdvb2dsZS5jb22CGGdtci1zbXRwLWluLmwuZ29vZ2xlLmNvbYIdYWx0MS5nbXItc210cC1pbi5sLmdvb2dsZS5jb22CHWFsdDIuZ21yLXNtdHAtaW4ubC5nb29nbGUuY29tgh1hbHQzLmdtci1zbXRwLWluLmwuZ29vZ2xlLmNvbYIdYWx0NC5nbXItc210cC1pbi5sLmdvb2dsZS5jb22CDW14Lmdvb2dsZS5jb22CFWFzcG14Mi5nb29nbGVtYWlsLmNvbYIVYXNwbXgzLmdvb2dsZW1haWwuY29tghVhc3BteDQuZ29vZ2xlbWFpbC5jb22CFWFzcG14NS5nb29nbGVtYWlsLmNvbTBoBggrBgEFBQcBAQRcMFowKwYIKwYBBQUHMAKGH2h0dHA6Ly9wa2kuZ29vZ2xlLmNvbS9HSUFHMi5jcnQwKwYIKwYBBQUHMAGGH2h0dHA6Ly9jbGllbnRzMS5nb29nbGUuY29tL29jc3AwHQYDVR0OBBYEFNuBEovo7sRua+YUfQRGCFA2Bl5iMAwGA1UdEwEB\/wQCMAAwHwYDVR0jBBgwFoAUSt0GFhu89mi1dvWBtrtiGrpagS8wFwYDVR0gBBAwDjAMBgorBgEEAdZ5AgU="} +02354{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":876837,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"pkt":"ABNyxPHhANAr0XYACABFAAW+X34AAC4GjjKtwkQaCgAAAQAZ4D6dvx5gV7k\/jYAQAph9mwAAAQEIChLxnOHaWRjDATAwBgNVHR8EKTAnMCWgI6Ahhh9odHRwOi8vcGtpLmdvb2dsZS5jb20vR0lBRzIuY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQBh15p9ofgkHP4Gr6bY\/9UqUItZiHM0dziFX4p2pBhW11Re3C+bcOYthyhHvlavx7GwD2k379Zo4uOdkhNYA4DL\/Jx79f884faJYu3Y78Qy9yWqIpNzNMdyYxgDPlSWZSS3JkIbBPRZSDIlEvbkd8BuVXJ6LQ1y2Fdd+8IeII1TX1O5padNVW\/VbiIAwmm87M4yUaGgqiKd4cxAXWNthAuV1aWrGCx4TnlgODKd4dtFHOY87G1DC43ssUoLkQ3X5Zj\/E6nkSz0wmQ6Ns7kRVouH6ctHuDBQ3d\/jJ\/fucsgxLJBnaP9Hf3J8CFlHnRo7A9ANuIJ6q5mg13WLfnaV\/IcUAAQIMIIEBDCCAuygAwIBAgIDAjppMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMwNDA1MTUxNTU1WhcNMTUwNDA0MTUxNTU1WjBJMQswCQYDVQQGEwJVUzETMBEGA1UEChMKR29vZ2xlIEluYzElMCMGA1UEAxMcR29vZ2xlIEludGVybmV0IEF1dGhvcml0eSBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJwqBHdc2FCROgajguDYUEi8iT\/xGXAaiEZ+4I\/F8YnOIe5a\/mENtzJEiaB0C1NPVaTOgmKV7utZX8bhBYASxF6UP7xbSDj0U\/ck5vuR6RXEz\/RTDfRK\/J9U3n2+oGtvh8DQUB8oMANA2ghzUWx\/\/zo8pzcGjr1LEQTrfSTe5vn8MXH7lNVg8y5Kr0LSy+rEahqyzFPdFUuLH8gZYR\/Nnag+YyuENWllhMgZxUYi+FOVvuOAShDGKuy6lyARxzmZEASg8GF6lSWMTlJ14rbtCMoU\/M4iarNOz0YDl5cDfsCx3nuvRTPPuj5xt970JSXCDTWJnZ37DhF5iR43xa+OcmkCAwEAAaOB+zCB+DAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQUSt0GFhu89mi1dvWBtrtiGrpagS8wEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5nZW90cnVzdC5jb20vY3Jscy9ndGdsb2JhbC5jcmwwPQYIKwYBBQUHAQEEMTAvMC0GCCsGAQUFBzABhiFodHRwOi8vZ3RnbG9iYWwtb2NzcC5nZW90cnVzdC5jb20wFwYDVR0gBBAwDjAMBgorBgEEAdZ5AgUBMA0GCSqGSIb3DQEBBQUAA4IBAQA21waAESetKhSbOHezI6B1WLuxfoNCunLaHtiONgaX4PCVOzf9G0JY\/iLIa704XtE7JW4S615ndkZAkNoUyHgN7ZVm2o6Gb4ChulYylYbc3GrKBIxbf\/a\/zG+FA1jDaFETzf3I93k9mTXwVqO94FntT0QJo544evZG0R0SnU++0ED8Vf4GXjzaHFa9llF7b1cq26KqltyMdMKVvvBulRP\/F\/A8rLIQjcxz++iPAsbw+zOzlTvjwstoWHPbqCRiOwY1nQ2pM714A5AuTHhdUDqB1O6gyHA43LL5Z\/qHQF1hwFGPa4NrzQU6yuGnBXj8ytqU0CwIPX4WecigUCAkVDNxAAOBMIIDfTCCAuagAwIBAgIDErvmMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVTMRAwDgY="} +00430{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":876854,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAMB6wBABNyxPHhCABFAAA0JrFAAEAGeokKAAABrcJEGuA+ABlXuT+Nnb8j6oAQAKcASQAAAQEICtpZGM8S8Zzh"} +01587{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"smtp-starttls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1388017124,"pkt_ts_usec":876863,"pkt_caplen":919,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":919,"pkt_l4_len":885,"pkt":"ABNyxPHhANAr0XYACABFAAOJX34AAC4GkGetwkQaCgAAAQAZ4D6dvyPqV7k\/jYAYApiTTgAAAQEIChLxnOHaWRjDA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTAyMDUyMTA0MDAwMFoXDTE4MDgyMTA0MDAwMFowQjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xGzAZBgNVBAMTEkdlb1RydXN0IEdsb2JhbCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANrMGGMw\/fQXIxpWflvfPGw45HG3eJHUvKHYTPioQ7YD6U0hBwiI2lgvZjkpvQV4i5046AW3an5xpObEYKaw74DkiSgPniXW7YPzraaRx5jJQhg1FJ2tmEaSLk\/K8YdDwRaVVy1Q74ktgHpXrfLuX2vSAI25FPgUFTXZwEaje3LIkb\/JVSvN0Jc+nCZkzN\/Ogxlxyk7m1NV7qRnNVd7I7NJeOFPlXE+MLf5QIzb8ZubLjqQ5GQC3lQI5kQsO\/jgu0R0FmvZNPm8PBx2vLB6PYDni+jZTEznUXiYr2z2oFL0y6xgDKFIEceWrMz3hOLsHNoRinHnqFjD0X8Ar6HFr5PkCAwEAAaOB8DCB7TAfBgNVHSMEGDAWgBRI5mj5K9KylddH2CMgEE8zmJCf1DAdBgNVHQ4EFgQUwHqYaI2J+6sFZAwRfap9ZbjKzE4wDwYDVR0TAQH\/BAUwAwEB\/zAOBgNVHQ8BAf8EBAMCAQYwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5nZW90cnVzdC5jb20vY3Jscy9zZWN1cmVjYS5jcmwwTgYDVR0gBEcwRTBDBgRVHSAAMDswOQYIKwYBBQUHAgEWLWh0dHBzOi8vd3d3Lmdlb3RydXN0LmNvbS9yZXNvdXJjZXMvcmVwb3NpdG9yeTANBgkqhkiG9w0BAQUFAAOBgQB24RJuTksWEoYwBrKBCM\/wCMfHcX5m7sLt1Dsf\/\/DwyE7WQziwuTB9GNBVg6JqyzYRnOhIZqNtf7gT1Ef+i1pcc\/yu2RsyGTirlzQUqpbS66McFAhJtrvlke+DNusdVm\/K2rxzY5Dkf3s+Iss9B+1fOHSc4wNQTqGvmO5h8oQ\/EhYDAQAEDgAAAA=="} +00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":36,"source":"smtp-starttls.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":36,"flow_first_seen":1388017124762,"flow_last_seen":1388017125239,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1418,"flow_tot_l4_payload_len":6011,"flow_avg_l4_payload_len":166,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"173.194.68.26","src_port":57406,"dst_port":25,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00133{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":36,"source":"smtp-starttls.pcap","alias":"nDPId-test"} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 36/36 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 7179 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 1928432 bytes +~~ total memory freed........: 1928432 bytes +~~ total allocations/frees...: 35361/35361 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/snapchat.pcap.out b/test/results/snapchat.pcap.out index a57431eab..d4e027077 100644 --- a/test/results/snapchat.pcap.out +++ b/test/results/snapchat.pcap.out @@ -64,7 +64,7 @@ ~~ total detected protocols..: 3 ~~ total active/idle flows...: 3/3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1940812 bytes -~~ total memory freed........: 1940812 bytes -~~ total allocations/frees...: 35391/35391 +~~ total memory allocated....: 1941382 bytes +~~ total memory freed........: 1941382 bytes +~~ total allocations/frees...: 35392/35392 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/snapchat_call.pcapng.out b/test/results/snapchat_call.pcapng.out index 5decf3ad0..a23a3e044 100644 --- a/test/results/snapchat_call.pcapng.out +++ b/test/results/snapchat_call.pcapng.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1928156 bytes -~~ total memory freed........: 1928156 bytes -~~ total allocations/frees...: 35374/35374 +~~ total memory allocated....: 1928838 bytes +~~ total memory freed........: 1928838 bytes +~~ total allocations/frees...: 35375/35375 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ssdp-m-search.pcap.out b/test/results/ssdp-m-search.pcap.out index 1f3a2b342..5cb880353 100644 --- a/test/results/ssdp-m-search.pcap.out +++ b/test/results/ssdp-m-search.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1927257 bytes -~~ total memory freed........: 1927257 bytes -~~ total allocations/frees...: 35343/35343 +~~ total memory allocated....: 1927939 bytes +~~ total memory freed........: 1927939 bytes +~~ total allocations/frees...: 35344/35344 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ssh.pcap.out b/test/results/ssh.pcap.out index 46b4fed72..5a6abf4d5 100644 --- a/test/results/ssh.pcap.out +++ b/test/results/ssh.pcap.out @@ -28,7 +28,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1936192 bytes -~~ total memory freed........: 1936192 bytes -~~ total allocations/frees...: 35586/35586 +~~ total memory allocated....: 1936874 bytes +~~ total memory freed........: 1936874 bytes +~~ total allocations/frees...: 35587/35587 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ssl-cert-name-mismatch.pcap.out b/test/results/ssl-cert-name-mismatch.pcap.out index de09033a8..0ee7ea459 100644 --- a/test/results/ssl-cert-name-mismatch.pcap.out +++ b/test/results/ssl-cert-name-mismatch.pcap.out @@ -27,7 +27,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1935523 bytes -~~ total memory freed........: 1935523 bytes -~~ total allocations/frees...: 35353/35353 +~~ total memory allocated....: 1936205 bytes +~~ total memory freed........: 1936205 bytes +~~ total allocations/frees...: 35354/35354 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/starcraft_battle.pcap.out b/test/results/starcraft_battle.pcap.out index ca985b7f2..5343b044f 100644 --- a/test/results/starcraft_battle.pcap.out +++ b/test/results/starcraft_battle.pcap.out @@ -529,7 +529,7 @@ ~~ total detected protocols..: 30 ~~ total active/idle flows...: 52/52 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2137508 bytes -~~ total memory freed........: 2137508 bytes -~~ total allocations/frees...: 36343/36343 +~~ total memory allocated....: 2135334 bytes +~~ total memory freed........: 2135334 bytes +~~ total allocations/frees...: 36344/36344 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/steam.pcap.out b/test/results/steam.pcap.out index d12ee2c54..0eebfb569 100644 --- a/test/results/steam.pcap.out +++ b/test/results/steam.pcap.out @@ -276,7 +276,7 @@ ~~ total detected protocols..: 55 ~~ total active/idle flows...: 55/55 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2100362 bytes -~~ total memory freed........: 2100362 bytes -~~ total allocations/frees...: 35590/35590 +~~ total memory allocated....: 2098020 bytes +~~ total memory freed........: 2098020 bytes +~~ total allocations/frees...: 35591/35591 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/steam_datagram_relay_ping.pcapng.out b/test/results/steam_datagram_relay_ping.pcapng.out index a14236de2..57d330631 100644 --- a/test/results/steam_datagram_relay_ping.pcapng.out +++ b/test/results/steam_datagram_relay_ping.pcapng.out @@ -12,7 +12,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926764 bytes -~~ total memory freed........: 1926764 bytes -~~ total allocations/frees...: 35326/35326 +~~ total memory allocated....: 1927446 bytes +~~ total memory freed........: 1927446 bytes +~~ total allocations/frees...: 35327/35327 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/synscan.pcap.out b/test/results/synscan.pcap.out index 31ff7f54b..eae418032 100644 --- a/test/results/synscan.pcap.out +++ b/test/results/synscan.pcap.out @@ -8000,7 +8000,7 @@ ~~ total detected protocols..: 2 ~~ total active/idle flows...: 1994/1994 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 8282905 bytes -~~ total memory freed........: 8282905 bytes -~~ total allocations/frees...: 43314/43314 +~~ total memory allocated....: 8171979 bytes +~~ total memory freed........: 8171979 bytes +~~ total allocations/frees...: 43315/43315 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/teams.pcap.out b/test/results/teams.pcap.out index 472dbb0cc..b21ab86f0 100644 --- a/test/results/teams.pcap.out +++ b/test/results/teams.pcap.out @@ -114,6 +114,7 @@ 00623{"flow_id":8,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":191,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":274350,"pkt_caplen":212,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":212,"pkt_l4_len":178,"pkt":"EBMx8Tl2KDc3AG3ICABFAADGAABAAEAGgY7AqAEGNHHChOx4Abt\/TkyspItsnVAYIADFvQAAFgMDAGYQAABiYQTxgotmGkb9FcH5FUJAmY+IuSsOw5d+NiTKNDdr8gMKGCiRz+OrN2usCVeyQuJ2hYG0lEs1BP4wAxS3bfPvL9r2KEGBZkrJHYatnTVZxhAAdnXdPSdHbUfx19ZFZrZkHzAUAwMAAQEWAwMAKAAAAAAAAAAAaIoAUkcmslIl15A1c+bAL53g4S7Y2eLaeTpGpoRJasw="} 00415{"flow_id":8,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":196,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":285008,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"KDc3AG3IEBMx8Tl2CABFAAAowVBAAHYGits0ccKEwKgBBgG77Hiki2ydf05NSlAQBAEnOgAAAAAAAAAA"} 00406{"flow_id":2,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":403,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":380886,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGPCzAqAEGlZqnW+SlAbsZTPC8DAoX91AUECaMmwAA"} +01064{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":444,"source":"teams.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":255,"flow_first_seen":1587041677243,"flow_last_seen":1587041677384,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":185330,"flow_avg_l4_payload_len":726,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60536,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"teams.microsoft.com","server_names":"teams.microsoft.com","ja3":"74d5fa154a7fc0a7c655d8eaa34b89bf","ja3s":"0f14538e1c9070becdad7739c67d6363","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4","issuerDN":"CN=teams.microsoft.com","alpn":"h2,http\/1.1","fingerprint":"68:1E:E8:3C:83:70:6F:E3:86:F4:E8:8C:C4:E6:A0:9A:3E:E0:9C:0E"}} 00385{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":607,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":408485,"pkt_caplen":60,"pkt_type":34969,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWriJklgAAA2A0X1lWrAACAAADYDRfWVauACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} 00148{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":607,"source":"teams.pcap","alias":"nDPId-test","type":34969} 00779{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":608,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":422728,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzES5AAEARZ+PAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGADtdrMEAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"} @@ -1038,7 +1039,7 @@ 00463{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":2,"flow_first_seen":1587041697660,"flow_last_seen":1587041697673,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"93.71.110.205","dst_ip":"192.168.1.6","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":30,"flow_first_seen":1587041693849,"flow_last_seen":1587041697765,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":7358,"flow_avg_l4_payload_len":245,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.153","src_port":50036,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":40,"flow_first_seen":1587041676435,"flow_last_seen":1587041676536,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":12621,"flow_avg_l4_payload_len":315,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60533,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1300,"flow_first_seen":1587041677243,"flow_last_seen":1587041697130,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":750126,"flow_avg_l4_payload_len":577,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60536,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":255,"flow_first_seen":1587041677243,"flow_last_seen":1587041697130,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":185330,"flow_avg_l4_payload_len":726,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60536,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":37,"flow_first_seen":1587041682144,"flow_last_seen":1587041685098,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":9034,"flow_avg_l4_payload_len":244,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60542,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":52,"flow_first_seen":1587041685240,"flow_last_seen":1587041685471,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":30424,"flow_avg_l4_payload_len":585,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60554,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":25,"flow_first_seen":1587041685984,"flow_last_seen":1587041686156,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":8124,"flow_avg_l4_payload_len":324,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60557,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -1124,7 +1125,7 @@ ~~ total detected protocols..: 78 ~~ total active/idle flows...: 85/85 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4016017 bytes -~~ total memory freed........: 4016017 bytes -~~ total allocations/frees...: 38848/38848 +~~ total memory allocated....: 3900405 bytes +~~ total memory freed........: 3900405 bytes +~~ total allocations/frees...: 38836/38836 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/teamspeak3.pcap.out b/test/results/teamspeak3.pcap.out index 6e56c4c4c..b6c3a9696 100644 --- a/test/results/teamspeak3.pcap.out +++ b/test/results/teamspeak3.pcap.out @@ -23,7 +23,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1927083 bytes -~~ total memory freed........: 1927083 bytes -~~ total allocations/frees...: 35337/35337 +~~ total memory allocated....: 1927765 bytes +~~ total memory freed........: 1927765 bytes +~~ total allocations/frees...: 35338/35338 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/telegram.pcap.out b/test/results/telegram.pcap.out index d35845fef..d505bace2 100644 --- a/test/results/telegram.pcap.out +++ b/test/results/telegram.pcap.out @@ -243,7 +243,6 @@ 00638{"flow_id":25,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":417,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779620,"pkt_ts_usec":675886,"pkt_caplen":218,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":218,"pkt_l4_len":184,"pkt":"8KNaMBgSKDc3AG3ICABFAADMZvUAAEARj1rAqAFNwKgBNFqGevgAuJMYkbG\/KIwIwQnayLD0LMXcqEj4lfZ8P9V2iOgexzXB+FkyVtJQfJJnKJmRVHq7SYjBzTc81jea\/W4JIV63if0rV5VmSeagRTwkiWOdGd9o02IQOA+PZJoz0lbdO4rIb8YnZr2XoGAdftw\/Xvcd7TrER6tHinrYdVg4a727UMkOFw96i+NaQr+lRQwgZr4Zf8u+FORrz2a5CnGe4doPuGXE8geBfZgxu\/1NsVKk2aHZjlE="} 00661{"flow_id":25,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":418,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779620,"pkt_ts_usec":724400,"pkt_caplen":234,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":234,"pkt_l4_len":200,"pkt":"KDc3AG3I8KNaMBgSCABFAADcPBYAAEARuinAqAE0wKgBTXr4WoYAyD7zXC3NU7wX1h\/h\/kWcJ8qpQmiUN4mhou4JHo77YBPu7\/VIjDsoEmtNSaKDnbUdu9rsQvahuCrdo6qM8+WBlFmUqWfA9spsOUDbGhwiOu\/lCsyDdexur637pbnJEdrQnE5HC5ssaS6AKLWy49YhWHXZpaKXSUEpzSC6ItBDxBR3fKHkGB5NVGyHr8\/h4eaV5mQuKkaNSXZCpy8wOZWWvDRFDXwW4QKX+b0Qm\/U5oaRB0uDYUq\/aULnstigk7puyQYRj"} 00782{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":443,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779621,"pkt_ts_usec":450773,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJpAAEARYHfAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGAKhEc1gAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"} -00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":501,"source":"telegram.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":97,"flow_first_seen":1588779617174,"flow_last_seen":1588779623177,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":240,"flow_tot_l4_payload_len":18384,"flow_avg_l4_payload_len":189,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.52","src_port":23174,"dst_port":31480,"l4_proto":"udp","ndpi": {"proto":"RTP","breed":"Acceptable","category":"Media"}} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":597,"source":"telegram.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1588779625981,"flow_last_seen":0,"flow_min_l4_payload_len":355,"flow_max_l4_payload_len":355,"flow_tot_l4_payload_len":355,"flow_avg_l4_payload_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00890{"flow_id":28,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":597,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779625,"pkt_ts_usec":981468,"pkt_caplen":397,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":397,"pkt_l4_len":363,"pkt":"\/\/\/\/\/\/\/\/AICPmq69CABFAAF\/jrEAAEAR6r0AAAAA\/\/\/\/\/wBEAEMBa16\/AQEGAN7JmyKFuQAAAAAAAAAAAAAAAAAAAAAAAACAj5quvQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBPRP\/j5quvQABAAEfyzfOuCfrPQjbUAB0AQE5AgXcPC1kaGNwY2QtNi4xMC4xOkxpbnV4LTQuOS41Ny12Nys6YXJtdjdsOkJDTTI4MzUMDHBpMy5udG9wLm9yZ5EBATcPAXkhAwYMDxocKjM2Ojt3\/w=="} 00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":597,"source":"telegram.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1588779625981,"flow_last_seen":0,"flow_min_l4_payload_len":355,"flow_max_l4_payload_len":355,"flow_tot_l4_payload_len":355,"flow_avg_l4_payload_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"fingerprint":""}} @@ -258,6 +257,7 @@ 00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":618,"source":"telegram.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1588779625981,"flow_last_seen":0,"flow_min_l4_payload_len":355,"flow_max_l4_payload_len":355,"flow_tot_l4_payload_len":355,"flow_avg_l4_payload_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":618,"source":"telegram.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1588779626393,"flow_last_seen":0,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":201,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.43","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00782{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":618,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779626,"pkt_ts_usec":467979,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJtAAEARYHbAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGAOKuuvkAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"} +00523{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":667,"source":"telegram.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":255,"flow_first_seen":1588779617174,"flow_last_seen":1588779627931,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":272,"flow_tot_l4_payload_len":50128,"flow_avg_l4_payload_len":196,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.52","src_port":23174,"dst_port":31480,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":695,"source":"telegram.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1588779628757,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49764,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00438{"flow_id":31,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":695,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779628,"pkt_ts_usec":757409,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA7n3IAAP8RmKDAqAFNwKgBAcJkADUAJ31bFnMBAAABAAAAAAAABGRhdGkEbnRvcANvcmcAAAEAAQ=="} 00644{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":695,"source":"telegram.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1588779628757,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49764,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.ntop","breed":"Safe","category":"Network"},"dns": {"query":"dati.ntop.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} @@ -510,7 +510,7 @@ 00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1588779647380,"flow_last_seen":0,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":126,"flow_tot_l4_payload_len":126,"flow_avg_l4_payload_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":50698,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":2,"flow_first_seen":1588779650651,"flow_last_seen":1588779650681,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":58615,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1588779637560,"flow_last_seen":1588779637572,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":94,"flow_tot_l4_payload_len":135,"flow_avg_l4_payload_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":301,"flow_first_seen":1588779617174,"flow_last_seen":1588779629315,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":272,"flow_tot_l4_payload_len":59552,"flow_avg_l4_payload_len":197,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.52","src_port":23174,"dst_port":31480,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":255,"flow_first_seen":1588779617174,"flow_last_seen":1588779629315,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":272,"flow_tot_l4_payload_len":50128,"flow_avg_l4_payload_len":196,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.52","src_port":23174,"dst_port":31480,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":3,"flow_first_seen":1588779634762,"flow_last_seen":1588779634795,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":1350,"flow_tot_l4_payload_len":2728,"flow_avg_l4_payload_len":909,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":61974,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00515{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":120,"flow_first_seen":1588779596708,"flow_last_seen":1588779655298,"flow_min_l4_payload_len":100,"flow_max_l4_payload_len":427,"flow_tot_l4_payload_len":19803,"flow_avg_l4_payload_len":165,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4ba:91a:7817:e318","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test"} @@ -518,10 +518,10 @@ ~~ packets captured/processed: 1566/1566 ~~ skipped flows.............: 0 ~~ total layer4 data length..: 281061 bytes -~~ total detected protocols..: 53 +~~ total detected protocols..: 52 ~~ total active/idle flows...: 54/54 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2139696 bytes -~~ total memory freed........: 2139696 bytes -~~ total allocations/frees...: 37051/37051 +~~ total memory allocated....: 2137410 bytes +~~ total memory freed........: 2137410 bytes +~~ total allocations/frees...: 37052/37052 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/teredo.pcap.out b/test/results/teredo.pcap.out index 789aeef35..4f8b973dd 100644 --- a/test/results/teredo.pcap.out +++ b/test/results/teredo.pcap.out @@ -46,7 +46,7 @@ ~~ total detected protocols..: 5 ~~ total active/idle flows...: 5/5 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1940042 bytes -~~ total memory freed........: 1940042 bytes -~~ total allocations/frees...: 35360/35360 +~~ total memory allocated....: 1940500 bytes +~~ total memory freed........: 1940500 bytes +~~ total allocations/frees...: 35361/35361 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/tftp.pcap.out b/test/results/tftp.pcap.out index b96c2e758..6e1ad971c 100644 --- a/test/results/tftp.pcap.out +++ b/test/results/tftp.pcap.out @@ -40,7 +40,7 @@ ~~ total detected protocols..: 4 ~~ total active/idle flows...: 4/4 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1939202 bytes -~~ total memory freed........: 1939202 bytes -~~ total allocations/frees...: 35437/35437 +~~ total memory allocated....: 1939716 bytes +~~ total memory freed........: 1939716 bytes +~~ total allocations/frees...: 35438/35438 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/tinc.pcap.out b/test/results/tinc.pcap.out index 8752dc125..0319ef246 100644 --- a/test/results/tinc.pcap.out +++ b/test/results/tinc.pcap.out @@ -79,7 +79,7 @@ ~~ total detected protocols..: 4 ~~ total active/idle flows...: 4/4 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1953892 bytes -~~ total memory freed........: 1953892 bytes -~~ total allocations/frees...: 35662/35662 +~~ total memory allocated....: 1954406 bytes +~~ total memory freed........: 1954406 bytes +~~ total allocations/frees...: 35663/35663 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/tk.pcap.out b/test/results/tk.pcap.out index 0f253b1a5..8b3b0fe28 100644 --- a/test/results/tk.pcap.out +++ b/test/results/tk.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 3 ~~ total active/idle flows...: 3/3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1933200 bytes -~~ total memory freed........: 1933200 bytes -~~ total allocations/frees...: 35336/35336 +~~ total memory allocated....: 1933770 bytes +~~ total memory freed........: 1933770 bytes +~~ total allocations/frees...: 35337/35337 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/tls-esni-fuzzed.pcap.out b/test/results/tls-esni-fuzzed.pcap.out index c9bc5adbb..42c21fa9b 100644 --- a/test/results/tls-esni-fuzzed.pcap.out +++ b/test/results/tls-esni-fuzzed.pcap.out @@ -19,7 +19,7 @@ ~~ total detected protocols..: 3 ~~ total active/idle flows...: 3/3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1940553 bytes -~~ total memory freed........: 1940553 bytes -~~ total allocations/frees...: 35344/35344 +~~ total memory allocated....: 1941123 bytes +~~ total memory freed........: 1941123 bytes +~~ total allocations/frees...: 35345/35345 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/tls-rdn-extract.pcap.out b/test/results/tls-rdn-extract.pcap.out index 694f37379..a4c6585be 100644 --- a/test/results/tls-rdn-extract.pcap.out +++ b/test/results/tls-rdn-extract.pcap.out @@ -18,7 +18,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1968547 bytes -~~ total memory freed........: 1968547 bytes -~~ total allocations/frees...: 35379/35379 +~~ total memory allocated....: 1969229 bytes +~~ total memory freed........: 1969229 bytes +~~ total allocations/frees...: 35380/35380 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/tls_alert.pcap.out b/test/results/tls_alert.pcap.out new file mode 100644 index 000000000..2eaded003 --- /dev/null +++ b/test/results/tls_alert.pcap.out @@ -0,0 +1,27 @@ +00477{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"tls_alert.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} +00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"tls_alert.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1628259176203,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.192","dst_ip":"192.168.1.20","src_port":63158,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00442{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"tls_alert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1628259176,"pkt_ts_usec":203392,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"AICPmq69oM7IELEuCABFAABAAABAAEAGtpPAqAHAwKgBFPa2AbvtIEkOAAAAALAC\/\/9MagAAAgQFtAEDAwUBAQgKE9Ij+wAAAAAEAgAA"} +00436{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"tls_alert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1628259176,"pkt_ts_usec":203813,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"oM7IELEuAICPmq69CABFAAA8AABAAEAGtpfAqAEUwKgBwAG79rbEoc1F7SBJD6AScSBz9QAAAgQFtAQCCAoAseWtE9Ij+wEDAwc="} +00426{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"tls_alert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1628259176,"pkt_ts_usec":203877,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AICPmq69oM7IELEuCABFAAA0AABAAEAGtp\/AqAHAwKgBFPa2AbvtIEkPxKHNRoAQEBUDzQAAAQEIChPSI\/sAseWt"} +00700{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"tls_alert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1628259176,"pkt_ts_usec":204397,"pkt_caplen":265,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":265,"pkt_l4_len":231,"pkt":"AICPmq69oM7IELEuCABFAAD7AABAAEAGtdjAqAHAwKgBFPa2AbvtIEkPxKHNRoAYEBXUyQAAAQEIChPSI\/wAseWtFgMBAMIBAAC+AwFS2zXz6qEYi\/Hhk\/zPMz5Yc\/Q1u9wcSBgXhT9UdiVqOgAAEgAvADMANQA5wAnACsATwBRWAAEAAIP\/AQABAAAAAB0AGwAAGHd3dy5nb29nbGUtYW5hbHl0aWNzLmNvbQAXAAAABQAFAQAAAAAzdAAAABIAAAAQADAALgJoMgVoMi0xNgVoMi0xNQVoMi0xNAhzcGR5LzMuMQZzcGR5LzMIaHR0cC8xLjEACwACAQAACgAKAAgAHQAXABgAGQ=="} +00832{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"tls_alert.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1628259176203,"flow_last_seen":1628259176204,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":199,"flow_tot_l4_payload_len":199,"flow_avg_l4_payload_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.192","dst_ip":"192.168.1.20","src_port":63158,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"www.google-analytics.com","ja3":"d78489b860c8bf7838a6ff0b4d131541","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1"}} +00424{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"tls_alert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1628259176,"pkt_ts_usec":204809,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"oM7IELEuAICPmq69CABFAAA0KOtAAEAGjbTAqAEUwKgBwAG79rbEoc1G7SBJ1oAQAOsSLwAAAQEICgCx5a0T0iP8"} +00436{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"tls_alert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1628259176,"pkt_ts_usec":204934,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"oM7IELEuAICPmq69CABFAAA7KOxAAEAGjazAqAEUwKgBwAG79rbEoc1G7SBJ1oAYAOu0GgAAAQEICgCx5a0T0iP8FQMBAAICRg=="} +00427{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"tls_alert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1628259176,"pkt_ts_usec":204981,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AICPmq69oM7IELEuCABFAAA0AABAAEAGtp\/AqAHAwKgBFPa2AbvtIEnWxKHNTYAQEBUC\/gAAAQEIChPSI\/wAseWt"} +00424{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"tls_alert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1628259176,"pkt_ts_usec":205061,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"oM7IELEuAICPmq69CABFAAA0KO1AAEAGjbLAqAEUwKgBwAG79rbEoc1N7SBJ1oARAOsSJwAAAQEICgCx5a0T0iP8"} +00427{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"tls_alert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1628259176,"pkt_ts_usec":205093,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AICPmq69oM7IELEuCABFAAA0AABAAEAGtp\/AqAHAwKgBFPa2AbvtIEnWxKHNToAQEBUC\/QAAAQEIChPSI\/wAseWt"} +00428{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"tls_alert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1628259176,"pkt_ts_usec":205826,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AICPmq69oM7IELEuCABFAAA0AABAAEAGtp\/AqAHAwKgBFPa2AbvtIEnWxKHNToAREBUC+wAAAQEIChPSI\/0AseWt"} +00426{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"tls_alert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1628259176,"pkt_ts_usec":206182,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"oM7IELEuAICPmq69CABFAAA0S9xAAEAGasPAqAEUwKgBwAG79rbEoc1O7SBJ14AQAOsSJAAAAQEICgCx5a4T0iP9"} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11,"source":"tls_alert.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":11,"flow_first_seen":1628259176203,"flow_last_seen":1628259176206,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":199,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.192","dst_ip":"192.168.1.20","src_port":63158,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":11,"source":"tls_alert.pcap","alias":"nDPId-test"} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 11/11 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 578 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 1929801 bytes +~~ total memory freed........: 1929801 bytes +~~ total allocations/frees...: 35338/35338 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/tls_certificate_too_long.pcap.out b/test/results/tls_certificate_too_long.pcap.out index 3604d5d16..eaa239d78 100644 --- a/test/results/tls_certificate_too_long.pcap.out +++ b/test/results/tls_certificate_too_long.pcap.out @@ -358,7 +358,7 @@ ~~ total detected protocols..: 29 ~~ total active/idle flows...: 35/35 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2155165 bytes -~~ total memory freed........: 2155165 bytes -~~ total allocations/frees...: 35856/35856 +~~ total memory allocated....: 2153943 bytes +~~ total memory freed........: 2153943 bytes +~~ total allocations/frees...: 35857/35857 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/tls_esni_sni_both.pcap.out b/test/results/tls_esni_sni_both.pcap.out index 2cba97ddc..5324a5ba3 100644 --- a/test/results/tls_esni_sni_both.pcap.out +++ b/test/results/tls_esni_sni_both.pcap.out @@ -45,7 +45,7 @@ ~~ total detected protocols..: 2 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1949468 bytes -~~ total memory freed........: 1949468 bytes -~~ total allocations/frees...: 35375/35375 +~~ total memory allocated....: 1950094 bytes +~~ total memory freed........: 1950094 bytes +~~ total allocations/frees...: 35376/35376 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/tls_invalid_reads.pcap.out b/test/results/tls_invalid_reads.pcap.out index f0988ca57..cde98a3c8 100644 --- a/test/results/tls_invalid_reads.pcap.out +++ b/test/results/tls_invalid_reads.pcap.out @@ -30,7 +30,7 @@ ~~ total detected protocols..: 2 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1934194 bytes -~~ total memory freed........: 1934194 bytes -~~ total allocations/frees...: 35337/35337 +~~ total memory allocated....: 1934820 bytes +~~ total memory freed........: 1934820 bytes +~~ total allocations/frees...: 35338/35338 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/tls_long_cert.pcap.out b/test/results/tls_long_cert.pcap.out index a3db34915..d94c8b787 100644 --- a/test/results/tls_long_cert.pcap.out +++ b/test/results/tls_long_cert.pcap.out @@ -27,7 +27,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1972822 bytes -~~ total memory freed........: 1972822 bytes -~~ total allocations/frees...: 35568/35568 +~~ total memory allocated....: 1973504 bytes +~~ total memory freed........: 1973504 bytes +~~ total allocations/frees...: 35569/35569 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/tls_verylong_certificate.pcap.out b/test/results/tls_verylong_certificate.pcap.out index c95ddb5c4..eb7e23ca3 100644 --- a/test/results/tls_verylong_certificate.pcap.out +++ b/test/results/tls_verylong_certificate.pcap.out @@ -27,7 +27,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2100377 bytes -~~ total memory freed........: 2100377 bytes -~~ total allocations/frees...: 35509/35509 +~~ total memory allocated....: 2101059 bytes +~~ total memory freed........: 2101059 bytes +~~ total allocations/frees...: 35510/35510 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/tor.pcap.out b/test/results/tor.pcap.out index a5ab1b228..50ce8de9a 100644 --- a/test/results/tor.pcap.out +++ b/test/results/tor.pcap.out @@ -479,7 +479,7 @@ ~~ total detected protocols..: 19 ~~ total active/idle flows...: 20/20 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2108583 bytes -~~ total memory freed........: 2108583 bytes -~~ total allocations/frees...: 39096/39096 +~~ total memory allocated....: 2108201 bytes +~~ total memory freed........: 2108201 bytes +~~ total allocations/frees...: 39097/39097 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/trickbot.pcap.out b/test/results/trickbot.pcap.out index 734be2785..681be7177 100644 --- a/test/results/trickbot.pcap.out +++ b/test/results/trickbot.pcap.out @@ -26,7 +26,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1929028 bytes -~~ total memory freed........: 1929028 bytes -~~ total allocations/frees...: 35402/35402 +~~ total memory allocated....: 1929710 bytes +~~ total memory freed........: 1929710 bytes +~~ total allocations/frees...: 35403/35403 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/tumblr.pcap.out b/test/results/tumblr.pcap.out index ada402d54..a7a9853da 100644 --- a/test/results/tumblr.pcap.out +++ b/test/results/tumblr.pcap.out @@ -485,7 +485,7 @@ ~~ total detected protocols..: 13 ~~ total active/idle flows...: 48/48 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5006644 bytes -~~ total memory freed........: 5006644 bytes -~~ total allocations/frees...: 60391/60391 +~~ total memory allocated....: 3279433 bytes +~~ total memory freed........: 3279433 bytes +~~ total allocations/frees...: 60317/60317 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/ubntac2.pcap.out b/test/results/ubntac2.pcap.out index 59b98e790..d7466afa1 100644 --- a/test/results/ubntac2.pcap.out +++ b/test/results/ubntac2.pcap.out @@ -39,7 +39,7 @@ ~~ total detected protocols..: 8 ~~ total active/idle flows...: 8/8 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1949058 bytes -~~ total memory freed........: 1949058 bytes -~~ total allocations/frees...: 35353/35353 +~~ total memory allocated....: 1949348 bytes +~~ total memory freed........: 1949348 bytes +~~ total allocations/frees...: 35354/35354 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/upnp.pcap.out b/test/results/upnp.pcap.out index 83353039a..0d8f22780 100644 --- a/test/results/upnp.pcap.out +++ b/test/results/upnp.pcap.out @@ -27,7 +27,7 @@ ~~ total detected protocols..: 0 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1930272 bytes -~~ total memory freed........: 1930272 bytes -~~ total allocations/frees...: 35341/35341 +~~ total memory allocated....: 1930898 bytes +~~ total memory freed........: 1930898 bytes +~~ total allocations/frees...: 35342/35342 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/viber.pcap.out b/test/results/viber.pcap.out index 07b8a93cb..f278e7452 100644 --- a/test/results/viber.pcap.out +++ b/test/results/viber.pcap.out @@ -295,7 +295,7 @@ ~~ total detected protocols..: 22 ~~ total active/idle flows...: 26/26 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2270396 bytes -~~ total memory freed........: 2270396 bytes -~~ total allocations/frees...: 35895/35895 +~~ total memory allocated....: 2205229 bytes +~~ total memory freed........: 2205229 bytes +~~ total allocations/frees...: 35881/35881 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/vnc.pcap.out b/test/results/vnc.pcap.out index 458e99697..35d5afff6 100644 --- a/test/results/vnc.pcap.out +++ b/test/results/vnc.pcap.out @@ -43,7 +43,7 @@ ~~ total detected protocols..: 2 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2065941 bytes -~~ total memory freed........: 2065941 bytes -~~ total allocations/frees...: 39880/39880 +~~ total memory allocated....: 2066567 bytes +~~ total memory freed........: 2066567 bytes +~~ total allocations/frees...: 39881/39881 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/wa_video.pcap.out b/test/results/wa_video.pcap.out index ecbd57ac5..042979455 100644 --- a/test/results/wa_video.pcap.out +++ b/test/results/wa_video.pcap.out @@ -142,7 +142,7 @@ ~~ total detected protocols..: 14 ~~ total active/idle flows...: 15/15 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2397005 bytes -~~ total memory freed........: 2397005 bytes -~~ total allocations/frees...: 36996/36996 +~~ total memory allocated....: 2084260 bytes +~~ total memory freed........: 2084260 bytes +~~ total allocations/frees...: 36952/36952 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/wa_voice.pcap.out b/test/results/wa_voice.pcap.out index d417dd2f4..25312382d 100644 --- a/test/results/wa_voice.pcap.out +++ b/test/results/wa_voice.pcap.out @@ -294,7 +294,7 @@ ~~ total detected protocols..: 28 ~~ total active/idle flows...: 30/30 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 3418430 bytes -~~ total memory freed........: 3418430 bytes -~~ total allocations/frees...: 36271/36271 +~~ total memory allocated....: 2128610 bytes +~~ total memory freed........: 2128610 bytes +~~ total allocations/frees...: 36169/36169 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/waze.pcap.out b/test/results/waze.pcap.out index 744571d14..335c6c4e0 100644 --- a/test/results/waze.pcap.out +++ b/test/results/waze.pcap.out @@ -499,7 +499,7 @@ ~~ total detected protocols..: 22 ~~ total active/idle flows...: 33/33 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2310533 bytes -~~ total memory freed........: 2310533 bytes -~~ total allocations/frees...: 36113/36113 +~~ total memory allocated....: 2309423 bytes +~~ total memory freed........: 2309423 bytes +~~ total allocations/frees...: 36114/36114 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/webex.pcap.out b/test/results/webex.pcap.out index 145496178..144572003 100644 --- a/test/results/webex.pcap.out +++ b/test/results/webex.pcap.out @@ -924,7 +924,7 @@ ~~ total detected protocols..: 52 ~~ total active/idle flows...: 57/57 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2452086 bytes -~~ total memory freed........: 2452086 bytes -~~ total allocations/frees...: 37292/37292 +~~ total memory allocated....: 2449632 bytes +~~ total memory freed........: 2449632 bytes +~~ total allocations/frees...: 37293/37293 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/websocket.pcap.out b/test/results/websocket.pcap.out index 8d2db149e..1f689e514 100644 --- a/test/results/websocket.pcap.out +++ b/test/results/websocket.pcap.out @@ -18,7 +18,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1934107 bytes -~~ total memory freed........: 1934107 bytes -~~ total allocations/frees...: 35334/35334 +~~ total memory allocated....: 1934733 bytes +~~ total memory freed........: 1934733 bytes +~~ total allocations/frees...: 35335/35335 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/wechat.pcap.out b/test/results/wechat.pcap.out index 6ee724642..0999c5f09 100644 --- a/test/results/wechat.pcap.out +++ b/test/results/wechat.pcap.out @@ -1315,7 +1315,7 @@ ~~ total detected protocols..: 86 ~~ total active/idle flows...: 127/127 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2787020 bytes -~~ total memory freed........: 2787020 bytes +~~ total memory allocated....: 2768084 bytes +~~ total memory freed........: 2768084 bytes ~~ total allocations/frees...: 37989/37989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/weibo.pcap.out b/test/results/weibo.pcap.out index 98001093c..f64e74d32 100644 --- a/test/results/weibo.pcap.out +++ b/test/results/weibo.pcap.out @@ -350,7 +350,7 @@ ~~ total detected protocols..: 23 ~~ total active/idle flows...: 44/44 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2080864 bytes -~~ total memory freed........: 2080864 bytes -~~ total allocations/frees...: 35980/35980 +~~ total memory allocated....: 2079138 bytes +~~ total memory freed........: 2079138 bytes +~~ total allocations/frees...: 35981/35981 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/whatsapp_login_call.pcap.out b/test/results/whatsapp_login_call.pcap.out index 8200e9518..5fe030f70 100644 --- a/test/results/whatsapp_login_call.pcap.out +++ b/test/results/whatsapp_login_call.pcap.out @@ -558,7 +558,7 @@ ~~ total detected protocols..: 40 ~~ total active/idle flows...: 63/63 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2765823 bytes -~~ total memory freed........: 2765823 bytes -~~ total allocations/frees...: 36849/36849 +~~ total memory allocated....: 2185110 bytes +~~ total memory freed........: 2185110 bytes +~~ total allocations/frees...: 36776/36776 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/whatsapp_login_chat.pcap.out b/test/results/whatsapp_login_chat.pcap.out index f39e68db0..44be66cd4 100644 --- a/test/results/whatsapp_login_chat.pcap.out +++ b/test/results/whatsapp_login_chat.pcap.out @@ -87,7 +87,7 @@ ~~ total detected protocols..: 8 ~~ total active/idle flows...: 10/10 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1963987 bytes -~~ total memory freed........: 1963987 bytes -~~ total allocations/frees...: 35447/35447 +~~ total memory allocated....: 1964165 bytes +~~ total memory freed........: 1964165 bytes +~~ total allocations/frees...: 35448/35448 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/whatsapp_voice_and_message.pcap.out b/test/results/whatsapp_voice_and_message.pcap.out index 2353f1499..e8f95428a 100644 --- a/test/results/whatsapp_voice_and_message.pcap.out +++ b/test/results/whatsapp_voice_and_message.pcap.out @@ -165,7 +165,7 @@ ~~ total detected protocols..: 8 ~~ total active/idle flows...: 13/13 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1990643 bytes -~~ total memory freed........: 1990643 bytes -~~ total allocations/frees...: 35628/35628 +~~ total memory allocated....: 1990653 bytes +~~ total memory freed........: 1990653 bytes +~~ total allocations/frees...: 35629/35629 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/whatsappfiles.pcap.out b/test/results/whatsappfiles.pcap.out index d042e2da4..9a9b9ddbe 100644 --- a/test/results/whatsappfiles.pcap.out +++ b/test/results/whatsappfiles.pcap.out @@ -46,7 +46,7 @@ ~~ total detected protocols..: 2 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1958391 bytes -~~ total memory freed........: 1958391 bytes -~~ total allocations/frees...: 35961/35961 +~~ total memory allocated....: 1959017 bytes +~~ total memory freed........: 1959017 bytes +~~ total allocations/frees...: 35962/35962 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/wireguard.pcap.out b/test/results/wireguard.pcap.out index a7e8f0277..fc817b01a 100644 --- a/test/results/wireguard.pcap.out +++ b/test/results/wireguard.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1996277 bytes -~~ total memory freed........: 1996277 bytes -~~ total allocations/frees...: 37723/37723 +~~ total memory allocated....: 1996959 bytes +~~ total memory freed........: 1996959 bytes +~~ total allocations/frees...: 37724/37724 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/youtube_quic.pcap.out b/test/results/youtube_quic.pcap.out index b05931316..883e03b08 100644 --- a/test/results/youtube_quic.pcap.out +++ b/test/results/youtube_quic.pcap.out @@ -59,7 +59,7 @@ ~~ total detected protocols..: 3 ~~ total active/idle flows...: 3/3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1941551 bytes -~~ total memory freed........: 1941551 bytes -~~ total allocations/frees...: 35622/35622 +~~ total memory allocated....: 1942121 bytes +~~ total memory freed........: 1942121 bytes +~~ total allocations/frees...: 35623/35623 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/youtubeupload.pcap.out b/test/results/youtubeupload.pcap.out index 9bab8c673..ea5bc5175 100644 --- a/test/results/youtubeupload.pcap.out +++ b/test/results/youtubeupload.pcap.out @@ -61,7 +61,7 @@ ~~ total detected protocols..: 3 ~~ total active/idle flows...: 3/3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1947407 bytes -~~ total memory freed........: 1947407 bytes -~~ total allocations/frees...: 35488/35488 +~~ total memory allocated....: 1947977 bytes +~~ total memory freed........: 1947977 bytes +~~ total allocations/frees...: 35489/35489 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/z3950.pcapng.out b/test/results/z3950.pcapng.out index f94adaf48..bd471a7c2 100644 --- a/test/results/z3950.pcapng.out +++ b/test/results/z3950.pcapng.out @@ -43,7 +43,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 2/2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1941222 bytes -~~ total memory freed........: 1941222 bytes -~~ total allocations/frees...: 35362/35362 +~~ total memory allocated....: 1941848 bytes +~~ total memory freed........: 1941848 bytes +~~ total allocations/frees...: 35363/35363 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/zabbix.pcap.out b/test/results/zabbix.pcap.out index c5af617c9..b4b970b0f 100644 --- a/test/results/zabbix.pcap.out +++ b/test/results/zabbix.pcap.out @@ -20,7 +20,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1926996 bytes -~~ total memory freed........: 1926996 bytes -~~ total allocations/frees...: 35334/35334 +~~ total memory allocated....: 1927678 bytes +~~ total memory freed........: 1927678 bytes +~~ total allocations/frees...: 35335/35335 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/zcash.pcap.out b/test/results/zcash.pcap.out index f68e581e5..b6c20140a 100644 --- a/test/results/zcash.pcap.out +++ b/test/results/zcash.pcap.out @@ -25,7 +25,7 @@ ~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 1941167 bytes -~~ total memory freed........: 1941167 bytes -~~ total allocations/frees...: 35472/35472 +~~ total memory allocated....: 1941849 bytes +~~ total memory freed........: 1941849 bytes +~~ total allocations/frees...: 35473/35473 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/test/results/zoom.pcap.out b/test/results/zoom.pcap.out index 844b4b5e0..0610acc70 100644 --- a/test/results/zoom.pcap.out +++ b/test/results/zoom.pcap.out @@ -115,7 +115,7 @@ 00437{"flow_id":14,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":82,"source":"zoom.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569520469,"pkt_ts_usec":423520,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8wZVAAC4R\/\/Ci\/yYOwKgBdQ2XXV8AKOE+AAIADMFdrmNYXRQ5LlgsJgQDvzABAwAIAAH\/dVC03O8="} 00449{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":83,"source":"zoom.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1569520469423,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"162.255.38.14","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} 00430{"flow_id":17,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":83,"source":"zoom.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569520469,"pkt_ts_usec":423595,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA4WycAAEABlHPAqAF1ov8mDgMDkd4AAAAARQAAPMGVQAAuEf\/wov8mDsCoAXUNl11fACgAAA=="} -00486{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":83,"source":"zoom.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1569520469423,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"162.255.38.14","l4_proto":"icmp","ndpi": {"proto":"ICMP.Zoom","breed":"Acceptable","category":"Network"}} +00505{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":83,"source":"zoom.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1569520469423,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"162.255.38.14","l4_proto":"icmp","ndpi": {"entropy":4.182005,"proto":"ICMP.Zoom","breed":"Acceptable","category":"Network"}} 00436{"flow_id":14,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":86,"source":"zoom.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569520469,"pkt_ts_usec":433682,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8wZlAAC4R\/+yi\/yYOwKgBdQ2XXV8AKOE+AAIADMFdrmNYXRQ5LlgsJgQDvzABAwAIAAH\/dVC03O8="} 00430{"flow_id":17,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":87,"source":"zoom.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569520469,"pkt_ts_usec":433729,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA4ZPoAAEABiqDAqAF1ov8mDgMDkd4AAAAARQAAPMGZQAAuEf\/sov8mDsCoAXUNl11fACgAAA=="} 00499{"flow_id":15,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":88,"source":"zoom.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569520469,"pkt_ts_usec":435372,"pkt_caplen":121,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":121,"pkt_l4_len":87,"pkt":"KDc3AG3IEBMx8Tl2CABFAABrxSZAADUGFFhox0EqwKgBdQBQ0mtWiVx4p7jr14AYACoQ6AAAAQEICrPWHxMlnNteHG23tdrG8DG+h7r8Zxtz7MQCNVJFwwvVnv58rFQctE3+7OM+9UUQVY5R6JQAaaN6AcizUZjVWQ=="} @@ -369,7 +369,7 @@ ~~ total detected protocols..: 29 ~~ total active/idle flows...: 33/33 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 2271086 bytes -~~ total memory freed........: 2271086 bytes -~~ total allocations/frees...: 36202/36202 +~~ total memory allocated....: 2269976 bytes +~~ total memory freed........: 2269976 bytes +~~ total allocations/frees...: 36203/36203 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |