Use layer4 specific flow timeouts.

 * default values "stolen" from nf_conntrack

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 96 insertions, 96 deletions

diff --git a/test/results/alexa-app.pcapng.out b/test/results/alexa-app.pcapng.out
index 85fefc6b5..4ee866771 100644
--- a/test/results/alexa-app.pcapng.out
+++ b/test/results/alexa-app.pcapng.out
@@ -1,4 +1,4 @@
-00388{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"alexa-app.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
+00479{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"alexa-app.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
 00334{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976022,"pkt_ts_usec":526783,"pkt_caplen":20,"pkt_type":6,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":20,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/ePiC0\/vCAAYAAa+BAQA="}
 00148{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":1,"source":"alexa-app.pcapng","alias":"nDPId-test","type":6}
 00334{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976022,"pkt_ts_usec":526847,"pkt_caplen":20,"pkt_type":6,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":20,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/ePiC0\/vCAAYAAa+BAQA="}
@@ -667,6 +667,8 @@
 00415{"flow_id":54,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":763,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976048,"pkt_ts_usec":863911,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AMDKkaPvePiC0\/vCCABFAAAoQ41AAEAGA3asECrYNF7ohrJzAbuRhBRe6ucB81ARAVdzwwAA"}
 00424{"flow_id":54,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":776,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976048,"pkt_ts_usec":926772,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAoWpFAAOcGRXE0XuiGrBAq2AG7snPq5wHzkYQUX1ARf\/f1IQAAAAAAAAAA"}
 00415{"flow_id":54,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":778,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976048,"pkt_ts_usec":927819,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AMDKkaPvePiC0\/vCCABFAAAoQ45AAEAGA3WsECrYNF7ohrJzAbuRhBRf6ucB9FAQAVdzwgAA"}
+00446{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":780,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1490976022741,"flow_last_seen":1490976022741,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15}
+00455{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":780,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1490976022731,"flow_last_seen":1490976022731,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ffd3:fbc2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15}
 00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":780,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_first_seen":1490976054009,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45687,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00442{"flow_id":58,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":780,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976054,"pkt_ts_usec":9715,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AMDKkaPvePiC0\/vCCABFAAA8L1JAAEAGF52sECrYNF7ohrJ3AbtDNXw1AAAAAKAC\/\/+MNwAAAgQFtAQCCAoA9lNnAAAAAAEDAwg="}
 00426{"flow_id":58,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":781,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976054,"pkt_ts_usec":70557,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAwt0ZAAOcG6LM0XuiGrBAq2AG7snc6VHcpQzV8NnASH\/5LIgAAAgQFtAEDAwY="}
@@ -727,6 +729,9 @@
 00423{"flow_id":61,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":832,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976058,"pkt_ts_usec":295971,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAoRulAANsGMlU27xi6rBAq2AG7hPl2s2wjPxDJfFAQAbQVdwAAAAAAAAAA"}
 00954{"flow_id":61,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":833,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976058,"pkt_ts_usec":310272,"pkt_caplen":449,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":449,"pkt_l4_len":415,"pkt":"ePiC0\/vCAMDKkVoBCABFAAGzRupAANsGMMk27xi6rBAq2AG7hPl2s2wjPxDJfFAYAbRfGQAAFwMDAYYujMIFuLizeQ4nSXSVL9qZytKOfIpxYUUDGWDQawdyHZKqojphbkEb9ji3V36Ni3FzDQ6ZI5H\/LQFzlV2XIx1aKRAsDd3VNAuoijGL9SXN+BdtCE1TPVcNRsmt9OTPDXh4iITtxYbu0h0C\/OYuwvc49zNSfZCFOPjriu481PcjMBbBKmH2uL4Z09IYZyBxKqWtG7tXjsZdTBFRX8P7PmIii8XphTVdZVKjSTxpAp2G4aMbegiSPo1tZg3CdNZxxewHpUfFmVoc1uScxZCzFlTFtSdfSWMn\/iXZOWx1ti18G0RDXlVt94vfvi++W8LysqmWxssCzq8pZpLkUZNrXu+nXB6mTNLl4Ch4KG7RJIyhguDJv2vUrEO6CP7+wplPfyD00RxHpMugImElKQNBo+Qkt0WE\/D0QCJBzIYhcTcDqNkS3AJT+\/xF\/Ruq\/pS8zt94EyxkKvYil37VacwvRDQU39nnVa32G3eeZC6WuoTXBw+FFgM2BYb9LQu6OP80LYUCiCnlvN\/M="}
 00431{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":842,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":59,"flow_packet_id":1,"flow_first_seen":1490976055356,"flow_last_seen":0,"flow_tot_l4_data_len":8,"flow_min_l4_data_len":8,"flow_max_l4_data_len":8,"flow_avg_l4_data_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"224.0.0.1","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
+00461{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":842,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1490976027958,"flow_last_seen":1490976030758,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":60,"flow_max_l4_data_len":60,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.1","dst_ip":"172.16.42.216","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15}
+00470{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":842,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1490976032763,"flow_last_seen":1490976032763,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::7af8:82ff:fed3:fbc2","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15}
+00468{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":842,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":5,"flow_packet_id":6,"flow_first_seen":1490976023731,"flow_last_seen":1490976031750,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::7af8:82ff:fed3:fbc2","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15}
 00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":843,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":62,"flow_packet_id":1,"flow_first_seen":1490976064328,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"72.21.206.135","src_port":42148,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00444{"flow_id":62,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":843,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976064,"pkt_ts_usec":328375,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AMDKkaPvePiC0\/vCCABFAAA88S5AAEAGXAisECrYSBXOh6SkAbuyb6ZBAAAAAKAC\/\/8DBAAAAgQFtAQCCAoA9ldvAAAAAAEDAwg="}
 00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":846,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":63,"flow_packet_id":1,"flow_first_seen":1490976064333,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":44475,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
@@ -1269,7 +1274,6 @@
 00417{"flow_id":100,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1526,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976094,"pkt_ts_usec":731542,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AMDKkaPvePiC0\/vCCABFAAAo8bhAAEAGXNqsECrYsCBlNKvhAbv82ZQ2gXVMHlAQAW216QAA"}
 00417{"flow_id":100,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1527,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976094,"pkt_ts_usec":732206,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AMDKkaPvePiC0\/vCCABFAAAo8blAAEAGXNmsECrYsCBlNKvhAbv82ZQ2gXVOAFAQAXmz+wAA"}
 00588{"flow_id":100,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1528,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976094,"pkt_ts_usec":742222,"pkt_caplen":180,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":180,"pkt_l4_len":146,"pkt":"AMDKkaPvePiC0\/vCCABFAACm8bpAAEAGXFqsECrYsCBlNKvhAbv82ZQ2gXVOAFAYAXm2wAAAFgMDAEYQAABCQQTckZsd8+RkJuResgaQkK5Mcc05joYp36isSPV1sAa1yemGa4THFw80p6P6KN15VMfq3SViqxH31nD0WeDHJsEsFAMDAAEBFgMDACgAAAAAAAAAAGopQvnydwKwwVYbSE9q3k9HY9HgvpLHXtXC1bca0c0e"}
-00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1529,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":22,"flow_packet_id":10,"flow_first_seen":1490976031691,"flow_last_seen":1490976032855,"flow_tot_l4_data_len":2382,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1366,"flow_avg_l4_data_len":238,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":49572,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00426{"flow_id":100,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1530,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976094,"pkt_ts_usec":926975,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAoMwpAAOcGdIiwIGU0rBAq2AG7q+GBdU4A\/NmUNlAQASy0SAAAAAAAAAAA"}
 00424{"flow_id":94,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1534,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976094,"pkt_ts_usec":927120,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAocVhAAOcGLqo0XuiGrBAq2ABQwd5KW8HzIbEJP1ARAH\/CGQAAAAAAAAAA"}
 00427{"flow_id":98,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1536,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976094,"pkt_ts_usec":927183,"pkt_caplen":61,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":61,"pkt_l4_len":27,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAvXMBAAOcG4OA250hYrBAq2AG7o117lZ80ZBSwSlAYADpuIQAAFQAAAAIBAA=="}
@@ -1332,27 +1336,6 @@
 00425{"flow_id":102,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1647,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976102,"pkt_ts_usec":188247,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAonQpAANsG3DM27xi6rBAq2AG7hRpDnUU1f0lvBVAQAYiJxAAAAAAAAAAA"}
 00445{"flow_id":31,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1657,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976104,"pkt_ts_usec":573475,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AMDKkaPvePiC0\/vCCABFAAA8G7RAAEAGvmWsECrYCsl+8Z0IH5CvoFXQAAAAAKAC\/\/+9NAAAAgQFtAQCCAoA9mcoAAAAAAEDAwg="}
 00445{"flow_id":40,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1658,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976104,"pkt_ts_usec":800373,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AMDKkaPvePiC0\/vCCABFAAA8WzhAAEAGfuGsECrYCsl+8Z0KH5BhrRWqAAAAAKAC\/\/9LNAAAAgQFtAQCCAoA9mdAAAAAAAEDAwg="}
-00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":46,"flow_packet_id":11,"flow_first_seen":1490976044439,"flow_last_seen":1490976046418,"flow_tot_l4_data_len":2423,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1016,"flow_avg_l4_data_len":220,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":49589,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":28,"flow_packet_id":32,"flow_first_seen":1490976041156,"flow_last_seen":1490976043655,"flow_tot_l4_data_len":11044,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":345,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45661,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":29,"flow_packet_id":18,"flow_first_seen":1490976041384,"flow_last_seen":1490976042405,"flow_tot_l4_data_len":2759,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1118,"flow_avg_l4_data_len":153,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45662,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":30,"flow_packet_id":18,"flow_first_seen":1490976041400,"flow_last_seen":1490976042398,"flow_tot_l4_data_len":2791,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1150,"flow_avg_l4_data_len":155,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45663,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":44,"flow_packet_id":26,"flow_first_seen":1490976044189,"flow_last_seen":1490976046415,"flow_tot_l4_data_len":6933,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1198,"flow_avg_l4_data_len":266,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45673,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":45,"flow_packet_id":24,"flow_first_seen":1490976044219,"flow_last_seen":1490976046417,"flow_tot_l4_data_len":6925,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1214,"flow_avg_l4_data_len":288,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45674,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":47,"flow_packet_id":22,"flow_first_seen":1490976044488,"flow_last_seen":1490976046418,"flow_tot_l4_data_len":4870,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1166,"flow_avg_l4_data_len":221,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45676,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":48,"flow_packet_id":17,"flow_first_seen":1490976044502,"flow_last_seen":1490976046415,"flow_tot_l4_data_len":2771,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1150,"flow_avg_l4_data_len":163,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45677,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":49,"flow_packet_id":14,"flow_first_seen":1490976044509,"flow_last_seen":1490976046418,"flow_tot_l4_data_len":744,"flow_min_l4_data_len":20,"flow_max_l4_data_len":259,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45678,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":50,"flow_packet_id":13,"flow_first_seen":1490976044521,"flow_last_seen":1490976046418,"flow_tot_l4_data_len":724,"flow_min_l4_data_len":20,"flow_max_l4_data_len":259,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45679,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":37,"flow_packet_id":78,"flow_first_seen":1490976041942,"flow_last_seen":1490976046399,"flow_tot_l4_data_len":43981,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":563,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.216","src_port":54411,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":38,"flow_packet_id":17,"flow_first_seen":1490976041961,"flow_last_seen":1490976042341,"flow_tot_l4_data_len":6241,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":367,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.216","src_port":54412,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00527{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":39,"flow_packet_id":6,"flow_first_seen":1490976042054,"flow_last_seen":1490976042398,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.216","src_port":54413,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
-00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":39,"flow_packet_id":6,"flow_first_seen":1490976042054,"flow_last_seen":1490976042398,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.216","src_port":54413,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":42,"flow_packet_id":29,"flow_first_seen":1490976043814,"flow_last_seen":1490976046408,"flow_tot_l4_data_len":10991,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":379,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"72.21.206.135","src_port":42129,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":43,"flow_packet_id":32,"flow_first_seen":1490976043814,"flow_last_seen":1490976046401,"flow_tot_l4_data_len":11707,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":365,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"72.21.206.135","src_port":42130,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":36,"flow_packet_id":25,"flow_first_seen":1490976041870,"flow_last_seen":1490976042512,"flow_tot_l4_data_len":7430,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":297,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34019,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1490976041434,"flow_last_seen":1490976041437,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"192.168.11.1","src_port":38391,"dst_port":8080,"l4_proto":"tcp","ndpi": {"proto":"HTTP_Proxy","breed":"Acceptable","category":"Web"}}
-00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1490976041434,"flow_last_seen":1490976041437,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"192.168.11.1","src_port":38391,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":25,"flow_packet_id":24,"flow_first_seen":1490976035553,"flow_last_seen":1490976036358,"flow_tot_l4_data_len":6484,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":270,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"34.199.52.240","src_port":38363,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":26,"flow_packet_id":18,"flow_first_seen":1490976037754,"flow_last_seen":1490976042398,"flow_tot_l4_data_len":3903,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":216,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"34.199.52.240","src_port":38364,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1490976107217,"flow_last_seen":0,"flow_tot_l4_data_len":49,"flow_min_l4_data_len":49,"flow_max_l4_data_len":49,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":14476,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00456{"flow_id":104,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976107,"pkt_ts_usec":217569,"pkt_caplen":83,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":83,"pkt_l4_len":49,"pkt":"AMDKkaPvePiC0\/vCCABFAABFWlxAAEARM1KsECrYrBAqATiMADUAMXUjXSIBAAABAAAAAAAADHNraWxscy1zdG9yZQZhbWF6b24DY29tAAABAAE="}
 00652{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1659,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1490976107217,"flow_last_seen":0,"flow_tot_l4_data_len":49,"flow_min_l4_data_len":49,"flow_max_l4_data_len":49,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":14476,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Amazon","breed":"Acceptable","category":"Web"},"dns": {"query":"skills-store.amazon.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
@@ -1539,14 +1522,6 @@
 00446{"flow_id":84,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1958,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976116,"pkt_ts_usec":960511,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AMDKkaPvePiC0\/vCCABFAAA8m\/pAAEAGPh+sECrYCsl+8Z0yH5CNbMQpAAAAAKAC\/\/9sDQAAAgQFtAQCCAoA9mwAAAAAAAEDAwg="}
 00423{"flow_id":117,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1959,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976117,"pkt_ts_usec":4804,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAoj3VAANsG6c427xi0rBAq2AG7krCs\/eb7YAHS2lARARws6wAAAAAAAAAA"}
 00415{"flow_id":117,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1960,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976117,"pkt_ts_usec":5965,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AMDKkaPvePiC0\/vCCABFAAAouXNAAEAGWtGsECrYNu8YtJKwAbtgAdLarP3m\/FAQAVcssAAA"}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1967,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":51,"flow_packet_id":29,"flow_first_seen":1490976046418,"flow_last_seen":1490976048924,"flow_tot_l4_data_len":10393,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1214,"flow_avg_l4_data_len":358,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45680,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1967,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":54,"flow_packet_id":15,"flow_first_seen":1490976047096,"flow_last_seen":1490976048927,"flow_tot_l4_data_len":902,"flow_min_l4_data_len":20,"flow_max_l4_data_len":259,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45683,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1967,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":58,"flow_packet_id":19,"flow_first_seen":1490976054009,"flow_last_seen":1490976055604,"flow_tot_l4_data_len":3973,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1166,"flow_avg_l4_data_len":209,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45687,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1967,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":55,"flow_packet_id":21,"flow_first_seen":1490976047560,"flow_last_seen":1490976048909,"flow_tot_l4_data_len":9156,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":436,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.216","src_port":54427,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1967,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":56,"flow_packet_id":22,"flow_first_seen":1490976047563,"flow_last_seen":1490976048928,"flow_tot_l4_data_len":6132,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":278,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"72.21.206.135","src_port":42143,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1967,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":57,"flow_packet_id":23,"flow_first_seen":1490976047858,"flow_last_seen":1490976048917,"flow_tot_l4_data_len":5019,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":218,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"72.21.206.135","src_port":42144,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1967,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":52,"flow_packet_id":25,"flow_first_seen":1490976047014,"flow_last_seen":1490976048924,"flow_tot_l4_data_len":7330,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":293,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34033,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1967,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":53,"flow_packet_id":43,"flow_first_seen":1490976047050,"flow_last_seen":1490976048924,"flow_tot_l4_data_len":23419,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":544,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34034,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00770{"flow_id":116,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1967,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976118,"pkt_ts_usec":107055,"pkt_caplen":313,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":313,"pkt_l4_len":279,"pkt":"AMDKkaPvePiC0\/vCCABFAAErJUlAAEAG7fisECrYNu8YtJKvAbsZEE7UqkY3+lAYAVdXdAAAFgMBAP4BAAD6AwPrW9HSsEakj6mtt\/VNcOse9OO4StwA3f8PEsza4rC61SAK8IS3HVgGOc2sZcVp0kAKYJvK21\/4JhIPoGYmpJU7LgAg6urMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACR2toAAP8BAAEAAAAALAAqAAAnbW9iaWxlYW5hbHl0aWNzLnVzLWVhc3QtMS5hbWF6b25hd3MuY29tABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEABQAFAQAAAAAAEgAAABAADgAMAmgyCGh0dHAvMS4xAAsAAgEAAAoACgAIWloAHQAXABjKygABAA=="}
 00424{"flow_id":116,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1968,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976118,"pkt_ts_usec":335076,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAoiX5AANsG78U27xi0rBAq2AG7kq+qRjf6GRBP11AQASyoigAAAAAAAAAA"}
 00630{"flow_id":116,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1969,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976118,"pkt_ts_usec":335216,"pkt_caplen":210,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":210,"pkt_l4_len":176,"pkt":"ePiC0\/vCAMDKkVoBCABFAADEiX9AANsG7yg27xi0rBAq2AG7kq+qRjf6GRBP11AYASwooQAAFgMDAGQCAABgAwNZS3nfHykATu3CC7mmoc0bUWm9K4e9z4q18mgLdytBOSAK8IS3HVgGOc2sZcVp0kAKYJvK21\/4JhIPoGYmpJU7LsAvAAAY\/wEAAQAABQAAABAACwAJCGh0dHAvMS4xFAMDAAEBFgMDACjewnNSd4iq4yrAhkxqFaRy27cheBPD04w9zfg+PVa226nC0Bx\/D34+"}
@@ -1558,10 +1533,6 @@
 02404{"flow_id":116,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1974,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976118,"pkt_ts_usec":436142,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"AMDKkaPvePiC0\/vCCABFAAXcJU1AAEAG6UOsECrYNu8YtJKvAbsZEFW+qkY4llAQAVuApgAAefZ3E5R4ptFDhrqiuqKQ0arcfcySBzOVFDD8D7x8tO8IqVOwmRMdlwxU8Q7eqMxfTk9EXeEqZG69TDXtXwcYCteDADsO\/pOCwcF8zPAqMc7udl1QUufQiSRy+bMy7tsSYQayZjU+ETw6XpcFH\/MINKZda5Ry8qTRDYWkuVqYXSaGlepAQ2Otyzpopwc5Y+DJeDq8nlfPJaaKjKKzljuGMukEPIE4F5GAgl\/Wl22H9kp+BxGb5bP5U\/lQPCh\/rppuVDAN6x6VD4GwYSsqFkCmGL8y787lhLjne\/th2r\/hyHdbmtlUN\/pDIx4Db5AsWS2iViwFyBbOHrDUXwuVLN9Lk0FgEWy6J4LHYtTlBw\/LZzwBbdDO1U4+Aqc8FaXdskutGqs\/5hjrhV6TetzTRCJ8wPbOfLIDK0N6Q3hbIHeVcbCgi6gjvKMGdEzOQxwyKk6H1NARGdy5V0r3aGFHoSklmCBcGyAezxpdQEsj\/xVcj2wI1e83jPOV4p2cL\/+lB9Ws+yT9IeL3Udq2mt8mbAbyMTTPZHsKW2wGAzYR1eQqaTXW7w6bbowdDJK2oPnSnI4sET72GaRTRc7ntU2WDE0QrjYcz4gYGACGWS42NqeeSp0ZixGfeTndUiiFSG2oq8pA9BrQH0IqT7Adtgb+dAtgvJ5BwX0ThAg6gvyjTkWT6xjQiRgslR4v5fjpCzTcmztcl3LOUxb5Kd4mFgfzX9AOXih09iPZ97cB5UMPpBuu5R0JvAQ7F1yBmOT5EqhGpADsS8qlu5ISWy\/BEHl6YF3butsFWiDRYyjo4vgyvjgKfhj4FQnIFe077blHQSGDticu5lzLFeg+yGWkFUWK2Dt9eDlEseS\/M4aa051gIpSn52C+uR3Vr3Y128QfrCsZsS8IQJvofRbMXMbF7eHV3xnFiYm+K6Dx1R25FXm4ZVMQ\/KNPSBkY6zk4osif3YhbDpK+bdxpJpzMdKJ7Na6\/fDHJgsDin1u9GEmLh897wAtREFn7Gnh4ZM9dB5DXq0+f\/ZFBXhPVH16Ma\/Gm21zuvPl1jkVVR90ahqVG+DE1JUN6bbeO1BLH4qYwhuAiFgGJAqDWto8yJFjXlcuoOqoYGllzcJeWiA8Ld8iph18HLEJgwTk7J+KdPMi8mdF9RaLe\/lbq3ZGj5thKeFFk8piTb04s+ysXvjIyo4P59HB26eH8vkQXKddypMjjY1CRcLezGKC6sqPooPLixBS5Dttv6W3iEgFLgsNWvpPW84IFfEg6yoXvTE5DR2bv5AlkYUasHF7UB3A3G9c4Lit6A\/72c9vB7GuA\/2Amem34vRruJ7\/iCpCQN4a8A1MWiqDsuDP9JPBD\/L0bV7xajJaI7t\/8XICiWiBexYbrIkVUmJJ2Gj\/4x+1pGcC4O+4eRQm0XYhP6kFEgTZK3S07T2P26Nb+5H4xBnmK7PU91msb4mfgwVVZ9qZq3tL+gcFq19tb24Lw5VuC+C\/l8gtt\/eE3vYV5AbrClNHw4uddlTzj6B+ih\/9os0U8SqnAP+BeRLz6R1MVqe42\/hUSd1S6up5cTn2Y7CcXpFjy8D+1nQCAReoAqxFs2aRB3T16o5U+hqTp6a12XsmAuN8ixazHD13j2DgSyJu7TDC2yPTIleVYenBf7qZhVqAb9uWTUvVVtDyGfWcTTJVI64oeYd87p5oO3jxD6HCgFPsnTklm7Txfuh\/cJNZVPr6msIVINVPEFd8afVgfnkcgS3PmVQ2PG6vADg55CR1Z\/7pQyIgumH+d\/74OHgQ1RAHKloo4UfPzgeb4XUqQymbrH8iMEXQJOCbUpCilIONhsAJsobY5hsfd4+ROH8H0kVe0k1WP5YcAjRcDAwFFAAAAAAAAAAKrYYEDMqGj8xcllxPaJCK05D8YW9ItB4n\/Y0ftzso+NbL8O4ykvj96hnStE2QwSjA0dn8ockcVAZgQIzG3CGs="}
 00766{"flow_id":116,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1975,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976118,"pkt_ts_usec":436432,"pkt_caplen":308,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":308,"pkt_l4_len":274,"pkt":"AMDKkaPvePiC0\/vCCABFAAEmJU5AAEAG7fisECrYNu8YtJKvAbsZEFtyqkY4llAYAVv26gAA8+MNFYinlBYjQ2Hj+t5wnhQlPi7Yzs44ocg4KG8IYqYc2GsURXaQW3BxKhWmcrGGN1WrTL43aw8nQfqeyFJ2UnsewknXI3JUNb\/7zlE998ToBOvb0Fl51wDtWY12H7KtoirKF\/YtRoZrnWS25hU5OICuJTWvnuwuixEEo\/z2nl5kdU321VNOzko3h9OrjraSd7TggyYO1vJF+SyaPIUHr0fnQkPB+mw62cXDU2zAsberg0Xw\/ERPF4fjd0a\/lsp60Tp+ltbxoMbBMwZy0yLWeZpDs76v+c6a8eZuM71USibf+Hsy5N8vsZORZy9ckRo2Gbi7aMKsp4n\/ZF+ZTsc="}
 02403{"flow_id":114,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1977,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976118,"pkt_ts_usec":540723,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"AMDKkaPvePiC0\/vCCABFAAXcCntAAEAGNtSsECrYNF7ohrKkAbvN5GJyckqsG1AQAVeaNAAAFwMBACCVAsolemIjTXyS\/AxBEL4EvwJ0AgReq+\/dnJ7py5eTpBcDAQZg6xglvGF9hWSdTgHU8J\/p7kC5Mb8Tnz1hzpxpzlSgY9JlhHfddFP0jIAckhlAB8bvDSzSkQOZC9Fwi333Ne2dMboIPIOxSnecNT6oQ3aZGWtoFqVKqPppEL06xLeMyQniid4tFddV264EfoQ\/ki1knEIczVHC371xWjSuvj05y5GWQwpM\/eCB6hqpM9R6hTsTAgihjOAke+CaFu8zCJXg0qNGqKDuA9D3QmzGz8RiD95u2a4kLOpoKEYHHAfTt3bAAvzsqB144p\/+TcHGpqAARQ2K1pp6OdFw+onGNERmDE\/bCJVYXS\/4HHc2JWCDqqMv84+DkviL91ZhESecn5c+FbWCymc0tIc2BNRNI6HdT2lu0sZ+SF6YHekt7iE\/MrOpllBQzCOzQ0Z3V6vLTPF7I+8MTMY6nTj\/JBcyTgOv3PVXXwoJF0f11WA9nRWsNXcK7BDtDbeYRbezBxAvhT08lqHUQd3LogQ3IPc\/abAtJWARzlBYR60cwuIbt3yjlf54qegoswcMJajxXn3FGZCKM\/h89BL1TZVuyFRtzm7xycs+93JVOo\/6hkCxqsO2QPxjeBchB\/tKyXpF8p3JQbTKxMaqqnZC2afJhwGp1rOHeciCyzhzcfoPKxTQEy7WSNtLZi5lMDj9NEGGolQ2e+c6wRBHu8BDwUSl2fPQfX8UBR6W3HXzcZwoNIeVVPmyd67QYZ6NOAGyofuw3t6q6VjwvVo7LI03Sf1lf8yEhphtQlZkNCY8RCXmPsss1ZQBJpldyUhCe1NKxbKpZRItFmefB3+Xh63oiT+nBgfxA4DTAiNi03XR8ePUL\/tVowuXzjNFka8RKvcK9BzZ+y\/iZ\/Xbgc8LI7AQs\/PUUiv1aeWIMBz1bGDKREUSJkSzhaX4uK+5EyCv27gSOkXKdFOOBtL6xYLLGtkFtXS\/pKJ2pI2CRZTKQNX\/cmoM+zEOjMR1PSSOluAESi9nO7yn92OLlaHXThyMsBSIq3rzh6rpBn1tE54aUFgbUCzum29kq9X2\/oAUrOUGIHrn+TEGip691opUerDj2btsgPahiMwnnM2S93HIAEmb3\/JaNbyugRJXSwNSVjnv84prJWkSIJeXOEbVaoMkNKfCQm8uYoxdDgv5HGSJ444Nskh08mq2cqmu\/zKf2DoEMk5PLByuURgUJalOd96QvF0yIFwTBQxuS+3KgljqKRqkkLDnR0r56NYqS5bRegdSuJlD3tmC+sfloI1QL0CANyIwycjklamgHPCdbPo+TL0JGxdDZNnsdAqRFqJ+qUMunJ5IVAI1puEvtaGAy0FlMqd5QWLzXyGttSz85GAbRL1paJxLbxnJznsw\/IG6MJQou2oqwjehxe2S0SUHZZxjo99oyq2zNWbdMcEp0Igt3vpdr0blYcbSxoyuHN3L1OnaIVJ0WTMfxCwfwqUwtPOr\/0oLdY7uE+Mkv0CazNXtdrSgFzqhxm3Xgq45cpgOOeBqy4v7TH\/ES24L69+NbLx8zCoDlHetHIXID8dU8p\/tKex\/X13\/VCHG8+6O2UEUd\/8evInUmNUCU60M0bvZhdxjm\/bo6Kz7iQ6P+qLaVapSr6UgbCYBRfk5Ccw6J6DeY3S9TdCPYauFCZVHAYuY6sWH1j73+OQPmnZyJARMqEHeKdsi3qy76b+u00g\/BlkbH+QBndiz1rLj0szcV2Exmiu+LQVoeggSdFoEavdsy+JmkvU5C3pUQwjMF9bBB7XLgeqitfiFz1nmH99Z86v3SYNpONBBKQ0GfDzdxyERgLsZ7jvl7zCMl8Cc5swSowOld7XDDWiawIfMld2aDSCRGm717RlCE2SgZtqPna+jEcN+PTGFVpGN36EolG02mN1UpTT+b8viZzm7zpC89YNxU99QOQzmWDEh7Qg="}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2001,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":60,"flow_packet_id":20,"flow_first_seen":1490976057977,"flow_last_seen":1490976058806,"flow_tot_l4_data_len":5219,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":260,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45688,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2001,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":64,"flow_packet_id":33,"flow_first_seen":1490976064452,"flow_last_seen":1490976068180,"flow_tot_l4_data_len":18692,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":566,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.216","src_port":54434,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2001,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":62,"flow_packet_id":21,"flow_first_seen":1490976064328,"flow_last_seen":1490976064897,"flow_tot_l4_data_len":6078,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":289,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"72.21.206.135","src_port":42148,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2001,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":61,"flow_packet_id":19,"flow_first_seen":1490976058103,"flow_last_seen":1490976058813,"flow_tot_l4_data_len":5117,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":269,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34041,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2001,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":118,"flow_packet_id":1,"flow_first_seen":1490976130073,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40864,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00446{"flow_id":118,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2001,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976130,"pkt_ts_usec":73503,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AMDKkaPvePiC0\/vCCABFAAA8j51AAEAGf0qsECrYNu8d\/Z+gAbt6Gf6DAAAAAKAC\/\/+QHQAAAgQFtAQCCAoA9nEeAAAAAAEDAwg="}
 00431{"flow_id":118,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2002,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976130,"pkt_ts_usec":307042,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAww\/RAAOcGo\/427x39rBAq2AG7n6DOZIqUehn+hHASH\/7FQwAAAgQFtAEDAwY="}
@@ -1807,14 +1778,6 @@
 02413{"flow_id":132,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2405,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976139,"pkt_ts_usec":952977,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"ePiC0\/vCAMDKkVoBCABFAAXcG6FAAPIGHQY0VD84rBAq2ABQyx1XQcMqlNdIjoAQAHZqvwAAAQEICmz6gAsA9nTjS7sn0vxFaCG4\/cTvEJgFZlaKQIJEcEhkdT7V0iOkiCSNgysMqwOQRS17cYQgrRVj49tt6hRRRVCPLvGU32z4yagQcrZaBZxfRnluHI\/IJ+dLWfpt4Nb8TeIvFCtlL3W5Ircjp5duq24x7F4pG\/4FWhQB2fw+i2aK8n9+c\/oBW7Wb4St\/s3h+2UjllLn8ST\/KtKgAooooAKKKKAOG8b2X2TXXlC4WdQ4+vQ\/qP1rIrs\/Humm60tb6Nctbtk\/7p6\/0rjKANf4EaiIPD154Gmb97oF60MIPe1kJkgI9grGP6xGu5ryKLWB4H8aWPjV222U6jT9aPZYnb91Mf+uchwT2WVz2r12gArl\/i98TdN+FHgq48UXsYlmJEVja55nmbO1fpwSfYGuorwz48XLeKvj34e8HTjdZ6RpzahLGTw0jMQpI9iqfma8\/NMTPC4Ryp\/E2or1btf5b\/I8vOMXUweBcqXxyajHycna\/y1fyMTwz4D1DxDqR+IPxVl\/tHWrr51gnGYrReoRV6ZHp0H15PTa3r2geFtKl1rxJrVnptjbrma7vrlIYol9WZyAo+przX9srxl8RfCPwfsrD4S+IJ9J8Q+JvHXhrw3Y6pa2UVxNZR6jrNpaXNxHHKrxs8dtLPIpdWVSm5lIBFeS\/t1eGP2JP2Dx4N1P4s\/ss+MP2m\/iP421S4tvCGl+MrtNemVreNZZpkivM2tjGgdSRa24fL5CEKxHm4LLouDadu7erb7s8nLsrj7JuLtrq3q2+rb6nsnhz9rT9jr4saxL4D8I\/tL\/DbxHqHm+TNo+neMbC7m34zsMSSs27HbGa1LfUtf8A2ctY\/wCEp8IF7nw1eSAanpMshKwMeFkU8kDpz+BzkY\/OH9pH4x\/G74leH4vFX7Qf\/BB34E6l4fv7u3tNCstR0XV4NZjkmkWC2tobqHSDMtxK7JGg8u32uy9VG+vX\/wDglZ8Of2iLzxZ44g1nwj43+Gvwj021fQYfg78R\/GFv4hvtK1oeXJJ9kuY1BtrOKF4wsTMzM8rFvug0YzL4qn7ajO047Prft6Pquw8wyuKpe3oVLVI\/DLrft5p9U9LH6d+F9PtLmCLxTLqK6hc3kCul6FwgiYBgsS\/wJ09z1JJrR1LTrLV7CXTdRtkmgmQrJHIgYEfQgivLv2UvGdtJ8LYfDmvatBHdaZqkunQrNMFaTBDKq5PzH5sADsK9J8T65F4e8Oahrp2sbKyln2FvvbELY\/SvXwGJhVwkK8dLpP0fX8T3srl9ewVKpCNvaJaeb0evXXS58ofECPxJ8QfiBqH7O+gfEDVL3wfod8bjW7u6dTNJMxybXzFA3qG3YyODuPO1a6XxDr3w4+Avw5u\/EmsywaPoOjW++Zo4mY9QqqqqC8srsVVVUM7uyqAWIB5\/9mKydvhr\/wAJReMXvNb1G4u7uZuWdvMZOT\/wEn8TWjYeHbb4tftk+DvA+swC50TwNoFz4w1C1bBjbUmmSz0syKeGVQdRmUHpLbROMGMV59OpVzLEfWa2s56t2S06LTTbfu9XqfsmdOhw3gXluF0pYf3bXfvT2lJ925Xt\/LFKKskZg+Bf7afjv4YN8YJviRq3hnXtRVZtK+F2h6ZpCfYbZ3GyO8vL+KctdqhDytGViU7o0jkKiRvPv2aPi5qn7Ql78Qf2dP2jfDkkPirwF4hayeLUbGO2uL202KBexeSzRSqs4ng8+AhXMQLRwsxiX6o179t79kjw\/wCH28TXH7Q\/hG5tVMGTYa7BO22VkVJNqOT5fzqxf7qrkkgCvFf25\/gD8MPhv8TPAv8AwUL+G3hG0sfE2k6\/aeHfFt9pcQhTWdB1q8t7WV7oRpmdoLh7W5SRz8gjkycMRXo18NSnRcbHwmWZ1jsPmMKrqPfvt5rtbyOy\/ZZ+IviH4b+PX\/Zr8eao93ayQNP4R1GY\/M0YyWg="}
 02407{"flow_id":132,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2406,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976139,"pkt_ts_usec":953291,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"ePiC0\/vCAMDKkVoBCABFAAXcG6JAAPIGHQU0VD84rBAq2ABQyx1XQcjSlNdIjoAQAHanswAAAQEICmz6gAsA9nTjCfYAkDttI6Fa+jK+RP2g538MyeFviVYri70PxJA6ODglGOWX6Eov619dI4dA46EZFc2W1JJSot\/Da3o9l8tV6HucbYSlKdDMqcVF11LnS0XtINKUkunMnGT\/ALzYtYnxG8Ut4M8E6h4hhjD3EUGyyiP\/AC1uHISJPxdlH41t15n8S9YHirx3beF7Zt1loBW6vyPuveOp8mM+uxGMhHYvGa9M+FM7w5oyeHtBtNEWYyG2t1R5W6yNj5nPuTk\/jWja273VzHbRj5pHCj8TUdbngPTTd6sb11+S3XP\/AAI8D+p\/CgDsoYkghSCMfKihV+gFOoooAKKKKACiiigBs0MdxC8Ey5R1KsPUGvOtX02XSdQlsZf4G+U+q9jXo9YnjTQjqdl9ttkzNAOgHLL3H4daAOGvLO11C0lsL2BZYZ42jmjcZDqwwQfYg1tfB7xbcKj\/AA38RXTPf6ZEGsLiU\/Ne2WcI+e7pwj987W\/jFZNUdb0m4vxBf6VfGz1Kxl87Tr1Vz5UmMEMP4kYZVl7g9jggA9erwr4tJLov7TWnX1yuIdW8PGCFz03o7MR9eB\/30K9S+HfxBtvG9hJBdWws9WsdqappzPkxMejqf442wSrdxwcEEDlf2qPhN4n+Jvw6kufh1rCab4p0kPPoWoNZi48qQjn90WUSYIDBCwDFQCQCTXmZtQqV8JeGri1L1s9fwueRneGq4nA3pq8oSUku9nqvuv8AM8sj+yfGP9sLwd4B0ord6b8NFufFHiyeMEx2moSWxtNMs5G+75jpd3d0E+8otYnIAdC1X9rz9pz9ij4iadB8NtY1HWfGGtWFwl9omofDAfaL\/Q73zorZLiC8jYJBKPtDZBYo8UdwsiugdDH4z\/ZU\/Yv8IfAPTviD48+Iev23hbw9Z3U3iHUZ9XfzvEF9dTwPJcX0aqTdag08SpEFTzFeURwqpEITE8LeFviT4v0Y+HfhH8F9N+BHhDVgr6nrFpfJP4x1G0+dktyUjMemsfMbMhnuJYld1jELkSJvTlQw+HV5XT\/E6KUsNhcKryTT19fQ5\/QdSOneMtAv7S\/8b\/F74waJYR3kHhvxXqFhY6H8O724tWQyalJp1pBD9rEUzL5ey4udsjNFHHG5kr174I\/DSP4K\/CfTPBeo62uo31rDJdeIdcMHlHU9Rmdp729dcna01xJLKRk434ycVqfDz4ceBvhP4TtvA\/w68M2uk6XalmjtbZT8zsxZ5XY5aSR2JZ5HJd2YsxJJNY3j3W9S8X6pH8IPAI+0apqR8u9lQ\/LaQ\/xliOnHX0HuRXjY3GpU\/dWnRLdvovVng5hmCjS92Nl9mK3bey9Wa\/7L\/wAIvAXjLwtN8RPFXg+0u7ybXrifT7meH51jwFxkfeUncNpyOvFeqa\/8JPh7rWh3mkr4K0iJrq0khWZdNiDIWUqGB28EZzXlXiPxV+1L8E\/GL\/Df4M\/s0QeMfCGn+DrefTNTfxJb6c7akrXJnt237izShYNp2qqs\/wAzYJK87f8A7Sv\/AAUIj8WwS2n7AZbR4fDM095AvjmyaWbUWjikihRztwFKzRklcEyISVCHPrYHBQw2ChSmldLX16n1eVV8ywGX0KDrSvTikvedl1stdFfocR+z78Ov2yfGngaPwj4N0Pwt4I0bTb+8tT4r8TzNqt1clJ3DeRp1rJGqru3LvnuUcFf9SR1+iv2e\/wBmzRPgSmsa9f8Ai3UfFHivxLJC\/iTxTrCxpLdLCHEFvFFEqx29tEJJPLhQcGSR2Z5JHkYvr6b4I+MrrxLqFu6eEvEdws+oyD5ho1+wCtI+OkMuBuYcK4yeGyOW+IX7dfgHTvE198OPgR4T1H4neJ9NlMGqW3hmeFNN0mbGfLvdRlYQQuON0MZluFBB8kgiqwkKWHpKGzjp\/k\/R\/wDA6H1PEGJzDNsc8UryhWbnGy0Teso="}
 02415{"flow_id":132,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2407,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976139,"pkt_ts_usec":953617,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"ePiC0\/vCAMDKkVoBCABFAAXcG6NAAPIGHQQ0VD84rBAq2ABQyx1XQc56lNdIjoAQAHaCvAAAAQEICmz6gAsA9nTjLt9qLdnfyltJN9T4k\/Zt\/ZL0bQ7zXvF3wU8C2um2Om4v7zUNDtUggs4YxxIzqFWFEjU4PygID2zXhnizxzrn7Z02kaV4d8OzaD8F9H1C3vrY3qSQXvjR7c77UrD8pttMSRYpl8z95cmJAUSHPnv1v4d\/Fn9oK7j1j9rDxpb3WlpdJcW3wx8MsyaDCUbdH9rkdFn1V1YBj5vl25ZVItlZQ1dd4x8b+GPAGjPrXibUkt4UH7tM5eU\/3UXqx\/ycVGIxcVF8r06s6Mn4erVK8XVjeTfuxWrb87fl95x\/7QFu\/im68KfDGxYm71zxHAoVRkiNThmPsN4P4H0r66RAiBF6AYFfO\/7K\/wAM\/EvjzxvJ+0p8RNMe0jaAweE9MlHMUBBBmI9SCcHvuY9Nte8eKvFWi+DNEm1\/Xrry4IsABV3PK5OFjRRyzscAKOSTUZbTlaVZq3Na3otvv1Z1cbYuiqlDLaclL2Clztar2k2nJJ9eVKMW+6Zn\/EnxwngfQPtFrAtxqV5J9n0myJx505BIz6IoBZj2VT3xXB+H9HbRdO+zz3TXFzNK899duMNcTudzyH0yTwOwAA4FNtzrPiPXJPG\/iyIR3ksZisrENuXT7cnPlg9DI2AXYdSABwoq\/XpnwwAEnAFd94W0n+yNJSKRcSyfPL9T2\/AVzngrRDqOofbZ0zDAQeRwzdh\/Wu1oAKKKKACiiigAooooAKKKKAOO8ZeGjYynVLGP9y5\/eKo+4f8AA1gV6dJHHNG0UqBlYYZWGQRXF+KPCkukubyyUvbMefWP2Pt70AcvqmkXE15Br2h6g1hq1mD9kvo03cHrHIv\/AC0jbAyp+oIIBHYeA\/ipaeI7pfDXiW1XS9cVCTaNJmO6A6yQOceYvcr95e46E87VXV9F0zXrT7FqtoJUDh4zkq0bjo6MMFGHZgQRQBP8bv2UvA3xh1DTvEqTyadq+j6quqadNGS0AvljeNLhochTKqSOBJjcNxNcxJ8O\/wBqPQ5TaRQ+H9ZjXhbky+UzD1IyvP4V1OieO\/HvgoC21SOTxJpifdlDKmoQr75wlwB\/wB\/98123hP4i+DfG2+Pw9rcclxEP39jMpiuIf9+JwHX6kYrzMRlOGrz505Rf912\/DVfgePiskwmJqe0TlB\/3Xa\/yd1+B5HafBj9ojxi32bxT4p0zw\/ZscSrpoMkzDvg9v++hXp3ww+EHg34T6Y1l4bs2a4mwbvULg7ppz7nsPYcfzrqaKrC5XhcLU9oryl3k7tenRfJF4PJsFg6ntVeU\/wCaTu16dF8kgooor0T1RlxbwXcD2t1AksUiFZI5FBVlPBBB6ivDfGH7Cvgw6rN4j+DPiq+8FXs7s8sGnjdau7Ekny8gjJJJAOOele60VhXw1DEq1SN7fevR7nqZXnWaZNUc8HVcL6NaOL\/xRacX80z5v\/4ZV\/afk\/0OX9omwEHQypo6+Zj\/AL5Bz\/wKuo+HX7E\/gHw3rcfi74ja9feMdXjIaObVj+4jYdxFk5+jEj2r1jxH4q8N+EbA6n4n1y1sYM4ElzMF3H+6oPLH2GSa4fWfi34m8Sg2vw90drG2bg61rFuVYj1htzhj\/vSbR\/ssK54ZbhIS5mm\/Vt\/mz18TxrxDiKLpRqRpqWj9nCFNv1cIp\/K9jq\/GvxA8PeA7SMX5ea7uMrYaXaKGnuWHZV7Ad2OFUdSK89ePXPFGtJ4s8byRtcxZ\/s7ToW3QaepGDtP8cpHDSEeygDOV0rQLXTLiXUpbie8v7kD7XqV7Jvnmx0BboqjsigKOwFXq7z5QKn07T7jU7xLK2XLOevYDuTUUMMs8qwwoWdjhVA5JruvC\/h2PQ7TfKAbiQfvG9P8AZFAFzTNOt9KsksbYfKg5Pdj3JqxRRQAUUUUAFFFFABRRRQAUUUUAFIyq6lHUEEYII4NLRQBy\/iLwOcteaKvu1vk="}
-00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2438,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":67,"flow_packet_id":10,"flow_first_seen":1490976071237,"flow_last_seen":1490976075957,"flow_tot_l4_data_len":2354,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1366,"flow_avg_l4_data_len":235,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":49606,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2438,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":77,"flow_packet_id":10,"flow_first_seen":1490976076275,"flow_last_seen":1490976077663,"flow_tot_l4_data_len":2354,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1366,"flow_avg_l4_data_len":235,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":49613,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2438,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":68,"flow_packet_id":28,"flow_first_seen":1490976071286,"flow_last_seen":1490976075975,"flow_tot_l4_data_len":9214,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":329,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45693,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2438,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":69,"flow_packet_id":20,"flow_first_seen":1490976071306,"flow_last_seen":1490976075950,"flow_tot_l4_data_len":5532,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":276,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45694,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2438,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":71,"flow_packet_id":23,"flow_first_seen":1490976071349,"flow_last_seen":1490976075957,"flow_tot_l4_data_len":5242,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":227,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45695,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2438,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":72,"flow_packet_id":23,"flow_first_seen":1490976071380,"flow_last_seen":1490976075949,"flow_tot_l4_data_len":7319,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":318,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45696,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2438,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":73,"flow_packet_id":14,"flow_first_seen":1490976071385,"flow_last_seen":1490976075957,"flow_tot_l4_data_len":983,"flow_min_l4_data_len":20,"flow_max_l4_data_len":259,"flow_avg_l4_data_len":70,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45697,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2438,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":75,"flow_packet_id":15,"flow_first_seen":1490976071583,"flow_last_seen":1490976075957,"flow_tot_l4_data_len":902,"flow_min_l4_data_len":20,"flow_max_l4_data_len":259,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45698,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2480,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":133,"flow_packet_id":1,"flow_first_seen":1490976142629,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40878,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00447{"flow_id":133,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2480,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976142,"pkt_ts_usec":629437,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AMDKkaPvePiC0\/vCCABFAAA8Si5AAEAGxLmsECrYNu8d\/Z+uAbuBOjwrAAAAAKAC\/\/9GYAAAAgQFtAQCCAoA9nYFAAAAAAEDAwg="}
 00429{"flow_id":133,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2481,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976142,"pkt_ts_usec":691841,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAw0iJAAOcGldA27x39rBAq2AG7n66gUyr3gTo8LHASH\/4OHAAAAgQFtAEDAwY="}
@@ -1848,16 +1811,6 @@
 00416{"flow_id":134,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2514,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976150,"pkt_ts_usec":198368,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AMDKkaPvePiC0\/vCCABFAAAo6ytAAEAGW9esECrYNF7ohrK2AbvOUJS+tBCbTVAQAVdT0QAA"}
 00499{"flow_id":134,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2515,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976150,"pkt_ts_usec":201483,"pkt_caplen":113,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":113,"pkt_l4_len":79,"pkt":"AMDKkaPvePiC0\/vCCABFAABj6yxAAEAGW5usECrYNF7ohrK2AbvOUJS+tBCbTVAYAVdiRgAAFAMBAAEBFgMBADCwuv8XBYK0+AHTDf78NuYcAQ5Wd60Wpm3oTJFtOxaTinjcMJIvU0VlbtkQLiDDMss="}
 01362{"flow_id":134,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2516,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976150,"pkt_ts_usec":210618,"pkt_caplen":752,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":752,"pkt_l4_len":718,"pkt":"AMDKkaPvePiC0\/vCCABFAALi6y1AAEAGWRusECrYNF7ohrK2AbvOUJT5tBCbTVAYAVeamQAAFwMBACCKzEam9ljsPv33r5OYYXaerLCH5q\/e7mZVb1oKLZ6xTBcDAQKQbsP4hTQxEHzwbyWJgK+7PhnWvP4lfEyWd6PsbIsn+4BF0w6jXmi5MnjZoAytLgr8gk8rEI1fiZM2yGqgDI+W2snl4rSsIFqAWuS4zJJAu2d3RL1sqcRkSQ29uJAB5CV3hdTFti1bWa5xsNhRp4wMLKKDqBkE3iOujKFmSY0JT5jbUtkuFS2ZRG64BTVxuxxH9wYwdQ58guUg\/7cNsvaAEJ2m7ZwkLyr2n810iIQZWuKz+BPmbXOkD4wVwBUVhrdWuqHvyyXYsvRjDV3851FqDyFWcykpl9QKUCaqHouoTdBOI98JdJyjPNIl+8sSmQxCsdOeJd8akqK9wBBtimOTNFi7QNs+dvMmzMwfYyWk4UuGccGXGA5hPKHbYbHMnkhW8u\/HIV+R91KDyQrSY\/qcRWjuVSD7ILEa5ipSPEzdGIOwXLpjZx874hMt06yrgOxrWvtKjqN11kmBDLxUX0yiwAurxpxM1La9gViCSpjNwsDtGyR0RpKRgu9saf4M4HMjdukuawa+Wx8atMyqHW5e+RSpc8N5uoDxFMD9oorfKniD2jyyuTCcasZ\/+\/PH+xTqMkFnCCHggzDnqCD+ZiEeIM6LVGPnSfPtp9T0SoRzvtkzgrXYc0KH1U+nOldDRjbyy0FUTp3v2HYe5gxcfvRzgSrv76mnOOMsKZYV\/RRcvzGrSWF\/o6LtdnobY7Vr8MGwUu7b+6xx1LpdhCwA9i\/PNiZZC+NpNhGujtqjWcUuBlzQMH+NgV2D6mrdsqILf\/TFM6GOCGiCBzza9XQ0ptOlpGzeHvCJNUP+zMntb5RVUgkLPlpNZCCgBchWaMgRhWleT+KuBw7H1UJBcBIDSiunAluakZmQsn6MMKqDMwagATw="}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2517,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":82,"flow_packet_id":23,"flow_first_seen":1490976085829,"flow_last_seen":1490976088478,"flow_tot_l4_data_len":4832,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":210,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45704,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2517,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":83,"flow_packet_id":19,"flow_first_seen":1490976085832,"flow_last_seen":1490976088478,"flow_tot_l4_data_len":3003,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":158,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45705,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00527{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2517,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":85,"flow_packet_id":6,"flow_first_seen":1490976085884,"flow_last_seen":1490976088478,"flow_tot_l4_data_len":148,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45707,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
-00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2517,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":85,"flow_packet_id":6,"flow_first_seen":1490976085884,"flow_last_seen":1490976088478,"flow_tot_l4_data_len":148,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45707,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2517,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":79,"flow_packet_id":20,"flow_first_seen":1490976082723,"flow_last_seen":1490976084872,"flow_tot_l4_data_len":5448,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":272,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34053,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00527{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2517,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":80,"flow_packet_id":7,"flow_first_seen":1490976082964,"flow_last_seen":1490976084873,"flow_tot_l4_data_len":168,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34054,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
-00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2517,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":80,"flow_packet_id":7,"flow_first_seen":1490976082964,"flow_last_seen":1490976084873,"flow_tot_l4_data_len":168,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34054,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2517,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":86,"flow_packet_id":2,"flow_first_seen":1490976085891,"flow_last_seen":1490976085978,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"192.168.11.1","src_port":38434,"dst_port":8080,"l4_proto":"tcp","ndpi": {"proto":"HTTP_Proxy","breed":"Acceptable","category":"Web"}}
-00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2517,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":86,"flow_packet_id":2,"flow_first_seen":1490976085891,"flow_last_seen":1490976085978,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"192.168.11.1","src_port":38434,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2517,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":78,"flow_packet_id":27,"flow_first_seen":1490976080485,"flow_last_seen":1490976081484,"flow_tot_l4_data_len":8508,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":315,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"34.199.52.240","src_port":38404,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00426{"flow_id":134,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2517,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976150,"pkt_ts_usec":473730,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAolzNAAOcGCM80XuiGrBAq2AG7sra0EJtNzlCU+VAQf\/fU9QAAAAAAAAAA"}
 01362{"flow_id":134,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2526,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976156,"pkt_ts_usec":847148,"pkt_caplen":752,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":752,"pkt_l4_len":718,"pkt":"AMDKkaPvePiC0\/vCCABFAALi6y5AAEAGWRqsECrYNF7ohrK2AbvOUJT5tBCbTVAYAVeamQAAFwMBACCKzEam9ljsPv33r5OYYXaerLCH5q\/e7mZVb1oKLZ6xTBcDAQKQbsP4hTQxEHzwbyWJgK+7PhnWvP4lfEyWd6PsbIsn+4BF0w6jXmi5MnjZoAytLgr8gk8rEI1fiZM2yGqgDI+W2snl4rSsIFqAWuS4zJJAu2d3RL1sqcRkSQ29uJAB5CV3hdTFti1bWa5xsNhRp4wMLKKDqBkE3iOujKFmSY0JT5jbUtkuFS2ZRG64BTVxuxxH9wYwdQ58guUg\/7cNsvaAEJ2m7ZwkLyr2n810iIQZWuKz+BPmbXOkD4wVwBUVhrdWuqHvyyXYsvRjDV3851FqDyFWcykpl9QKUCaqHouoTdBOI98JdJyjPNIl+8sSmQxCsdOeJd8akqK9wBBtimOTNFi7QNs+dvMmzMwfYyWk4UuGccGXGA5hPKHbYbHMnkhW8u\/HIV+R91KDyQrSY\/qcRWjuVSD7ILEa5ipSPEzdGIOwXLpjZx874hMt06yrgOxrWvtKjqN11kmBDLxUX0yiwAurxpxM1La9gViCSpjNwsDtGyR0RpKRgu9saf4M4HMjdukuawa+Wx8atMyqHW5e+RSpc8N5uoDxFMD9oorfKniD2jyyuTCcasZ\/+\/PH+xTqMkFnCCHggzDnqCD+ZiEeIM6LVGPnSfPtp9T0SoRzvtkzgrXYc0KH1U+nOldDRjbyy0FUTp3v2HYe5gxcfvRzgSrv76mnOOMsKZYV\/RRcvzGrSWF\/o6LtdnobY7Vr8MGwUu7b+6xx1LpdhCwA9i\/PNiZZC+NpNhGujtqjWcUuBlzQMH+NgV2D6mrdsqILf\/TFM6GOCGiCBzza9XQ0ptOlpGzeHvCJNUP+zMntb5RVUgkLPlpNZCCgBchWaMgRhWleT+KuBw7H1UJBcBIDSiunAluakZmQsn6MMKqDMwagATw="}
 00425{"flow_id":134,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2527,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976157,"pkt_ts_usec":263632,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAolx9AAOcGCOM0XuiGrBAq2AG7sra0EJtNzlCXs1AQf+zSRgAAAAAAAAAA"}
@@ -1880,17 +1833,18 @@
 00426{"flow_id":135,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2543,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976160,"pkt_ts_usec":206885,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAoYPdAAOcGPws0XuiGrBAq2AG7sreYM6qkdo6D7lAQf\/dKSAAAAAAAAAAA"}
 00425{"flow_id":135,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2544,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976160,"pkt_ts_usec":206952,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAoYRlAAOcGPuk0XuiGrBAq2AG7sreYM6qkdo6JolAQf+BEqwAAAAAAAAAA"}
 00425{"flow_id":135,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2545,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976160,"pkt_ts_usec":206978,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAoYRpAAOcGPug0XuiGrBAq2AG7sreYM6qkdo6KeFAQf91D2AAAAAAAAAAA"}
-00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":91,"flow_packet_id":9,"flow_first_seen":1490976089173,"flow_last_seen":1490976090510,"flow_tot_l4_data_len":236,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":49627,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP.Amazon","breed":"Acceptable","category":"Web"},"http": {}}
-00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":91,"flow_packet_id":9,"flow_first_seen":1490976089173,"flow_last_seen":1490976090510,"flow_tot_l4_data_len":236,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":49627,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":94,"flow_packet_id":10,"flow_first_seen":1490976089426,"flow_last_seen":1490976094931,"flow_tot_l4_data_len":1407,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1016,"flow_avg_l4_data_len":140,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":49630,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":81,"flow_packet_id":56,"flow_first_seen":1490976085644,"flow_last_seen":1490976098828,"flow_tot_l4_data_len":22501,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":401,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45703,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":87,"flow_packet_id":20,"flow_first_seen":1490976088605,"flow_last_seen":1490976094930,"flow_tot_l4_data_len":2366,"flow_min_l4_data_len":20,"flow_max_l4_data_len":718,"flow_avg_l4_data_len":118,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45709,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":88,"flow_packet_id":49,"flow_first_seen":1490976088631,"flow_last_seen":1490976098828,"flow_tot_l4_data_len":19892,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":405,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45710,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":90,"flow_packet_id":42,"flow_first_seen":1490976088958,"flow_last_seen":1490976094931,"flow_tot_l4_data_len":13667,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":325,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45712,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":97,"flow_packet_id":27,"flow_first_seen":1490976090991,"flow_last_seen":1490976094931,"flow_tot_l4_data_len":5829,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1452,"flow_avg_l4_data_len":215,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.231.72.88","src_port":41820,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":98,"flow_packet_id":7,"flow_first_seen":1490976091048,"flow_last_seen":1490976094931,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.231.72.88","src_port":41821,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
-00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":98,"flow_packet_id":7,"flow_first_seen":1490976091048,"flow_last_seen":1490976094931,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.231.72.88","src_port":41821,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":95,"flow_packet_id":30,"flow_first_seen":1490976090572,"flow_last_seen":1490976094931,"flow_tot_l4_data_len":13094,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":436,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34069,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":22,"flow_packet_id":10,"flow_first_seen":1490976031691,"flow_last_seen":1490976032855,"flow_tot_l4_data_len":2382,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1366,"flow_avg_l4_data_len":238,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":49572,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":28,"flow_packet_id":32,"flow_first_seen":1490976041156,"flow_last_seen":1490976043655,"flow_tot_l4_data_len":11044,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":345,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45661,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":29,"flow_packet_id":18,"flow_first_seen":1490976041384,"flow_last_seen":1490976042405,"flow_tot_l4_data_len":2759,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1118,"flow_avg_l4_data_len":153,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45662,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":30,"flow_packet_id":18,"flow_first_seen":1490976041400,"flow_last_seen":1490976042398,"flow_tot_l4_data_len":2791,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1150,"flow_avg_l4_data_len":155,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45663,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":38,"flow_packet_id":17,"flow_first_seen":1490976041961,"flow_last_seen":1490976042341,"flow_tot_l4_data_len":6241,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":367,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.216","src_port":54412,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00527{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":39,"flow_packet_id":6,"flow_first_seen":1490976042054,"flow_last_seen":1490976042398,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.216","src_port":54413,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
+00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":39,"flow_packet_id":6,"flow_first_seen":1490976042054,"flow_last_seen":1490976042398,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.216","src_port":54413,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":36,"flow_packet_id":25,"flow_first_seen":1490976041870,"flow_last_seen":1490976042512,"flow_tot_l4_data_len":7430,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":297,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34019,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1490976041434,"flow_last_seen":1490976041437,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"192.168.11.1","src_port":38391,"dst_port":8080,"l4_proto":"tcp","ndpi": {"proto":"HTTP_Proxy","breed":"Acceptable","category":"Web"}}
+00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1490976041434,"flow_last_seen":1490976041437,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"192.168.11.1","src_port":38391,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":25,"flow_packet_id":24,"flow_first_seen":1490976035553,"flow_last_seen":1490976036358,"flow_tot_l4_data_len":6484,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":270,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"34.199.52.240","src_port":38363,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2549,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":26,"flow_packet_id":18,"flow_first_seen":1490976037754,"flow_last_seen":1490976042398,"flow_tot_l4_data_len":3903,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":216,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"34.199.52.240","src_port":38364,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2555,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":136,"flow_packet_id":1,"flow_first_seen":1490976164994,"flow_last_seen":0,"flow_tot_l4_data_len":42,"flow_min_l4_data_len":42,"flow_max_l4_data_len":42,"flow_avg_l4_data_len":42,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":64073,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00448{"flow_id":136,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2555,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976164,"pkt_ts_usec":994460,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"AMDKkaPvePiC0\/vCCABFAAA+WmBAAEARM1WsECrYrBAqAfpJADUAKhd4KNkBAAABAAAAAAAABWFsZXhhBmFtYXpvbgNjb20AAAEAAQ=="}
 00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2555,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":136,"flow_packet_id":1,"flow_first_seen":1490976164994,"flow_last_seen":0,"flow_tot_l4_data_len":42,"flow_min_l4_data_len":42,"flow_max_l4_data_len":42,"flow_avg_l4_data_len":42,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":64073,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.AmazonAlexa","breed":"Acceptable","category":"VirtualAssistant"},"dns": {"query":"alexa.amazon.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
@@ -1934,18 +1888,23 @@
 00424{"flow_id":138,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2588,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976170,"pkt_ts_usec":32557,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAoei9AAOcGJdM0XuiGrBAq2AG7srhwEXnl75ryh1AQf927nAAAAAAAAAAA"}
 01512{"flow_id":138,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2589,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976170,"pkt_ts_usec":60686,"pkt_caplen":859,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":859,"pkt_l4_len":825,"pkt":"ePiC0\/vCAMDKkVoBCABFAANNhEpAAOcGGJM0XuiGrBAq2AG7srhwEXnl75ryh1AY\/bA27QAAFwMBAyCM59eoL8uEPTx75PFu3CAlP3YuWBpZaav0\/a+DG14Qo7qA\/c6ioOREyNdRUqIJEUqhIKlhgtmyzasadVEGOSjf\/Zny9WcpCVbMxGqAaUBnze1Y9biUleVEBeffIOUorc\/rAyvH\/H7csNNmwXhPfgTQmjWwPU4iiwHhi3GfI\/3o2lGq2xYRjicp1ijRfhco8S1MWhJ9ou85kE9buLp4ZNA1MLshCt7aqHFMCDiz9cb+INhKM3qSwa3Qyr+jyn2f71ahKl9uZVIePoVwLa21WJRPT1KuffvGIYHgfe4La265pPxv0RvMIe7grZfCPOzOID3WJTZdq6Phr+NiEivg2LTalrRrhREZcbwpd2qLz3KKZpg4mdVKR3BaCG83OQ7KQdMVdXTgEXjw6bte5PxXKgMPzx6\/ITkm5ODNkjpvQc5meLk8nKL\/MT88+RWg5yxlA1pyrug3smUsr6xlxahBONns+TIr1gLSd24v1cJukvxBeU3MwigL38FLNn5lQdf0OIRx865cUvTlhBImaRKnyskbZwQpnhTa+uOmGGkPIoN4A66NJbfVEPa5vGqeEwFqrDujVAswbSm3J4dNRYB0FhF5ozuhL6ndIyHop6xw5wlKAx3+4SXBlL7XUXl+0paJpUPoUZSawxdjGIqwvOI99A9ozlNl3NhM3cN9Qxf78x3h0rVADdaliQhkLyCVmvjNOhvOAUrAfpKXSYbEf+6bfUhPqWCvHqyYnSvZIDfBJ\/wMwklkyPqmI0a92NqljjOOksMkQ9f2FDktNRXOLRHb7cqAqzFRTeyNc4tGWaBs8j9cK+W\/tIDNED4NFPOu8JL3jcjIxpm7cNSM4c+1z5awEEnS351MO0Awy6z\/iMz3xm1xnOvpygxnODElQnpy1FxAI7Z+8WiS5IfgCOuXB7FVJ\/zRLuiSEj76f26JRDJeROR6pn1YJhpqeQU3DdcUUS\/hRoiHki\/FcGD1RCk6PXhAnclOKvElZidUmV+iRIzm\/dSMJiLWrOAZVELtvPF1dNCIflviR1\/U5eYNIGcg1c+nYCHkdCns6uOeJFE4oBv9YCD86g=="}
 00417{"flow_id":138,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2592,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976170,"pkt_ts_usec":100674,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AMDKkaPvePiC0\/vCCABFAAAoanxAAEAG3IasECrYNF7ohrK4AbvvmvKHcBF9ClAQAV02+AAA"}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":105,"flow_packet_id":23,"flow_first_seen":1490976107365,"flow_last_seen":1490976110047,"flow_tot_l4_data_len":7372,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":320,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40853,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":106,"flow_packet_id":37,"flow_first_seen":1490976107365,"flow_last_seen":1490976110047,"flow_tot_l4_data_len":13845,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":374,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40854,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":107,"flow_packet_id":7,"flow_first_seen":1490976107366,"flow_last_seen":1490976110047,"flow_tot_l4_data_len":188,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40855,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
-00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":107,"flow_packet_id":7,"flow_first_seen":1490976107366,"flow_last_seen":1490976110047,"flow_tot_l4_data_len":188,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40855,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":108,"flow_packet_id":98,"flow_first_seen":1490976107455,"flow_last_seen":1490976110047,"flow_tot_l4_data_len":33419,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":341,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40856,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":89,"flow_packet_id":33,"flow_first_seen":1490976088937,"flow_last_seen":1490976110046,"flow_tot_l4_data_len":12974,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":393,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45711,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":92,"flow_packet_id":27,"flow_first_seen":1490976089227,"flow_last_seen":1490976107676,"flow_tot_l4_data_len":8584,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":317,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45714,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":93,"flow_packet_id":29,"flow_first_seen":1490976089239,"flow_last_seen":1490976111839,"flow_tot_l4_data_len":11074,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":381,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45715,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":103,"flow_packet_id":29,"flow_first_seen":1490976100859,"flow_last_seen":1490976107676,"flow_tot_l4_data_len":5930,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1452,"flow_avg_l4_data_len":204,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.231.72.88","src_port":41825,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":101,"flow_packet_id":8,"flow_first_seen":1490976100559,"flow_last_seen":1490976107681,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34073,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
-00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":101,"flow_packet_id":8,"flow_first_seen":1490976100559,"flow_last_seen":1490976107681,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34073,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":102,"flow_packet_id":22,"flow_first_seen":1490976100811,"flow_last_seen":1490976107676,"flow_tot_l4_data_len":7891,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":358,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34074,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":46,"flow_packet_id":11,"flow_first_seen":1490976044439,"flow_last_seen":1490976046418,"flow_tot_l4_data_len":2423,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1016,"flow_avg_l4_data_len":220,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":49589,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":44,"flow_packet_id":26,"flow_first_seen":1490976044189,"flow_last_seen":1490976046415,"flow_tot_l4_data_len":6933,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1198,"flow_avg_l4_data_len":266,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45673,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":45,"flow_packet_id":24,"flow_first_seen":1490976044219,"flow_last_seen":1490976046417,"flow_tot_l4_data_len":6925,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1214,"flow_avg_l4_data_len":288,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45674,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":47,"flow_packet_id":22,"flow_first_seen":1490976044488,"flow_last_seen":1490976046418,"flow_tot_l4_data_len":4870,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1166,"flow_avg_l4_data_len":221,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45676,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":48,"flow_packet_id":17,"flow_first_seen":1490976044502,"flow_last_seen":1490976046415,"flow_tot_l4_data_len":2771,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1150,"flow_avg_l4_data_len":163,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45677,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":49,"flow_packet_id":14,"flow_first_seen":1490976044509,"flow_last_seen":1490976046418,"flow_tot_l4_data_len":744,"flow_min_l4_data_len":20,"flow_max_l4_data_len":259,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45678,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":50,"flow_packet_id":13,"flow_first_seen":1490976044521,"flow_last_seen":1490976046418,"flow_tot_l4_data_len":724,"flow_min_l4_data_len":20,"flow_max_l4_data_len":259,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45679,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":51,"flow_packet_id":29,"flow_first_seen":1490976046418,"flow_last_seen":1490976048924,"flow_tot_l4_data_len":10393,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1214,"flow_avg_l4_data_len":358,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45680,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":54,"flow_packet_id":15,"flow_first_seen":1490976047096,"flow_last_seen":1490976048927,"flow_tot_l4_data_len":902,"flow_min_l4_data_len":20,"flow_max_l4_data_len":259,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45683,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":37,"flow_packet_id":78,"flow_first_seen":1490976041942,"flow_last_seen":1490976046399,"flow_tot_l4_data_len":43981,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":563,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.216","src_port":54411,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":55,"flow_packet_id":21,"flow_first_seen":1490976047560,"flow_last_seen":1490976048909,"flow_tot_l4_data_len":9156,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":436,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.216","src_port":54427,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":42,"flow_packet_id":29,"flow_first_seen":1490976043814,"flow_last_seen":1490976046408,"flow_tot_l4_data_len":10991,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":379,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"72.21.206.135","src_port":42129,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":43,"flow_packet_id":32,"flow_first_seen":1490976043814,"flow_last_seen":1490976046401,"flow_tot_l4_data_len":11707,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":365,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"72.21.206.135","src_port":42130,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":56,"flow_packet_id":22,"flow_first_seen":1490976047563,"flow_last_seen":1490976048928,"flow_tot_l4_data_len":6132,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":278,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"72.21.206.135","src_port":42143,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":57,"flow_packet_id":23,"flow_first_seen":1490976047858,"flow_last_seen":1490976048917,"flow_tot_l4_data_len":5019,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":218,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"72.21.206.135","src_port":42144,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":52,"flow_packet_id":25,"flow_first_seen":1490976047014,"flow_last_seen":1490976048924,"flow_tot_l4_data_len":7330,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":293,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34033,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2594,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":53,"flow_packet_id":43,"flow_first_seen":1490976047050,"flow_last_seen":1490976048924,"flow_tot_l4_data_len":23419,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":544,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34034,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2611,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":139,"flow_packet_id":1,"flow_first_seen":1490976177026,"flow_last_seen":0,"flow_tot_l4_data_len":45,"flow_min_l4_data_len":45,"flow_max_l4_data_len":45,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":4312,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00451{"flow_id":139,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2611,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976177,"pkt_ts_usec":26053,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"AMDKkaPvePiC0\/vCCABFAABBWmFAAEARM1GsECrYrBAqARDYADUALXE1hGEBAAABAAAAAAAACHBpdGFuZ3VpBmFtYXpvbgNjb20AAAEAAQ=="}
 00647{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2611,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":139,"flow_packet_id":1,"flow_first_seen":1490976177026,"flow_last_seen":0,"flow_tot_l4_data_len":45,"flow_min_l4_data_len":45,"flow_max_l4_data_len":45,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":4312,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Amazon","breed":"Acceptable","category":"Web"},"dns": {"query":"pitangui.amazon.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
@@ -2014,14 +1973,10 @@
 00406{"flow_id":144,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2680,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976180,"pkt_ts_usec":796726,"pkt_caplen":46,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":46,"pkt_l4_len":8,"pkt":"AQBeAAABAMDKkaPvCABGwAAgAABAAAECBBcAAAAA4AAAAZQEAAARZO6bAAAAAA=="}
 00464{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2680,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":144,"flow_packet_id":1,"flow_first_seen":1490976180796,"flow_last_seen":0,"flow_tot_l4_data_len":8,"flow_min_l4_data_len":8,"flow_max_l4_data_len":8,"flow_avg_l4_data_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"224.0.0.1","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}}
 00433{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":144,"flow_packet_id":1,"flow_first_seen":1490976180796,"flow_last_seen":0,"flow_tot_l4_data_len":8,"flow_min_l4_data_len":8,"flow_max_l4_data_len":8,"flow_avg_l4_data_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"224.0.0.1","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":110,"flow_packet_id":20,"flow_first_seen":1490976114885,"flow_last_seen":1490976117017,"flow_tot_l4_data_len":4467,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":223,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45728,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":111,"flow_packet_id":19,"flow_first_seen":1490976114894,"flow_last_seen":1490976116921,"flow_tot_l4_data_len":3131,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":164,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45729,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":112,"flow_packet_id":20,"flow_first_seen":1490976114906,"flow_last_seen":1490976117017,"flow_tot_l4_data_len":5043,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":252,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45730,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":113,"flow_packet_id":19,"flow_first_seen":1490976114921,"flow_last_seen":1490976117016,"flow_tot_l4_data_len":3019,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":158,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45731,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":114,"flow_packet_id":21,"flow_first_seen":1490976114940,"flow_last_seen":1490976120960,"flow_tot_l4_data_len":5979,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":284,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45732,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":116,"flow_packet_id":31,"flow_first_seen":1490976115905,"flow_last_seen":1490976120950,"flow_tot_l4_data_len":11436,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":368,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.180","src_port":37551,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":117,"flow_packet_id":7,"flow_first_seen":1490976116084,"flow_last_seen":1490976117005,"flow_tot_l4_data_len":168,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.180","src_port":37552,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
-00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":117,"flow_packet_id":7,"flow_first_seen":1490976116084,"flow_last_seen":1490976117005,"flow_tot_l4_data_len":168,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.180","src_port":37552,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":58,"flow_packet_id":19,"flow_first_seen":1490976054009,"flow_last_seen":1490976055604,"flow_tot_l4_data_len":3973,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1166,"flow_avg_l4_data_len":209,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45687,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":60,"flow_packet_id":20,"flow_first_seen":1490976057977,"flow_last_seen":1490976058806,"flow_tot_l4_data_len":5219,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":260,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45688,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":62,"flow_packet_id":21,"flow_first_seen":1490976064328,"flow_last_seen":1490976064897,"flow_tot_l4_data_len":6078,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":289,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"72.21.206.135","src_port":42148,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":61,"flow_packet_id":19,"flow_first_seen":1490976058103,"flow_last_seen":1490976058813,"flow_tot_l4_data_len":5117,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":269,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34041,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":145,"flow_packet_id":1,"flow_first_seen":1490976186164,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.28.178","src_port":50800,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00446{"flow_id":145,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2681,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976186,"pkt_ts_usec":164818,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AMDKkaPvePiC0\/vCCABFAAA8hhtAAEAGihesECrYNu8cssZwAbtODwEcAAAAAKAC\/\/9+IQAAAgQFtAQCCAoA9ocHAAAAAAEDAwg="}
 00429{"flow_id":145,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2682,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976186,"pkt_ts_usec":394721,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAwCmJAAOcGXtw27xyyrBAq2AG7xnDcplSHTg8BHXASH\/7w+wAAAgQFtAEDAwY="}
@@ -2214,13 +2169,14 @@
 00416{"flow_id":158,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2933,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976196,"pkt_ts_usec":147041,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AMDKkaPvePiC0\/vCCABFAAAoLW1AAEAG4tmsECrYNu8csuLAAbtkEKg3W8DR+lAQAVdldQAA"}
 00499{"flow_id":158,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2934,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976196,"pkt_ts_usec":147954,"pkt_caplen":113,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":113,"pkt_l4_len":79,"pkt":"AMDKkaPvePiC0\/vCCABFAABjLW5AAEAG4p2sECrYNu8csuLAAbtkEKg3W8DR+lAYAVeqEQAAFAMBAAEBFgMBADD2QvgoZCzL2sq9QkWBCk4oZYYnMOqmN0xgX5RLRlGnxcOsJXhxtOLqkEjsjWjhac0="}
 01086{"flow_id":158,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2935,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976196,"pkt_ts_usec":149644,"pkt_caplen":544,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":544,"pkt_l4_len":510,"pkt":"AMDKkaPvePiC0\/vCCABFAAISLW9AAEAG4O2sECrYNu8csuLAAbtkEKhyW8DR+lAYAVfCVwAAFwMBACAq1pVXkGSW4f2YohoU+FIGpU10z0bdYKMLfEeBr1uVNhcDAQHAfuhhV8jDb3AMgYqrEAETSCFFdqHfJVviEQ8iPKs82cgGEJmw8cZX+0\/Tue8IqHeSYG25k3IedqFe++SBL4MVz2MbqgnG4hrhn0JcN3IUcj8gQFNfrpCBt7iLoL4qvQ5g81iZ2SzcatlKm2X2qtG6wRqOll220jIzVJlE0rDIU\/0tjXGOKpgW4jQrPDyzvsZsYifXbLKNlILac7lviqRlZsj+XbS5GiB3tGTtwuP9XnxXgEPPPwPD2Se4Le++yQkCaK+MlvF\/Tg6HPxctU+vgRJ691Ss2\/ZKGIqHlZh25\/2ux843yj0CESkW5C8Yfye0GkBwqUHoY0oJJ39jXZ7PnGcGfEYPegzYKSx7fA4o\/nqR2lEHu1ieFqTR+1O+e0QxVk0JauRqix7VF26ojv1ejMe1iMoyMSzCX59i4jFk8nPX1naK1fTnzojXksdlA7MQhEQeqcWAxvjI712FwqBANLeztME\/TxY7rW5H0bjc\/ZunyqwxdXMRQy\/xuxzCjrvGfff9tc8OnNgdiHqJm8MLH93hv9AgKGuTqdXWnErvhCpycV1FwvzfzAn+52a\/rbSMXaKJpwMltLLU3EYuMM3pfbA=="}
-00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":120,"flow_packet_id":30,"flow_first_seen":1490976134140,"flow_last_seen":1490976135403,"flow_tot_l4_data_len":14885,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":496,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51985,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":121,"flow_packet_id":59,"flow_first_seen":1490976134141,"flow_last_seen":1490976135403,"flow_tot_l4_data_len":33432,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":566,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51986,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":122,"flow_packet_id":26,"flow_first_seen":1490976134144,"flow_last_seen":1490976135402,"flow_tot_l4_data_len":13433,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":516,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51987,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":123,"flow_packet_id":28,"flow_first_seen":1490976134146,"flow_last_seen":1490976135403,"flow_tot_l4_data_len":15059,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":537,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51988,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":124,"flow_packet_id":31,"flow_first_seen":1490976134148,"flow_last_seen":1490976135505,"flow_tot_l4_data_len":16709,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":539,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51989,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":125,"flow_packet_id":28,"flow_first_seen":1490976134149,"flow_last_seen":1490976135403,"flow_tot_l4_data_len":15709,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":561,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51990,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":118,"flow_packet_id":31,"flow_first_seen":1490976130073,"flow_last_seen":1490976134134,"flow_tot_l4_data_len":9238,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":298,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40864,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":67,"flow_packet_id":10,"flow_first_seen":1490976071237,"flow_last_seen":1490976075957,"flow_tot_l4_data_len":2354,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1366,"flow_avg_l4_data_len":235,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":49606,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":68,"flow_packet_id":28,"flow_first_seen":1490976071286,"flow_last_seen":1490976075975,"flow_tot_l4_data_len":9214,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":329,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45693,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":69,"flow_packet_id":20,"flow_first_seen":1490976071306,"flow_last_seen":1490976075950,"flow_tot_l4_data_len":5532,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":276,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45694,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":71,"flow_packet_id":23,"flow_first_seen":1490976071349,"flow_last_seen":1490976075957,"flow_tot_l4_data_len":5242,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":227,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45695,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":72,"flow_packet_id":23,"flow_first_seen":1490976071380,"flow_last_seen":1490976075949,"flow_tot_l4_data_len":7319,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":318,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45696,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":73,"flow_packet_id":14,"flow_first_seen":1490976071385,"flow_last_seen":1490976075957,"flow_tot_l4_data_len":983,"flow_min_l4_data_len":20,"flow_max_l4_data_len":259,"flow_avg_l4_data_len":70,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45697,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":75,"flow_packet_id":15,"flow_first_seen":1490976071583,"flow_last_seen":1490976075957,"flow_tot_l4_data_len":902,"flow_min_l4_data_len":20,"flow_max_l4_data_len":259,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45698,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2936,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":64,"flow_packet_id":33,"flow_first_seen":1490976064452,"flow_last_seen":1490976068180,"flow_tot_l4_data_len":18692,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":566,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.216","src_port":54434,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00426{"flow_id":158,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2937,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976196,"pkt_ts_usec":206840,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAoGApAAOcGUTw27xyyrBAq2AG74sBbwNH6ZBCoclAQf\/nmlwAAAAAAAAAA"}
 00426{"flow_id":158,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2938,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976196,"pkt_ts_usec":206984,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ePiC0\/vCAMDKkVoBCABFAAAoGA1AAOcGUTk27xyyrBAq2AG74sBbwNH6ZBCqXFAQf\/HktQAAAAAAAAAA"}
 01233{"flow_id":158,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2939,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976196,"pkt_ts_usec":210247,"pkt_caplen":651,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":651,"pkt_l4_len":617,"pkt":"ePiC0\/vCAMDKkVoBCABFAAJ9GDhAAOcGTrk27xyyrBAq2AG74sBbwNH6ZBCqXFAY\/cTfAAAAFwMBAlA1\/jeW82DEgSiFV2UMawc3\/qHF7N+D9KTUZEWtF6KLA1Ve83SXjzsPkBsG1pIB6OXd6Z2YKnAb6s7oGvPyPCwwd+z88+vxjPlDvQ8Op\/xy+2QYKg5zNjX+FBB5TcguCVVaR\/qYj\/blYX9piqHP3WmhSQSOG03BpWYgdWXM23vcEg9yEeWEJphAbJPfg8GMYMhUr9FCOAl\/s7CLpm\/fwYrx\/A\/szEDOr9GDpUNxRwrY54nsI8++8pYTf40Z64+qZLGQXTgkG1lo6z\/j3MSYbnZKoZsu+6XN6+JS1bQHFz5yXbVfArwVIiwHuG6lFBh2uxwi5g+ZL\/ONXCuojIdIJLGmJ1lQlR0rTq3GqAqcKAX51z19zV1+9kyAmzmBH+ioagfm8N2Luh652u2undAmnBRwTbO7u3Z91\/ILkjah7fdFAOBkP44NU9Cte509wVjhjQw3WwI1s6GRWVqN1CY2WUWJNyOd61mxdxtGNMwMoPAI82tiMRnoRiuHdYAIRjppSiFswruRjd2SC7jiSw5Ht386QGxOSJbk3LIt9QpedaBeP5Y4\/ZiDE63NVjisHpYW6wWhJPkJHqbsTP\/I0Ay2RPI9BDFbohTw9h8syJeSs7sHEHIKj0drsiXFz4Vx1YVanVtIVawoCqqottCkUqmNTAkcqXU7iujU2aR0aEF+m\/KcKgJtSY+faBw6PvIo1o19pfD+mkfXzTqB72f6QiMLSNcIp3bh60ZcK73sGWTGOrrl3166rV3CM6ZYjQgXhush\/jmCb8q7BFaN8gfkhAImtrTk"}
@@ -2294,6 +2250,12 @@
 00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":142,"flow_packet_id":7,"flow_first_seen":1490976177116,"flow_last_seen":1490976195547,"flow_tot_l4_data_len":188,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.28.178","src_port":50798,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":143,"flow_packet_id":37,"flow_first_seen":1490976177276,"flow_last_seen":1490976187754,"flow_tot_l4_data_len":13563,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":366,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.28.178","src_port":50799,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":145,"flow_packet_id":17,"flow_first_seen":1490976186164,"flow_last_seen":1490976186790,"flow_tot_l4_data_len":5520,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":324,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.28.178","src_port":50800,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":120,"flow_packet_id":30,"flow_first_seen":1490976134140,"flow_last_seen":1490976135403,"flow_tot_l4_data_len":14885,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":496,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51985,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":121,"flow_packet_id":59,"flow_first_seen":1490976134141,"flow_last_seen":1490976135403,"flow_tot_l4_data_len":33432,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":566,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51986,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":122,"flow_packet_id":26,"flow_first_seen":1490976134144,"flow_last_seen":1490976135402,"flow_tot_l4_data_len":13433,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":516,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51987,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":123,"flow_packet_id":28,"flow_first_seen":1490976134146,"flow_last_seen":1490976135403,"flow_tot_l4_data_len":15059,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":537,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51988,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":124,"flow_packet_id":31,"flow_first_seen":1490976134148,"flow_last_seen":1490976135505,"flow_tot_l4_data_len":16709,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":539,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51989,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":125,"flow_packet_id":28,"flow_first_seen":1490976134149,"flow_last_seen":1490976135403,"flow_tot_l4_data_len":15709,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":561,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51990,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":127,"flow_packet_id":51,"flow_first_seen":1490976139642,"flow_last_seen":1490976140773,"flow_tot_l4_data_len":30946,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":606,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51992,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":128,"flow_packet_id":26,"flow_first_seen":1490976139643,"flow_last_seen":1490976140772,"flow_tot_l4_data_len":13670,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":525,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51993,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":129,"flow_packet_id":21,"flow_first_seen":1490976139643,"flow_last_seen":1490976140745,"flow_tot_l4_data_len":8913,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":424,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51994,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
@@ -2301,11 +2263,20 @@
 00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":131,"flow_packet_id":28,"flow_first_seen":1490976139643,"flow_last_seen":1490976140773,"flow_tot_l4_data_len":14771,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":527,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51996,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":132,"flow_packet_id":30,"flow_first_seen":1490976139643,"flow_last_seen":1490976140781,"flow_tot_l4_data_len":16797,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":559,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51997,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1490976023264,"flow_last_seen":1490976023264,"flow_tot_l4_data_len":646,"flow_min_l4_data_len":323,"flow_max_l4_data_len":323,"flow_avg_l4_data_len":323,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":77,"flow_packet_id":10,"flow_first_seen":1490976076275,"flow_last_seen":1490976077663,"flow_tot_l4_data_len":2354,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1366,"flow_avg_l4_data_len":235,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":49613,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":149,"flow_packet_id":21,"flow_first_seen":1490976187511,"flow_last_seen":1490976190310,"flow_tot_l4_data_len":9629,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":458,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.28.178","src_port":38757,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":91,"flow_packet_id":9,"flow_first_seen":1490976089173,"flow_last_seen":1490976090510,"flow_tot_l4_data_len":236,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":49627,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP.Amazon","breed":"Acceptable","category":"Web"},"http": {}}
+00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":91,"flow_packet_id":9,"flow_first_seen":1490976089173,"flow_last_seen":1490976090510,"flow_tot_l4_data_len":236,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":49627,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":147,"flow_packet_id":33,"flow_first_seen":1490976186884,"flow_last_seen":1490976197347,"flow_tot_l4_data_len":16171,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":490,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.23.94","src_port":44912,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":94,"flow_packet_id":10,"flow_first_seen":1490976089426,"flow_last_seen":1490976094931,"flow_tot_l4_data_len":1407,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1016,"flow_avg_l4_data_len":140,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":49630,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":105,"flow_packet_id":23,"flow_first_seen":1490976107365,"flow_last_seen":1490976110047,"flow_tot_l4_data_len":7372,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":320,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40853,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":106,"flow_packet_id":37,"flow_first_seen":1490976107365,"flow_last_seen":1490976110047,"flow_tot_l4_data_len":13845,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":374,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40854,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":107,"flow_packet_id":7,"flow_first_seen":1490976107366,"flow_last_seen":1490976110047,"flow_tot_l4_data_len":188,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40855,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
+00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":107,"flow_packet_id":7,"flow_first_seen":1490976107366,"flow_last_seen":1490976110047,"flow_tot_l4_data_len":188,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40855,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":108,"flow_packet_id":98,"flow_first_seen":1490976107455,"flow_last_seen":1490976110047,"flow_tot_l4_data_len":33419,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":341,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40856,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":118,"flow_packet_id":31,"flow_first_seen":1490976130073,"flow_last_seen":1490976134134,"flow_tot_l4_data_len":9238,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":298,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40864,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":126,"flow_packet_id":41,"flow_first_seen":1490976136930,"flow_last_seen":1490976140745,"flow_tot_l4_data_len":14534,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":354,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40871,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":133,"flow_packet_id":23,"flow_first_seen":1490976142629,"flow_last_seen":1490976148981,"flow_tot_l4_data_len":4083,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":177,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40878,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00462{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1490976027958,"flow_last_seen":1490976030758,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":60,"flow_max_l4_data_len":60,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.1","dst_ip":"172.16.42.216","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15}
 00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1490976027514,"flow_last_seen":1490976027560,"flow_tot_l4_data_len":129,"flow_min_l4_data_len":42,"flow_max_l4_data_len":87,"flow_avg_l4_data_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":53188,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":115,"flow_packet_id":2,"flow_first_seen":1490976115835,"flow_last_seen":1490976115901,"flow_tot_l4_data_len":146,"flow_min_l4_data_len":65,"flow_max_l4_data_len":81,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":28614,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":76,"flow_packet_id":24,"flow_first_seen":1490976076042,"flow_last_seen":1490976177233,"flow_tot_l4_data_len":4002,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":166,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":37113,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
@@ -2322,8 +2293,22 @@
 00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1490976024847,"flow_last_seen":1490976024848,"flow_tot_l4_data_len":126,"flow_min_l4_data_len":55,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":55619,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":41,"flow_packet_id":2,"flow_first_seen":1490976043611,"flow_last_seen":1490976043811,"flow_tot_l4_data_len":102,"flow_min_l4_data_len":43,"flow_max_l4_data_len":59,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":43350,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":151,"flow_packet_id":65,"flow_first_seen":1490976195529,"flow_last_seen":1490976198776,"flow_tot_l4_data_len":36892,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":567,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.143","src_port":41828,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00447{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1490976022741,"flow_last_seen":1490976022741,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15}
-00456{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1490976022731,"flow_last_seen":1490976022731,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ffd3:fbc2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":81,"flow_packet_id":56,"flow_first_seen":1490976085644,"flow_last_seen":1490976098828,"flow_tot_l4_data_len":22501,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":401,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45703,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":82,"flow_packet_id":23,"flow_first_seen":1490976085829,"flow_last_seen":1490976088478,"flow_tot_l4_data_len":4832,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":210,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45704,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":83,"flow_packet_id":19,"flow_first_seen":1490976085832,"flow_last_seen":1490976088478,"flow_tot_l4_data_len":3003,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":158,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45705,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00527{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":85,"flow_packet_id":6,"flow_first_seen":1490976085884,"flow_last_seen":1490976088478,"flow_tot_l4_data_len":148,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45707,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
+00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":85,"flow_packet_id":6,"flow_first_seen":1490976085884,"flow_last_seen":1490976088478,"flow_tot_l4_data_len":148,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45707,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":87,"flow_packet_id":20,"flow_first_seen":1490976088605,"flow_last_seen":1490976094930,"flow_tot_l4_data_len":2366,"flow_min_l4_data_len":20,"flow_max_l4_data_len":718,"flow_avg_l4_data_len":118,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45709,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":88,"flow_packet_id":49,"flow_first_seen":1490976088631,"flow_last_seen":1490976098828,"flow_tot_l4_data_len":19892,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":405,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45710,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":89,"flow_packet_id":33,"flow_first_seen":1490976088937,"flow_last_seen":1490976110046,"flow_tot_l4_data_len":12974,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":393,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45711,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":90,"flow_packet_id":42,"flow_first_seen":1490976088958,"flow_last_seen":1490976094931,"flow_tot_l4_data_len":13667,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":325,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45712,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":92,"flow_packet_id":27,"flow_first_seen":1490976089227,"flow_last_seen":1490976107676,"flow_tot_l4_data_len":8584,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":317,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45714,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":93,"flow_packet_id":29,"flow_first_seen":1490976089239,"flow_last_seen":1490976111839,"flow_tot_l4_data_len":11074,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":381,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45715,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":110,"flow_packet_id":20,"flow_first_seen":1490976114885,"flow_last_seen":1490976117017,"flow_tot_l4_data_len":4467,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":223,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45728,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":111,"flow_packet_id":19,"flow_first_seen":1490976114894,"flow_last_seen":1490976116921,"flow_tot_l4_data_len":3131,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":164,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45729,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":112,"flow_packet_id":20,"flow_first_seen":1490976114906,"flow_last_seen":1490976117017,"flow_tot_l4_data_len":5043,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":252,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45730,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":113,"flow_packet_id":19,"flow_first_seen":1490976114921,"flow_last_seen":1490976117016,"flow_tot_l4_data_len":3019,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":158,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45731,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":114,"flow_packet_id":21,"flow_first_seen":1490976114940,"flow_last_seen":1490976120960,"flow_tot_l4_data_len":5979,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":284,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45732,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":20,"flow_packet_id":29,"flow_first_seen":1490976030894,"flow_last_seen":1490976194743,"flow_tot_l4_data_len":14473,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":499,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.22.185","src_port":53682,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":134,"flow_packet_id":20,"flow_first_seen":1490976150029,"flow_last_seen":1490976164211,"flow_tot_l4_data_len":3390,"flow_min_l4_data_len":20,"flow_max_l4_data_len":718,"flow_avg_l4_data_len":169,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45750,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":135,"flow_packet_id":21,"flow_first_seen":1490976158680,"flow_last_seen":1490976164214,"flow_tot_l4_data_len":3261,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":155,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45751,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
@@ -2339,12 +2324,17 @@
 00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":150,"flow_packet_id":2,"flow_first_seen":1490976195484,"flow_last_seen":1490976195524,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":40,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":14934,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":160,"flow_packet_id":2,"flow_first_seen":1490976196840,"flow_last_seen":1490976196938,"flow_tot_l4_data_len":102,"flow_min_l4_data_len":43,"flow_max_l4_data_len":59,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":2707,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":99,"flow_packet_id":2,"flow_first_seen":1490976093238,"flow_last_seen":1490976093355,"flow_tot_l4_data_len":135,"flow_min_l4_data_len":48,"flow_max_l4_data_len":87,"flow_avg_l4_data_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":41639,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":116,"flow_packet_id":31,"flow_first_seen":1490976115905,"flow_last_seen":1490976120950,"flow_tot_l4_data_len":11436,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":368,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.180","src_port":37551,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":117,"flow_packet_id":7,"flow_first_seen":1490976116084,"flow_last_seen":1490976117005,"flow_tot_l4_data_len":168,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.180","src_port":37552,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
+00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":117,"flow_packet_id":7,"flow_first_seen":1490976116084,"flow_last_seen":1490976117005,"flow_tot_l4_data_len":168,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.180","src_port":37552,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":158,"flow_packet_id":19,"flow_first_seen":1490976196016,"flow_last_seen":1490976196282,"flow_tot_l4_data_len":1903,"flow_min_l4_data_len":20,"flow_max_l4_data_len":617,"flow_avg_l4_data_len":100,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.28.178","src_port":58048,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":66,"flow_packet_id":56,"flow_first_seen":1490976067968,"flow_last_seen":1490976168824,"flow_tot_l4_data_len":27953,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":499,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.146","src_port":41691,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00471{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1490976032763,"flow_last_seen":1490976032763,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::7af8:82ff:fed3:fbc2","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15}
-00469{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":5,"flow_packet_id":6,"flow_first_seen":1490976023731,"flow_last_seen":1490976031750,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::7af8:82ff:fed3:fbc2","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15}
 00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":119,"flow_packet_id":2,"flow_first_seen":1490976133936,"flow_last_seen":1490976134135,"flow_tot_l4_data_len":265,"flow_min_l4_data_len":47,"flow_max_l4_data_len":218,"flow_avg_l4_data_len":132,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":4920,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":153,"flow_packet_id":19,"flow_first_seen":1490976195633,"flow_last_seen":1490976195989,"flow_tot_l4_data_len":7206,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":379,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"216.58.194.78","src_port":49067,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":97,"flow_packet_id":27,"flow_first_seen":1490976090991,"flow_last_seen":1490976094931,"flow_tot_l4_data_len":5829,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1452,"flow_avg_l4_data_len":215,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.231.72.88","src_port":41820,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":98,"flow_packet_id":7,"flow_first_seen":1490976091048,"flow_last_seen":1490976094931,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.231.72.88","src_port":41821,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
+00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":98,"flow_packet_id":7,"flow_first_seen":1490976091048,"flow_last_seen":1490976094931,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.231.72.88","src_port":41821,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":103,"flow_packet_id":29,"flow_first_seen":1490976100859,"flow_last_seen":1490976107676,"flow_tot_l4_data_len":5930,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1452,"flow_avg_l4_data_len":204,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.231.72.88","src_port":41825,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1490976041806,"flow_last_seen":1490976041938,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":40,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":52077,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":96,"flow_packet_id":2,"flow_first_seen":1490976090796,"flow_last_seen":1490976090982,"flow_tot_l4_data_len":150,"flow_min_l4_data_len":53,"flow_max_l4_data_len":97,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":35726,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1490976041770,"flow_last_seen":1490976041866,"flow_tot_l4_data_len":146,"flow_min_l4_data_len":65,"flow_max_l4_data_len":81,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":21391,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
@@ -2360,13 +2350,23 @@
 00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1490976030681,"flow_last_seen":1490976030890,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":7358,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00529{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":84,"flow_packet_id":7,"flow_first_seen":1490976085883,"flow_last_seen":1490976149040,"flow_tot_l4_data_len":280,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"10.201.126.241","src_port":40242,"dst_port":8080,"l4_proto":"tcp","ndpi": {"proto":"HTTP_Proxy","breed":"Acceptable","category":"Web"}}
 00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":84,"flow_packet_id":7,"flow_first_seen":1490976085883,"flow_last_seen":1490976149040,"flow_tot_l4_data_len":280,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"10.201.126.241","src_port":40242,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":79,"flow_packet_id":20,"flow_first_seen":1490976082723,"flow_last_seen":1490976084872,"flow_tot_l4_data_len":5448,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":272,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34053,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00527{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":80,"flow_packet_id":7,"flow_first_seen":1490976082964,"flow_last_seen":1490976084873,"flow_tot_l4_data_len":168,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34054,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
+00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":80,"flow_packet_id":7,"flow_first_seen":1490976082964,"flow_last_seen":1490976084873,"flow_tot_l4_data_len":168,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34054,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":95,"flow_packet_id":30,"flow_first_seen":1490976090572,"flow_last_seen":1490976094931,"flow_tot_l4_data_len":13094,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":436,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34069,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":101,"flow_packet_id":8,"flow_first_seen":1490976100559,"flow_last_seen":1490976107681,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34073,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
+00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":101,"flow_packet_id":8,"flow_first_seen":1490976100559,"flow_last_seen":1490976107681,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34073,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":102,"flow_packet_id":22,"flow_first_seen":1490976100811,"flow_last_seen":1490976107676,"flow_tot_l4_data_len":7891,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":358,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.24.186","src_port":34074,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":100,"flow_packet_id":41,"flow_first_seen":1490976093358,"flow_last_seen":1490976194991,"flow_tot_l4_data_len":8165,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":199,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"176.32.101.52","src_port":44001,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1490976024793,"flow_last_seen":1490976024844,"flow_tot_l4_data_len":138,"flow_min_l4_data_len":55,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":69,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":3440,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1490976027522,"flow_last_seen":1490976027523,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":40,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":52603,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":65,"flow_packet_id":2,"flow_first_seen":1490976067916,"flow_last_seen":1490976067965,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":40,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":60804,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":86,"flow_packet_id":2,"flow_first_seen":1490976085891,"flow_last_seen":1490976085978,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"192.168.11.1","src_port":38434,"dst_port":8080,"l4_proto":"tcp","ndpi": {"proto":"HTTP_Proxy","breed":"Acceptable","category":"Web"}}
+00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":86,"flow_packet_id":2,"flow_first_seen":1490976085891,"flow_last_seen":1490976085978,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"192.168.11.1","src_port":38434,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":11,"flow_packet_id":17,"flow_first_seen":1490976027567,"flow_last_seen":1490976028006,"flow_tot_l4_data_len":2009,"flow_min_l4_data_len":32,"flow_max_l4_data_len":549,"flow_avg_l4_data_len":118,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"173.194.223.188","src_port":42878,"dst_port":5228,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":63,"flow_packet_id":2,"flow_first_seen":1490976064333,"flow_last_seen":1490976064448,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":40,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":44475,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":16,"flow_packet_id":38,"flow_first_seen":1490976029248,"flow_last_seen":1490976152630,"flow_tot_l4_data_len":13618,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":358,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.197","src_port":55242,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":152,"flow_packet_id":2,"flow_first_seen":1490976195545,"flow_last_seen":1490976195628,"flow_tot_l4_data_len":144,"flow_min_l4_data_len":52,"flow_max_l4_data_len":92,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":40425,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":78,"flow_packet_id":27,"flow_first_seen":1490976080485,"flow_last_seen":1490976081484,"flow_tot_l4_data_len":8508,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":315,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"34.199.52.240","src_port":38404,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1490976029669,"flow_last_seen":1490976029753,"flow_tot_l4_data_len":142,"flow_min_l4_data_len":50,"flow_max_l4_data_len":92,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":19967,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00133{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test"}