Major nDPId extension. Sorry for the huge commit.

 - nDPId: fixed invalid IP4/IP6 tuple compare
 - nDPIsrvd: fixed caching issue (finally)
 - added tiny c example (can be used to check flow manager sanity)
 - c-captured: use flow_last_seen timestamp from `struct nDPIsrvd_flow`
 - README.md update: added example JSON sequence
 - nDPId: added new flow event `update` necessary for correct
   timeout handling (and other future use-cases)
 - nDPIsrvd.h and nDPIsrvd.py: switched to an instance
   (consists of an alias/source tuple) based flow manager
 - every flow related event **must** now serialize `alias`, `source`,
   `flow_id`, `flow_last_seen` and `flow_idle_time` to make the timeout
   handling and verification process work correctly
 - nDPIsrvd.h: ability to profile any dynamic memory (de-)allocation
 - nDPIsrvd.py: removed PcapPacket class (unused)
 - py-flow-dashboard and py-flow-multiprocess: fixed race condition
 - py-flow-info: print statusbar with probably useful information
 - nDPId/nDPIsrvd.h: switched from packet-flow only timestamps (`pkt_*sec`)
   to a generic flow event timestamp `ts_msec`
 - nDPId-test: added additional checks
 - nDPId: increased ICMP flow timeout
 - nDPId: using event based i/o if capturing packets from a device
 - nDPIsrvd: fixed memory leak on shutdown if remote descriptors
   were still connected

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 16 insertions, 27 deletions

diff --git a/test/results/exe_download_as_png.pcap.out b/test/results/exe_download_as_png.pcap.out
index 2092f4f29..3006facc4 100644
--- a/test/results/exe_download_as_png.pcap.out
+++ b/test/results/exe_download_as_png.pcap.out
@@ -1,35 +1,24 @@
-00487{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"exe_download_as_png.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":10000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
-00502{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"exe_download_as_png.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1569434903040,"flow_last_seen":1569434903040,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.25.101","dst_ip":"185.98.87.185","src_port":49197,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00433{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434903,"pkt_ts_usec":40298,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"IOUqtpPxAAgCHEeuCABFAAA0Bk9AAIAGv+sKCRlluWJXucAtAFB7PMGWAAAAAIACIAAdNgAAAgQFtAEDAwgBAQQC"}
-00426{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434903,"pkt_ts_usec":440451,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"AAgCHEeuIOUqtpPxCABFAAAsESIAAIAG9SC5Yle5CgkZZQBQwC0vLgrVezzBl2AS+vAxRwAAAgQFtA=="}
-00419{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434903,"pkt_ts_usec":440784,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"IOUqtpPxAAgCHEeuCABFAAAoBlJAAIAGv\/QKCRlluWJXucAtAFB7PMGXLy4K1lAQ+vBJBAAA"}
-00621{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434903,"pkt_ts_usec":441012,"pkt_caplen":203,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":203,"pkt_l4_len":169,"pkt":"IOUqtpPxAAgCHEeuCABFAAC9BlNAAIAGv14KCRlluWJXucAtAFB7PMGXLy4K1lAY+vA3lwAAR0VUIC90YWJsb25lLnBuZyBIVFRQLzEuMQ0KQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUNCkNvbm5lY3Rpb246IEtlZXAtQWxpdmUNClByYWdtYTogbm8tY2FjaGUNClVzZXItQWdlbnQ6IFdpbkhUVFAgbG9hZGVyLzEuMA0KSG9zdDogMTg1Ljk4Ljg3LjE4NQ0KDQo="}
-00715{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"exe_download_as_png.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1569434903040,"flow_last_seen":1569434903441,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":149,"flow_tot_l4_payload_len":149,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.25.101","dst_ip":"185.98.87.185","src_port":49197,"dst_port":80,"l4_proto":"tcp","ndpi": {"flow_risk": {"12":"HTTP Numeric IP Address"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"185.98.87.185","url":"185.98.87.185\/tablone.png","code":0,"content_type":"","user_agent":"WinHTTP loader\/1.0"}}
-00418{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434903,"pkt_ts_usec":441168,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AAgCHEeuIOUqtpPxCABFAAAoESMAAIAG9SO5Yle5CgkZZQBQwC0vLgrWezzCLFAQ+vBIbwAA"}
-02375{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434904,"pkt_ts_usec":53845,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"AAgCHEeuIOUqtpPxCABFAAXcESQAAIAG7265Yle5CgkZZQBQwC0vLgrWezzCLFAQ+vCXagAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuMTAuMw0KRGF0ZTogV2VkLCAyNSBTZXAgMjAxOSAxODowODoyNCBHTVQNCkNvbnRlbnQtVHlwZTogaW1hZ2UvcG5nDQpDb250ZW50LUxlbmd0aDogMjQ5OTA2DQpMYXN0LU1vZGlmaWVkOiBXZWQsIDI1IFNlcCAyMDE5IDEyOjI2OjI1IEdNVA0KQ29ubmVjdGlvbjoga2VlcC1hbGl2ZQ0KRVRhZzogIjVkOGI1Y2YxLTNkMDMyIg0KQWNjZXB0LVJhbmdlczogYnl0ZXMNCg0KTVqQAAMAAAAEAAAA\/\/8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAAdgnHaWeMfiVnjH4lZ4x+J2v8RiVjjH4kw\/BaJXeMfibD8EolY4x+JsfwbiVjjH4lSaWNoWeMfiQAAAAAAAAAAUEUAAEwBAwDSQ4tdAAAAAAAAAADgAA8BCwEGAADQAAAA8AIAAAAAANAXAAAAEAAAAOAAAAAAQAAAEAAAABAAAAQAAAABAAAABAAAAAAAAAAA4AMAABAAAGTQAQACAAAAAAAQAAAQAAAAABAAABAAAAAAAAAQAAAA8N4AAJ0AAADU1wAAZAAAAAAAAQBo0gIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkBEAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADACAABsAAAAABAAAIQBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAI3PAAAAEAAAANAAAAAQAAAAAAAAAAAAAAAAAAAgAABgLmRhdGEAAAAIFgAAAOAAAAAQAAAA4AAAAAAAAAAAAAAAAAAAQAAAwC5yc3JjAAAAaNICAAAAAQAA4AIAAPAAAAAAAAAAAAAAAAAAAEAAAEB\/r39SMAAAAPg3EBo6AAAA7CdUe0cAAQA6xeGNVAAAAMMfsEleAAAAAAAAAAAAAABnZGkzMi5ETEwAb2xlYXV0MzIuRExMAGtlcm5lbDMyLkRMTABOVERMTC5ETEwATVNWQlZNNjAuRExMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="}
-00772{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":6,"source":"exe_download_as_png.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":1569434903040,"flow_last_seen":1569434904053,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":1609,"flow_avg_l4_payload_len":268,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.25.101","dst_ip":"185.98.87.185","src_port":49197,"dst_port":80,"l4_proto":"tcp","ndpi": {"flow_risk": {"4":"Binary application transfer","12":"HTTP Numeric IP Address"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"185.98.87.185","url":"185.98.87.185\/tablone.png","code":200,"content_type":"image\/png","user_agent":"WinHTTP loader\/1.0"}}
-02115{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434904,"pkt_ts_usec":53857,"pkt_caplen":1322,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1322,"pkt_l4_len":1288,"pkt":"AAgCHEeuIOUqtpPxCABFAAUcESUAAIAG8C25Yle5CgkZZQBQwC0vLhCKezzCLFAY+vA9vwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="}
-00418{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434904,"pkt_ts_usec":54024,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"IOUqtpPxAAgCHEeuCABFAAAoBlRAAIAGv\/IKCRlluWJXucAtAFB7PMIsLy4VflAQ+vA9xwAA"}
-02243{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434904,"pkt_ts_usec":54281,"pkt_caplen":1418,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1418,"pkt_l4_len":1384,"pkt":"AAgCHEeuIOUqtpPxCABFAAV8ESYAAIAG78y5Yle5CgkZZQBQwC0vLhV+ezzCLFAY+vA4awAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="}
-02249{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434904,"pkt_ts_usec":54763,"pkt_caplen":1418,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1418,"pkt_l4_len":1384,"pkt":"AAgCHEeuIOUqtpPxCABFAAV8EScAAIAG78u5Yle5CgkZZQBQwC0vLhrSezzCLFAY+vDSrwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCxUE1QZFBNQFpQTQAAAABQvQEQAAAAACBfgWvQXoFrcHyBa3CGMEsQ24FrAAAAAIaTD2b5CQ9m7moQZjFoEGZEwgxmKRkOZo3MDWabag5mYnIQZroCD2aPixBmw58NZrdwDmZBCQ9mdmoOZjrDDGZ0og1mbgIPZv7BDWYQXg9mMtENZvGfDWadSQ5mBgMPZgigDWYGBA9m9+AMZuTPDGZJXw9m7pQPZuJvDmbqYg9m+30OZnSbDGaWlQ5m\/aAAZijGDWb2CQ9mh5sMZpOVD2aFmgxmYHYQZt9HDmbEiQ9mHb8MZokGD2a6Aw9miXYQZhN1EGZIGQ5mWsYNZr4ODmYrlA9m7DoQZjeiDWY6Aw9mOgQPZkpsDmbj2g1mXhAOZgFsDmZuAw9mqf0OZqQ1AGYvTg5m\/Y0QZsF3EGbZxg1mCyQNZvZtEGbXowBmWXUQZnB1EGbAkg9m7V0QZjBsDmbt7g5mRIsQZkSWD2YhmA5m\/MYNZhHdDmavnw1m7GsOZgAAAAAAAAAAAAAAAAAAAAAAAAAA0kOLXQAAAAACAAAAMgAAAAAAAAAA0AMAAAAAAIUACABWbEAAAAAAAF1sQAAFAAgAWW1AAAAAAABgbUAAAADIQgAAAAAHAAgAS29AAF1vQABTb0AAAQAIAGVwQAABAAgA9XBAAAEACABkcUAAAQAIACxyQAAoLURU+yH5PwEACAChckAABwAIAMdzQADZc0AAz3NAAAcACABSdUAAZHVAAFp1QAAJAAgANnZAAAAAAAA+dkAABwAIAAl6QAAnekAAEXpAACwAFAAAAAAAAAAAAFWNQAAAAAAAcBJAABoAAACOekAAnnpAAAZ7QAAVe0AAIntAAG97QACHfEAAXX1AADl+QAAQf0AA939AAPWBQAC\/gkAA14NAAKiEQABJhkAAbIZAAA2IQAAGiUAAC4lAAI2LQACNi0AAXoxAACiNQABBjUAATY1AAAAAAAAAALpCAADwQQAASEIAAAAABgAEAAAAAAAqkEAAF5BAAA0ACADZkUAAAAAAAOGRQAACAAQAAAAAAEaWQAAAAAAAAgAEAAAAAADglkAAAAAAAAIABAAAAAAAEZhAAAAAAAAEAAQAAAAAAAAAAAB0nkAAAQAIANOeQAABAAgAQp9AAAUACAAnoEAAAAAAAC6gQAAAAAAAAAAAQAcACADTrkAAHK9AANuuQAABAAgAuq9AAAkACAAtsEAAAAAAADSwQAABAAgAs7BAAAEACAAisUAACQAIAJ6xQAAAAAAApbFAAAMACAAzskAAOLJAAAAAAAABAAgAtLJAAAEACAAks0AAAQAIAJOzQAABAAgAArRAAAEACABxtEAAAQAIAOG0QAABAAgAQLVAAAEACACvtUAAAQAIABC2QAABAAgAgbZAAAEACADxtkAAAQAIAFC3QAABAAgAv7dAAAEACAAhuEAAAQAIAJG4QAABAAgA8bhAAAEACABhuUAAAQAIAME="}
-00420{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434904,"pkt_ts_usec":54858,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"IOUqtpPxAAgCHEeuCABFAAAoBlVAAIAGv\/EKCRlluWJXucAtAFB7PMIsLy4gJlAQ+vAzHwAA"}
-02359{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434904,"pkt_ts_usec":55189,"pkt_caplen":1418,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1418,"pkt_l4_len":1384,"pkt":"AAgCHEeuIOUqtpPxCABFAAV8ESgAAIAG78q5Yle5CgkZZQBQwC0vLiAmezzCLFAY+vBiYQAAuUAAAQAIADG6QAABAAgAkbpAAAEACAABu0AAAQAIAGC7QAABAAgAz7tAAAkACAA7vEAAAAAAAEK8QAADAAgA0LxAANW8QAAAAAAAAQAIAEG9QAABAAgAsb1AAAEACAAQvkAAAQAIAH++QAABAAgA4L5AAAEACABPv0AAAQAIALC\/QAABAAgAH8BAAAEACACAwEAAAQAIAO\/AQAABAAgAUMFAAAEACAC\/wUAAAQAIACfCQAAJAAgAm8JAAAAAAACiwkAAAQAIAB\/DQACBAAgA8MNAAAEACAByxEAABAAEAAAAAAAAAAAAjshAAAAAAAAA4G9ADgAIAAAAAACi0kAAXNJAAAYABAAAAAAAntNAAJTTQAAGAAQAAAAAAG7UQABk1EAAAQAIAODUQAABAAgAetVAAAUACAB610AAAAAAAIHXQAD\/JawQQAD\/JdgQQAD\/JfAQQAD\/JYwQQAD\/JXQQQAD\/JQwRQAD\/JVQQQAD\/JSgRQAD\/JZQQQAD\/JSQRQAD\/JRARQAD\/JegQQAD\/JcQQQAD\/JeQQQAD\/JWQQQAD\/JTQQQAD\/JVQRQAD\/JTAQQAD\/JXQRQAD\/JQARQAD\/JaQQQAD\/JcwQQAD\/JWgRQAD\/JWARQAD\/JbwQQAD\/JagQQAD\/JVwRQAD\/JWAQQAD\/JfgQQAD\/JcAQQAD\/JUwQQAD\/JVwQQAD\/JYgQQAD\/JXgQQAD\/JQgRQAD\/JQQRQAD\/JUAQQAD\/JRgQQAD\/JRQRQAD\/JRwRQAD\/JSAQQAD\/JXwRQAD\/JSgQQAD\/JWwQQAD\/JZgQQAD\/JUARQAD\/JTgQQAD\/JXgRQAD\/JUwRQAD\/JZAQQAD\/JYQQQAD\/JTwQQAD\/JTARQAD\/JXARQAD\/JTwRQAD\/JSQQQAD\/JRwQQAD\/JXAQQAD\/JRAQQAD\/JVgRQAD\/JdQQQAD\/JewQQAD\/JWQRQAD\/JfwQQAD\/JWwRQAD\/JUgQQAD\/JQAQQAD\/JQQQQAD\/JVgQQAD\/JTQRQAD\/JQgQQAD\/JVARQAD\/JTgRQAD\/JeAQQAD\/JfQQQAD\/JdwQQAD\/JbAQQAD\/JVAQQAD\/JRgRQAD\/JUQQQAD\/JSARQAD\/JWgQQAD\/JUgRQAD\/JZwQQAD\/JUQRQAD\/JYAQQAD\/JbgQQAD\/JdAQQAD\/JbQQQAD\/JcgQQAD\/JXwQQAD\/JaAQQAD\/JSwRQAAAAGjgGEAA6O7\/\/\/8AAEgAAAAwAAAAQAAAAAAAAABZxeBSNkWdR7XAygQPYAd3AAAAAAAAAQAAAAAAAAAAAEFNTUFDQVJFAAAAAAAAAAAAAAAAAAAAAAAAAACQAAAAAAAAAAIAAAAAAAAAw+pSHSnosEW6azzXfHwapwEAAACYAAAAqAAAAAEAAAAAAAAAASAAAAAAAAAAAAAAAAAAAGpDaGFydAAAy+IzLEEPxUGmS11wcgPVKQAUfZL3TUxLqgQKmr5etHcBAAEAbCtAAAAAAAD\/\/\/\/\/\/\/\/\/\/wAAAADwK0AACOBAAAUAAADMGEAAAAAAAAAAAAAAAAAAzBhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVkI1IfAfKgAAAAAAAAAAAAAAAAB+AAAAAAAAAAAAAAAAAAoACQQAAAAAAADQnUAANBxAABbwcAAA\/\/\/\/CAAAAAEAAAACAAEA6QAAAHwZQAAcGkAA3BdAAHgAAACBAAAAkAAAAJEAAAAAAAAAAAAAAAAAAAAAAAAASG9sYUZvcm0ARGljVmVyb25hUGFydDIAAEFNTUFDQVJFAAAAUAAAAELjrPwr8ndNjhrp2LSKRh0AAAAAAAAAAAAAAAAAAAAAAAAAAMMBAACRQQIAw+pSHSk="}
-02264{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434904,"pkt_ts_usec":55696,"pkt_caplen":1418,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1418,"pkt_l4_len":1384,"pkt":"AAgCHEeuIOUqtpPxCABFAAV8ESkAAIAG78m5Yle5CgkZZQBQwC0vLiV6ezzCLFAY+vCF8gAA6LBFums813x8GqfsAAAAAAAAAGRFQABMAAAAUAAAAN9uiYgizvFGuh2dNdOBjtEAAAAAAAAAAAAAAAAAAAAAAwAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPYVAAAAAAAAUEZAAJwAAADoAAAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0AAAAP\/\/\/\/8AAAAA0AAAANEAAADhAAAAAAAAAMPqUh0p6LBFums813x8GqcAFH2S901MS6oECpq+XrR3y+IzLEEPxUGmS11wcgPVKeOSxrAzpaRGvgd9xm+yfh4xjrter\/k+T7eGjRsDtdunPwEAAADgAAAARoT\/DwMAAOxiHWDQkSRJhGgetLBl\/ZJowTPquYefQaoiGxAoHisfAAAAAGITVyAAAAAAAAAAAAAAAAAAAAAAAEFNTUFDQVJFLmpDaGFydABqQ2hhcnQABwAAALRBQAAHAAAAcEFAAAcAAAAsQUAABwAAAOBAQAAHAAAAhEBAAAcAAAAwQEAABwAAAOw\/QAAHAAAAqD9AAAcAAABgP0AABwAAABg\/QAAHAAAAsD5AAAcAAABsPkAABwAAACg+QAAHAAAA3D1AAAcAAACUPUAABwAAAFA9QAAHAAAA7DxAAAcAAACkPEAABwAAAFw8QAAHAAAAFDxAAAcAAADMO0AABwAAAIg7QAAHAAAAGDtAAAcAAADUOkAABwAAAJA6QAAHAAAATDpAAAcAAAAIOkAABwAAAMQ5QAAHAAAAYDlAAAcAAAAEOUAABwAAAMA4QAAHAAAAeDhAAAYAAAD8M0AABwAAAEQwQAAHAAAA\/C9AAAcAAACgL0AABwAAAEwvQAAHAAAA8C5AAPQBAABsK0AAAAAAANBqQADQ10AAABYAAAjgQACmFUAAAOBAACoAXABBAEYAOgBcADgAMQA3ADIAMAAwADAAXABEAGkAYwBWAGUAcgBvAG4AYQA0AFAAYQByAHQAMgAuAHYAYgBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQbQAAmAAAAAQAAAGwrQAAAAAAApGZAAP\/\/\/\/8AAAAAwCtAACDgQAAAAAAAGMdUCQAAAAAAAAAAAAAAAOgeQAABAAAAoDBAAAAAAADoHkAAAQAAAPAeQAABAAAA7B5AAAIAAAD0HkAADwDiAWgAbABEH0AAHO5AAAAAAAA09mAJsDBAAMAwQADQMEAAQAAsAIgGAADgMEAA\/\/\/\/\/wA="}
-00420{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434904,"pkt_ts_usec":55794,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"IOUqtpPxAAgCHEeuCABFAAAoBlZAAIAGv\/AKCRlluWJXucAtAFB7PMIsLy4qzlAQ+vAodwAA"}
-02285{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434904,"pkt_ts_usec":56830,"pkt_caplen":1418,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1418,"pkt_l4_len":1384,"pkt":"AAgCHEeuIOUqtpPxCABFAAV8ESoAAIAG78i5Yle5CgkZZQBQwC0vLirOezzCLFAY+vBtPQAAAAAAAAAAAIAfQADol0AJ8DBAAP\/\/\/\/9AABIAjAYAAJwxQAABAAMAAAAAAAAAAABIIEAA+JdACawxQAABAAMA5CBAAPEgQAD+IEAACyFAABghQAAlIUAAMiFAAD8hQABmIUAAsCBAAL0gQADKIEAA1yBAAEwhQABZIUAAAAAAAPQeQABwHkAAqhdAALAXQAC2F0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMIgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACoIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM8gQAC1IEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHB9AAHAeQACqF0AAsBdAALYXQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACBbCQEhwYAAOkrSgAAgWwkBIcGAADpzksAAIFsJASHBgAA6cFMAACBbCQEhwYAAOm0TgAAgWwkBP\/\/AADpp08AAIFsJAT\/\/wAA6SpQAACBbCQE\/\/8AAOmNUAAAgWwkBP\/\/AADpQFEAAIFsJAT\/\/wAA6bNRAACBbCQE\/\/8AAOn2UgAAgWwkBP\/\/AADpWVQAAIFsJAT\/\/wAA6UxVAACBbCQE\/\/8AAOn\/WAAAgWwkBP\/\/AADpYmwAAIFsJAT\/\/wAA6eVuAAAAAQADAGwrQAAAAAAAJGdAAP\/\/\/\/8AAAAAUCxAADTgQAAAAAAAQNJQCQAAAAAAAAAAAAAAAOQhQAABAAAAiDZAAAAAAADkIUAAAQAAAOwhQAAAAAAA6CFAAAcAAADsIUAABAC3AWgAbAAEI0AA8OVAAAAAAACo7WAJmDZAANA0QABAABgAOAAAAEQ0QAAFAAMAAAAAAAAAAAAUI0AAgJhACag2QAAFAAMAQAAJADwAAAC0NkAAAQADAAAAAAAAAAAAjCNAAJCYQAnENkAAAQADAEAAEQBAAAAAzDZAAAMAAwAAAAAAAAAAAMgjQACgmEAJ3DZAAAMAAwBAABgARAAAAEQ0QAACAAMAAAAAAAAAAAAkJEAAgJhACeQ2QAACAAMAQAASAEgAAACcMUAABgADAAAAAAAAAAAAnCRAAPiXQAnwNkAABgADAEAAHwBMAAAA\/DZAAP\/\/\/\/8AAAAAAAAAAPwkQACwmEAJDDdAAP\/\/\/\/9AABEAUAAAAMw2QAAEAAMAAAAAAAAAAACQJUAAoJhACRQ3QAAEAAMA7CVAAPslQAASJkAAHyZAAAAAAADsIUAAbCFAAKoXQACwF0AAthdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUIkAAbCFAAKoXQACwF0AAthdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8IkAAbCFAAKoXQACwF0AAthdAABcmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGQiQABsIUAAqhdAALAXQAC2F0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="}
-00516{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":534,"source":"exe_download_as_png.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":534,"flow_first_seen":1569434903040,"flow_last_seen":1569434972556,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":500597,"flow_avg_l4_payload_len":937,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.25.101","dst_ip":"185.98.87.185","src_port":49197,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00140{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":534,"source":"exe_download_as_png.pcap","alias":"nDPId-test"}
+00453{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"exe_download_as_png.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7460000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":255}
+00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"exe_download_as_png.pcap","alias":"nDPId-test","flow_id":1,"flow_packets_processed":1,"flow_first_seen":1569434903040,"flow_last_seen":1569434903040,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"ts_msec":1569434903040,"l3_proto":"ip4","src_ip":"10.9.25.101","dst_ip":"185.98.87.185","src_port":49197,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
+00469{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"exe_download_as_png.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1569434903040,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"ts_msec":1569434903040,"pkt":"IOUqtpPxAAgCHEeuCABFAAA0Bk9AAIAGv+sKCRlluWJXucAtAFB7PMGWAAAAAIACIAAdNgAAAgQFtAEDAwgBAQQC"}
+00461{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"exe_download_as_png.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1569434903440,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"ts_msec":1569434903440,"pkt":"AAgCHEeuIOUqtpPxCABFAAAsESIAAIAG9SC5Yle5CgkZZQBQwC0vLgrVezzBl2AS+vAxRwAAAgQFtA=="}
+00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"exe_download_as_png.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1569434903440,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"ts_msec":1569434903440,"pkt":"IOUqtpPxAAgCHEeuCABFAAAoBlJAAIAGv\/QKCRlluWJXucAtAFB7PMGXLy4K1lAQ+vBJBAAA"}
+00772{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"exe_download_as_png.pcap","alias":"nDPId-test","flow_id":1,"flow_packets_processed":4,"flow_first_seen":1569434903040,"flow_last_seen":1569434903441,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":149,"flow_tot_l4_payload_len":149,"flow_avg_l4_payload_len":37,"midstream":0,"ts_msec":1569434903441,"l3_proto":"ip4","src_ip":"10.9.25.101","dst_ip":"185.98.87.185","src_port":49197,"dst_port":80,"l4_proto":"tcp","ndpi": {"flow_risk": {"12":"HTTP Numeric IP Address"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"185.98.87.185","url":"185.98.87.185\/tablone.png","code":0,"content_type":"","user_agent":"WinHTTP loader\/1.0"}}
+00829{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":6,"source":"exe_download_as_png.pcap","alias":"nDPId-test","flow_id":1,"flow_packets_processed":6,"flow_first_seen":1569434903040,"flow_last_seen":1569434904053,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":1609,"flow_avg_l4_payload_len":268,"midstream":0,"ts_msec":1569434904053,"l3_proto":"ip4","src_ip":"10.9.25.101","dst_ip":"185.98.87.185","src_port":49197,"dst_port":80,"l4_proto":"tcp","ndpi": {"flow_risk": {"4":"Binary application transfer","12":"HTTP Numeric IP Address"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"185.98.87.185","url":"185.98.87.185\/tablone.png","code":200,"content_type":"image\/png","user_agent":"WinHTTP loader\/1.0"}}
+00572{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":534,"source":"exe_download_as_png.pcap","alias":"nDPId-test","flow_id":1,"flow_packets_processed":534,"flow_first_seen":1569434903040,"flow_last_seen":1569434972556,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":500597,"flow_avg_l4_payload_len":937,"midstream":0,"ts_msec":1569434972556,"l3_proto":"ip4","src_ip":"10.9.25.101","dst_ip":"185.98.87.185","src_port":49197,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
+00168{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":534,"source":"exe_download_as_png.pcap","alias":"nDPId-test","total-events-serialized":9}
 ~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~
 ~~ packets captured/processed: 534/534
 ~~ skipped flows.............: 0
-~~ total layer4 data length..: 511293 bytes
+~~ total layer4 data length..: 500597 bytes
 ~~ total detected protocols..: 1
 ~~ total active/idle flows...: 1/1
+~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 1943609 bytes
-~~ total memory freed........: 1943609 bytes
+~~ total memory allocated....: 1943665 bytes
+~~ total memory freed........: 1943665 bytes
 ~~ total allocations/frees...: 35875/35875
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ json string min len.......: 145 chars
-~~ json string max len.......: 2380 chars
-~~ json string avg len.......: 1331 chars
+~~ json string min len.......: 173 chars
+~~ json string max len.......: 834 chars
+~~ json string avg len.......: 563 chars