bump libnDPI to 7c19de49047a5731f3107ff17854e9afe839cc61

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 433 insertions, 433 deletions

diff --git a/test/results/gnutella.pcap.out b/test/results/gnutella.pcap.out
index a3324eb5f..f1991cc43 100644
--- a/test/results/gnutella.pcap.out
+++ b/test/results/gnutella.pcap.out
@@ -3,58 +3,58 @@
 00259{"packet_event_id":1,"packet_event_name":"packet","packet_id":1,"source":"gnutella.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":4,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":4,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"AAAAAA=="}
 00516{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":140000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ffa4:e108","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3}
 00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":9752,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":78,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":78,"pkt_l4_len":24,"thread_ts_msec":9752,"pkt":"MzP\/pOEICAAn5uVZht1gAAAAABg6\/wAAAAAAAAAAAAAAAAAAAAD\/AgAAAAAAAAAAAAH\/pOEIhwAMIAAAAAD+gAAAAAAAAMUNUZ+WpOEI"}
-00577{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":140000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ffa4:e108","l4_proto":"icmp6","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
+00577{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":140000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ffa4:e108","l4_proto":"icmp6","ndpi": {"confidence": {"6":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
 00525{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":140000,"flow_min_l4_payload_len":8,"flow_max_l4_payload_len":8,"flow_tot_l4_payload_len":8,"flow_avg_l4_payload_len":8,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3}
 00445{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":9752,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":62,"pkt_l4_len":8,"thread_ts_msec":9752,"pkt":"MzMAAAACCAAn5uVZht1gAAAAAAg6\/\/6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAChQDu3AAAAAA="}
-00586{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":140000,"flow_min_l4_payload_len":8,"flow_max_l4_payload_len":8,"flow_tot_l4_payload_len":8,"flow_avg_l4_payload_len":8,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::2","l4_proto":"icmp6","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
+00586{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":140000,"flow_min_l4_payload_len":8,"flow_max_l4_payload_len":8,"flow_tot_l4_payload_len":8,"flow_avg_l4_payload_len":8,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::2","l4_proto":"icmp6","ndpi": {"confidence": {"6":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
 00530{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":140000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3}
 00482{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":9752,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":62,"pkt_len":90,"pkt_l4_len":28,"thread_ts_msec":9752,"pkt":"MzMAAAAWCAAn5uVZht1gAAAAACQAAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAWOgAFAgAAAQCPAAECAAAAAQQAAAD\/AgAAAAAAAAAAAAH\/pOEI"}
-00591{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":140000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
+00591{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":140000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","ndpi": {"confidence": {"6":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
 00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":10250,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":62,"pkt_len":90,"pkt_l4_len":28,"thread_ts_msec":10250,"pkt":"MzMAAAAWCAAn5uVZht1gAAAAACQAAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAWOgAFAgAAAQCPAAECAAAAAQQAAAD\/AgAAAAAAAAAAAAH\/pOEI"}
 00532{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":10750,"flow_last_seen":10750,"flow_idle_time":140000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":10750,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3}
 00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_last_seen":10750,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"thread_ts_msec":10750,"pkt":"MzMAAAABCAAn5uVZht1gAAAAACA6\/\/6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAABiAAnqSAAAAD+gAAAAAAAAMUNUZ+WpOEIAgEIACfm5Vk="}
-00593{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":10750,"flow_last_seen":10750,"flow_idle_time":140000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":10750,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1","l4_proto":"icmp6","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
+00593{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":10750,"flow_last_seen":10750,"flow_idle_time":140000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":10750,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1","l4_proto":"icmp6","ndpi": {"confidence": {"6":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
 00552{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12446,"flow_last_seen":12446,"flow_idle_time":200000,"flow_min_l4_payload_len":314,"flow_max_l4_payload_len":314,"flow_tot_l4_payload_len":314,"flow_avg_l4_payload_len":314,"midstream":0,"thread_ts_msec":12446,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00853{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_last_seen":12446,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":356,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":356,"pkt_l4_len":322,"thread_ts_msec":12446,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAAFWW8sAAIAR3cwAAAAA\/\/\/\/\/wBEAEMBQgLkAQEGAKZ4S30AAAAAAAAAAAAAAAAAAAAAAAAAAAgAJ+blWQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEDPQcBCAAn5uVZMgQKAAIPDAtNU0VER0VXSU4xMFEOAAAATVNFREdFV0lOMTA8CE1TRlQgNS4wNw4BAwYPHyErLC4vd3n5\/P8="}
-00730{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12446,"flow_last_seen":12446,"flow_idle_time":200000,"flow_min_l4_payload_len":314,"flow_max_l4_payload_len":314,"flow_tot_l4_payload_len":314,"flow_avg_l4_payload_len":314,"midstream":0,"thread_ts_msec":12446,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"hostname":"msedgewin10","fingerprint":"1,3,6,15,31,33,43,44,46,47,119,121,249,252","class_ident":"MSFT 5.0"}}
+00730{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12446,"flow_last_seen":12446,"flow_idle_time":200000,"flow_min_l4_payload_len":314,"flow_max_l4_payload_len":314,"flow_tot_l4_payload_len":314,"flow_avg_l4_payload_len":314,"midstream":0,"thread_ts_msec":12446,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"hostname":"msedgewin10","fingerprint":"1,3,6,15,31,33,43,44,46,47,119,121,249,252","class_ident":"MSFT 5.0"}}
 00547{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":8,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12447,"flow_last_seen":12447,"flow_idle_time":200000,"flow_min_l4_payload_len":548,"flow_max_l4_payload_len":548,"flow_tot_l4_payload_len":548,"flow_avg_l4_payload_len":548,"midstream":0,"thread_ts_msec":12447,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","src_port":67,"dst_port":68,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 01155{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_last_seen":12447,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"thread_ts_msec":12447,"pkt":"CAAn5uVZUlQAEjUCCABFEAJAAAAAAEARYI0KAAICCgACDwBDAEQCLAYSAgEGAKZ4S30AAAAACgACDwoAAg8KAAIEAAAAAAgAJ+blWQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATVNFZGdlIC0gV2luMTAucHhlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEFAQT\/\/\/8AAwQKAAICBgQKAAIDDwNsYW4zBAABUYA2BAoAAgL\/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="}
-00664{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12447,"flow_last_seen":12447,"flow_idle_time":200000,"flow_min_l4_payload_len":548,"flow_max_l4_payload_len":548,"flow_tot_l4_payload_len":548,"flow_avg_l4_payload_len":548,"midstream":0,"thread_ts_msec":12447,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","src_port":67,"dst_port":68,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"hostname":"","fingerprint":"","class_ident":""}}
+00664{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12447,"flow_last_seen":12447,"flow_idle_time":200000,"flow_min_l4_payload_len":548,"flow_max_l4_payload_len":548,"flow_tot_l4_payload_len":548,"flow_avg_l4_payload_len":548,"midstream":0,"thread_ts_msec":12447,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","src_port":67,"dst_port":68,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"hostname":"","fingerprint":"","class_ident":""}}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":9,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12461,"flow_last_seen":12461,"flow_idle_time":200000,"flow_min_l4_payload_len":91,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":91,"flow_avg_l4_payload_len":91,"midstream":0,"thread_ts_msec":12461,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00568{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_last_seen":12461,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":153,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":153,"pkt_l4_len":99,"thread_ts_msec":12461,"pkt":"MzMAAQACCAAn5uVZht1gDPpkAGMRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQACAiICIwBj3RcBE9HtAAgAAgAAAAEADgABAAEkIvGzCAAn5uVZAAMADAUIACcAAAAAAAAAAAAnAA0AC01TRURHRVdJTjEwABAADgAAATcACE1TRlQgNS4wAAYACAARABcAGAAn"}
-00623{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":9,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12461,"flow_last_seen":12461,"flow_idle_time":200000,"flow_min_l4_payload_len":91,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":91,"flow_avg_l4_payload_len":91,"midstream":0,"thread_ts_msec":12461,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"DHCPV6","breed":"Acceptable","category":"Network"}}
+00623{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":9,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12461,"flow_last_seen":12461,"flow_idle_time":200000,"flow_min_l4_payload_len":91,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":91,"flow_avg_l4_payload_len":91,"midstream":0,"thread_ts_msec":12461,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"DHCPV6","breed":"Acceptable","category":"Network"}}
 00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_last_seen":12512,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":62,"pkt_len":90,"pkt_l4_len":28,"thread_ts_msec":12512,"pkt":"MzMAAAAWCAAn5uVZht1gAAAAACQAAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAWOgAFAgAAAQCPAOC1AAAAAQQAAAD\/AgAAAAAAAAAAAAAAAAD7"}
 00514{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":11,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12513,"flow_last_seen":12513,"flow_idle_time":620000,"flow_min_l4_payload_len":16,"flow_max_l4_payload_len":16,"flow_tot_l4_payload_len":16,"flow_avg_l4_payload_len":16,"midstream":0,"thread_ts_msec":12513,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":3}
 00433{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_last_seen":12513,"flow_idle_time":620000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"thread_ts_msec":12513,"pkt":"AQBeAAAWCAAn5uVZCABGAAAoICwAAAECGH8KAAIP4AAAFpQEAAAiAPkCAAAAAQQAAADgAAD7"}
-00573{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12513,"flow_last_seen":12513,"flow_idle_time":620000,"flow_min_l4_payload_len":16,"flow_max_l4_payload_len":16,"flow_tot_l4_payload_len":16,"flow_avg_l4_payload_len":16,"midstream":0,"thread_ts_msec":12513,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.22","l4_proto":2,"ndpi": {"confidence": {"4":"DPI"},"proto":"IGMP","breed":"Acceptable","category":"Network"}}
+00573{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12513,"flow_last_seen":12513,"flow_idle_time":620000,"flow_min_l4_payload_len":16,"flow_max_l4_payload_len":16,"flow_tot_l4_payload_len":16,"flow_avg_l4_payload_len":16,"midstream":0,"thread_ts_msec":12513,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.22","l4_proto":2,"ndpi": {"confidence": {"6":"DPI"},"proto":"IGMP","breed":"Acceptable","category":"Network"}}
 00433{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_last_seen":12524,"flow_idle_time":620000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"thread_ts_msec":12524,"pkt":"AQBeAAAWCAAn5uVZCABGAAAoIC0AAAECGH4KAAIP4AAAFpQEAAAiAPkBAAAAAQQAAADgAAD8"}
 00433{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":3,"flow_last_seen":12527,"flow_idle_time":620000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"thread_ts_msec":12527,"pkt":"AQBeAAAWCAAn5uVZCABGAAAoIC4AAAECGH0KAAIP4AAAFpQEAAAiAPoBAAAAAQMAAADgAAD8"}
 00551{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":18,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00468{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_last_seen":12529,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"thread_ts_msec":12529,"pkt":"AQBeAAD7CAAn5uVZCABFAAA\/aF0AAAERZEcKAAIP4AAA+xTpFOkAK6\/OAAAAAAABAAAAAAAAC01TRURHRVdJTjEwBWxvY2FsAAD\/AAE="}
-00649{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":18,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"msedgewin10.local"}}
+00649{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":18,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"msedgewin10.local"}}
 00565{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":19,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00496{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_last_seen":12529,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":97,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":97,"pkt_l4_len":43,"thread_ts_msec":12529,"pkt":"MzMAAAD7CAAn5uVZht1gATieACsRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAD7FOkU6QArEAAAAAAAAAEAAAAAAAALTVNFREdFV0lOMTAFbG9jYWwAAP8AAQ=="}
-00663{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":19,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"msedgewin10.local"}}
+00663{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":19,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"msedgewin10.local"}}
 00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":20,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":63717,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_last_seen":12529,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":91,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":91,"pkt_l4_len":37,"thread_ts_msec":12529,"pkt":"MzMAAQADCAAn5uVZht1gD+kJACURAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQAD+OUU6wAl\/+MDXAAAAAEAAAAAAAALTVNFREdFV0lOMTAAAP8AAQ=="}
-00627{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":20,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":63717,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
+00627{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":20,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":63717,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
 00519{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_last_seen":12529,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":115,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":115,"pkt_l4_len":81,"thread_ts_msec":12529,"pkt":"AQBeAAD7CAAn5uVZCABFAABlaF4AAAERZCAKAAIP4AAA+xTpFOkAUYkoAACEAAAAAAIAAAAAC01TRURHRVdJTjEwBWxvY2FsAAAcAAEAAAA8ABD+gAAAAAAAAMUNUZ+WpOEIwAwAAQABAAAAPAAECgACDw=="}
-00658{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":21,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":108,"flow_avg_l4_payload_len":54,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"msedgewin10.local"}}
+00658{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":21,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":108,"flow_avg_l4_payload_len":54,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"msedgewin10.local"}}
 00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":22,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":63717,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00460{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_last_seen":12529,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"thread_ts_msec":12529,"pkt":"AQBeAAD8CAAn5uVZCABFAAA5pMYAAAERJ+MKAAIP4AAA\/PjlFOsAJZ66A1wAAAABAAAAAAAAC01TRURHRVdJTjEwAAD\/AAE="}
-00613{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":22,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":63717,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
+00613{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":22,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":63717,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
 00546{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_last_seen":12530,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":135,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":135,"pkt_l4_len":81,"thread_ts_msec":12530,"pkt":"MzMAAAD7CAAn5uVZht1gATieAFERAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAD7FOkU6QBR6VkAAIQAAAAAAgAAAAALTVNFREdFV0lOMTAFbG9jYWwAABwAAQAAADwAEP6AAAAAAAAAxQ1Rn5ak4QjADAABAAEAAAA8AAQKAAIP"}
-00672{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":23,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":12529,"flow_last_seen":12530,"flow_idle_time":200000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":108,"flow_avg_l4_payload_len":54,"midstream":0,"thread_ts_msec":12530,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"msedgewin10.local"}}
+00672{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":23,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":12529,"flow_last_seen":12530,"flow_idle_time":200000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":108,"flow_avg_l4_payload_len":54,"midstream":0,"thread_ts_msec":12530,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"msedgewin10.local"}}
 00549{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":33,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12827,"flow_last_seen":12827,"flow_idle_time":200000,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":68,"flow_avg_l4_payload_len":68,"midstream":0,"thread_ts_msec":12827,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00521{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":33,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_last_seen":12827,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":110,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":110,"pkt_l4_len":76,"thread_ts_msec":12827,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAABgHOwAAIARBJQKAAIPCgAC\/wCJAIkATEdqnCkpEAABAAAAAAABIEVORkRFRkVFRUhFRkZIRUpFT0RCREFDQUNBQ0FDQUFBAAAgAAHADAAgAAEABJPgAAYAAAoAAg8="}
-00610{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":33,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12827,"flow_last_seen":12827,"flow_idle_time":200000,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":68,"flow_avg_l4_payload_len":68,"midstream":0,"thread_ts_msec":12827,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":137,"dst_port":137,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"NetBIOS","breed":"Acceptable","category":"System"}}
+00610{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":33,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12827,"flow_last_seen":12827,"flow_idle_time":200000,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":68,"flow_avg_l4_payload_len":68,"midstream":0,"thread_ts_msec":12827,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":137,"dst_port":137,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"NetBIOS","breed":"Acceptable","category":"System"}}
 00521{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_last_seen":12827,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":110,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":110,"pkt_l4_len":76,"thread_ts_msec":12827,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAABgHO0AAIARBJMKAAIPCgAC\/wCJAIkATMtnnCopEAABAAAAAAABIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUFBAAAgAAHADAAgAAEABJPgAAaAAAoAAg8="}
 00573{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":37,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":13118,"flow_last_seen":13118,"flow_idle_time":200000,"flow_min_l4_payload_len":1091,"flow_max_l4_payload_len":1091,"flow_tot_l4_payload_len":1091,"flow_avg_l4_payload_len":1091,"midstream":0,"thread_ts_msec":13118,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 01911{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":37,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_last_seen":13118,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":1153,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1153,"pkt_l4_len":1099,"thread_ts_msec":13118,"pkt":"MzMAAAAMCAAn5uVZht1gB0PFBEsRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dYOdgRLOdU8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiIHhtbG5zOndzZHA9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDYvMDIvZGV2cHJvZiIgeG1sbnM6cHViPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvcHViLzIwMDUvMDciPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvSGVsbG88L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6YWMzNzRhY2YtOTJhYi00YWY1LWJkZDEtOTQ5ODVkYWViNDA3PC93c2E6TWVzc2FnZUlEPjx3c2Q6QXBwU2VxdWVuY2UgSW5zdGFuY2VJZD0iNDYiIFNlcXVlbmNlSWQ9InVybjp1dWlkOjc2NzM4OWUwLWVlOWEtNGMxYy1iOTAyLTIwY2I4MWQyMDNlMCIgTWVzc2FnZU51bWJlcj0iMSI+PC93c2Q6QXBwU2VxdWVuY2U+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6SGVsbG8+PHdzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NhOkFkZHJlc3M+dXJuOnV1aWQ6NzQ3ZjNkOTYtNjhhNy00M2YxLThjYmUtZThkNmRhZGQwMzU4PC93c2E6QWRkcmVzcz48L3dzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NkOlR5cGVzPndzZHA6RGV2aWNlIHB1YjpDb21wdXRlcjwvd3NkOlR5cGVzPjx3c2Q6WEFkZHJzPmh0dHA6Ly9bZmU4MDo6YzUwZDo1MTlmOjk2YTQ6ZTEwOF06NTM1Ny83NDdmM2Q5Ni02OGE3LTQzZjEtOGNiZS1lOGQ2ZGFkZDAzNTgvPC93c2Q6WEFkZHJzPjx3c2Q6TWV0YWRhdGFWZXJzaW9uPjI8L3dzZDpNZXRhZGF0YVZlcnNpb24+PC93c2Q6SGVsbG8+PC9zb2FwOkJvZHk+PC9zb2FwOkVudmVsb3BlPg=="}
-00631{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":37,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":13118,"flow_last_seen":13118,"flow_idle_time":200000,"flow_min_l4_payload_len":1091,"flow_max_l4_payload_len":1091,"flow_tot_l4_payload_len":1091,"flow_avg_l4_payload_len":1091,"midstream":0,"thread_ts_msec":13118,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
+00631{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":37,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":13118,"flow_last_seen":13118,"flow_idle_time":200000,"flow_min_l4_payload_len":1091,"flow_max_l4_payload_len":1091,"flow_tot_l4_payload_len":1091,"flow_avg_l4_payload_len":1091,"midstream":0,"thread_ts_msec":13118,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
 00565{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":38,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":13118,"flow_last_seen":13118,"flow_idle_time":200000,"flow_min_l4_payload_len":1073,"flow_max_l4_payload_len":1073,"flow_tot_l4_payload_len":1073,"flow_avg_l4_payload_len":1073,"midstream":0,"thread_ts_msec":13118,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 01861{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":38,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_last_seen":13118,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":1115,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1115,"pkt_l4_len":1081,"thread_ts_msec":13118,"pkt":"AQBef\/\/6CAAn5uVZCABFAARN4IUAAAER2REKAAIP7\/\/\/+vnVDnYEOdZOPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5IiB4bWxuczp3c2RwPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA2LzAyL2RldnByb2YiIHhtbG5zOnB1Yj0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93aW5kb3dzL3B1Yi8yMDA1LzA3Ij48c29hcDpIZWFkZXI+PHdzYTpUbz51cm46c2NoZW1hcy14bWxzb2FwLW9yZzp3czoyMDA1OjA0OmRpc2NvdmVyeTwvd3NhOlRvPjx3c2E6QWN0aW9uPmh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5L0hlbGxvPC93c2E6QWN0aW9uPjx3c2E6TWVzc2FnZUlEPnVybjp1dWlkOmZhMTdjZDkwLThmMzktNGY1Yi05ZTI4LWJmZjA4ZmI1Y2QwZTwvd3NhOk1lc3NhZ2VJRD48d3NkOkFwcFNlcXVlbmNlIEluc3RhbmNlSWQ9IjQ2IiBTZXF1ZW5jZUlkPSJ1cm46dXVpZDo3NjczODllMC1lZTlhLTRjMWMtYjkwMi0yMGNiODFkMjAzZTAiIE1lc3NhZ2VOdW1iZXI9IjEiPjwvd3NkOkFwcFNlcXVlbmNlPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOkhlbGxvPjx3c2E6RW5kcG9pbnRSZWZlcmVuY2U+PHdzYTpBZGRyZXNzPnVybjp1dWlkOjc0N2YzZDk2LTY4YTctNDNmMS04Y2JlLWU4ZDZkYWRkMDM1ODwvd3NhOkFkZHJlc3M+PC93c2E6RW5kcG9pbnRSZWZlcmVuY2U+PHdzZDpUeXBlcz53c2RwOkRldmljZSBwdWI6Q29tcHV0ZXI8L3dzZDpUeXBlcz48d3NkOlhBZGRycz5odHRwOi8vMTAuMC4yLjE1OjUzNTcvNzQ3ZjNkOTYtNjhhNy00M2YxLThjYmUtZThkNmRhZGQwMzU4Lzwvd3NkOlhBZGRycz48d3NkOk1ldGFkYXRhVmVyc2lvbj4yPC93c2Q6TWV0YWRhdGFWZXJzaW9uPjwvd3NkOkhlbGxvPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="}
-00623{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":38,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":13118,"flow_last_seen":13118,"flow_idle_time":200000,"flow_min_l4_payload_len":1073,"flow_max_l4_payload_len":1073,"flow_tot_l4_payload_len":1073,"flow_avg_l4_payload_len":1073,"midstream":0,"thread_ts_msec":13118,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
+00623{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":38,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":13118,"flow_last_seen":13118,"flow_idle_time":200000,"flow_min_l4_payload_len":1073,"flow_max_l4_payload_len":1073,"flow_tot_l4_payload_len":1073,"flow_avg_l4_payload_len":1073,"midstream":0,"thread_ts_msec":13118,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
 01861{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":41,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_last_seen":13322,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":1115,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1115,"pkt_l4_len":1081,"thread_ts_msec":13322,"pkt":"AQBef\/\/6CAAn5uVZCABFAARN4IYAAAER2RAKAAIP7\/\/\/+vnVDnYEOdZOPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5IiB4bWxuczp3c2RwPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA2LzAyL2RldnByb2YiIHhtbG5zOnB1Yj0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93aW5kb3dzL3B1Yi8yMDA1LzA3Ij48c29hcDpIZWFkZXI+PHdzYTpUbz51cm46c2NoZW1hcy14bWxzb2FwLW9yZzp3czoyMDA1OjA0OmRpc2NvdmVyeTwvd3NhOlRvPjx3c2E6QWN0aW9uPmh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5L0hlbGxvPC93c2E6QWN0aW9uPjx3c2E6TWVzc2FnZUlEPnVybjp1dWlkOmZhMTdjZDkwLThmMzktNGY1Yi05ZTI4LWJmZjA4ZmI1Y2QwZTwvd3NhOk1lc3NhZ2VJRD48d3NkOkFwcFNlcXVlbmNlIEluc3RhbmNlSWQ9IjQ2IiBTZXF1ZW5jZUlkPSJ1cm46dXVpZDo3NjczODllMC1lZTlhLTRjMWMtYjkwMi0yMGNiODFkMjAzZTAiIE1lc3NhZ2VOdW1iZXI9IjEiPjwvd3NkOkFwcFNlcXVlbmNlPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOkhlbGxvPjx3c2E6RW5kcG9pbnRSZWZlcmVuY2U+PHdzYTpBZGRyZXNzPnVybjp1dWlkOjc0N2YzZDk2LTY4YTctNDNmMS04Y2JlLWU4ZDZkYWRkMDM1ODwvd3NhOkFkZHJlc3M+PC93c2E6RW5kcG9pbnRSZWZlcmVuY2U+PHdzZDpUeXBlcz53c2RwOkRldmljZSBwdWI6Q29tcHV0ZXI8L3dzZDpUeXBlcz48d3NkOlhBZGRycz5odHRwOi8vMTAuMC4yLjE1OjUzNTcvNzQ3ZjNkOTYtNjhhNy00M2YxLThjYmUtZThkNmRhZGQwMzU4Lzwvd3NkOlhBZGRycz48d3NkOk1ldGFkYXRhVmVyc2lvbj4yPC93c2Q6TWV0YWRhdGFWZXJzaW9uPjwvd3NkOkhlbGxvPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="}
 01911{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":42,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_last_seen":13322,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":1153,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1153,"pkt_l4_len":1099,"thread_ts_msec":13322,"pkt":"MzMAAAAMCAAn5uVZht1gB0PFBEsRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dYOdgRLOdU8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiIHhtbG5zOndzZHA9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDYvMDIvZGV2cHJvZiIgeG1sbnM6cHViPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvcHViLzIwMDUvMDciPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvSGVsbG88L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6YWMzNzRhY2YtOTJhYi00YWY1LWJkZDEtOTQ5ODVkYWViNDA3PC93c2E6TWVzc2FnZUlEPjx3c2Q6QXBwU2VxdWVuY2UgSW5zdGFuY2VJZD0iNDYiIFNlcXVlbmNlSWQ9InVybjp1dWlkOjc2NzM4OWUwLWVlOWEtNGMxYy1iOTAyLTIwY2I4MWQyMDNlMCIgTWVzc2FnZU51bWJlcj0iMSI+PC93c2Q6QXBwU2VxdWVuY2U+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6SGVsbG8+PHdzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NhOkFkZHJlc3M+dXJuOnV1aWQ6NzQ3ZjNkOTYtNjhhNy00M2YxLThjYmUtZThkNmRhZGQwMzU4PC93c2E6QWRkcmVzcz48L3dzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NkOlR5cGVzPndzZHA6RGV2aWNlIHB1YjpDb21wdXRlcjwvd3NkOlR5cGVzPjx3c2Q6WEFkZHJzPmh0dHA6Ly9bZmU4MDo6YzUwZDo1MTlmOjk2YTQ6ZTEwOF06NTM1Ny83NDdmM2Q5Ni02OGE3LTQzZjEtOGNiZS1lOGQ2ZGFkZDAzNTgvPC93c2Q6WEFkZHJzPjx3c2Q6TWV0YWRhdGFWZXJzaW9uPjI8L3dzZDpNZXRhZGF0YVZlcnNpb24+PC93c2Q6SGVsbG8+PC9zb2FwOkJvZHk+PC9zb2FwOkVudmVsb3BlPg=="}
 00521{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":43,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":3,"flow_last_seen":13443,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":110,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":110,"pkt_l4_len":76,"thread_ts_msec":13443,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAABgHO4AAIARBJIKAAIPCgAC\/wCJAIkATEdmnCspEAABAAAAAAABIEVORkRFRkVFRUhFRkZIRUpFT0RCREFDQUNBQ0FDQUNBAAAgAAHADAAgAAEABJPgAAYAAAoAAg8="}
@@ -64,18 +64,18 @@
 00461{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":50,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":13765,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":70,"pkt_l4_len":16,"thread_ts_msec":13765,"pkt":"MzMAAAACCAAn5uVZht1gAAAAABA6\/\/6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAChQDYkwAAAAABAQgAJ+blWQ=="}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":82,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15284,"flow_last_seen":15284,"flow_idle_time":200000,"flow_min_l4_payload_len":137,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":137,"flow_avg_l4_payload_len":137,"midstream":0,"thread_ts_msec":15284,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00610{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":82,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_last_seen":15284,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":179,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":179,"pkt_l4_len":145,"thread_ts_msec":15284,"pkt":"AQBef\/\/6CAAn5uVZCABFAACl4I8AAAQR2a8KAAIP7\/\/\/+vnaB2wAkQ9eTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClNUOiB1cm46c2NoZW1hcy11cG5wLW9yZzpkZXZpY2U6SW50ZXJuZXRHYXRld2F5RGV2aWNlOjENCk1hbjogInNzZHA6ZGlzY292ZXIiDQpNWDogMw0KDQo="}
-00619{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":82,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15284,"flow_last_seen":15284,"flow_idle_time":200000,"flow_min_l4_payload_len":137,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":137,"flow_avg_l4_payload_len":137,"midstream":0,"thread_ts_msec":15284,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00619{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":82,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15284,"flow_last_seen":15284,"flow_idle_time":200000,"flow_min_l4_payload_len":137,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":137,"flow_avg_l4_payload_len":137,"midstream":0,"thread_ts_msec":15284,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00565{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":83,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15285,"flow_last_seen":15285,"flow_idle_time":200000,"flow_min_l4_payload_len":95,"flow_max_l4_payload_len":95,"flow_tot_l4_payload_len":95,"flow_avg_l4_payload_len":95,"midstream":0,"thread_ts_msec":15285,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63960,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00579{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":83,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_last_seen":15285,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":157,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":157,"pkt_l4_len":103,"thread_ts_msec":15285,"pkt":"MzMAAAAMCAAn5uVZht1gDyjoAGcRBP6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dgHbABnVAhNLVNFQVJDSCAqIEhUVFAvMS4xDQpIb3N0OiBbRkYwMjo6Q106MTkwMA0KU1Q6IHVwbnA6cm9vdGRldmljZQ0KTWFuOiAic3NkcDpkaXNjb3ZlciINCk1YOiAzDQoNCg=="}
-00623{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":83,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15285,"flow_last_seen":15285,"flow_idle_time":200000,"flow_min_l4_payload_len":95,"flow_max_l4_payload_len":95,"flow_tot_l4_payload_len":95,"flow_avg_l4_payload_len":95,"midstream":0,"thread_ts_msec":15285,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63960,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00623{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":83,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15285,"flow_last_seen":15285,"flow_idle_time":200000,"flow_min_l4_payload_len":95,"flow_max_l4_payload_len":95,"flow_tot_l4_payload_len":95,"flow_avg_l4_payload_len":95,"midstream":0,"thread_ts_msec":15285,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63960,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00562{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":84,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_last_seen":15285,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":143,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":143,"pkt_l4_len":109,"thread_ts_msec":15285,"pkt":"AQBef\/\/6CAAn5uVZCABFAACB4JAAAAQR2dIKAAIP7\/\/\/+vnaB2wAbXqpTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClNUOiB1cG5wOnJvb3RkZXZpY2UNCk1hbjogInNzZHA6ZGlzY292ZXIiDQpNWDogMw0KDQo="}
 00569{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":87,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":3,"flow_last_seen":15468,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":153,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":153,"pkt_l4_len":99,"thread_ts_msec":15468,"pkt":"MzMAAQACCAAn5uVZht1gA+R4AGMRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQACAiICIwBj2+oBE9HtAAgAAgEtAAEADgABAAEkIvGzCAAn5uVZAAMADAUIACcAAAAAAAAAAAAnAA0AC01TRURHRVdJTjEwABAADgAAATcACE1TRlQgNS4wAAYACAARABcAGAAn"}
 00569{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":88,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15469,"flow_last_seen":15469,"flow_idle_time":200000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":624,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":15469,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63965,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 01284{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":88,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_last_seen":15469,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":686,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":686,"pkt_l4_len":632,"thread_ts_msec":15469,"pkt":"MzMAAAAMCAAn5uVZht1gCQFeAngRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+d0OdgJ4bjk8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiIHhtbG5zOndzZHA9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDYvMDIvZGV2cHJvZiI+PHNvYXA6SGVhZGVyPjx3c2E6VG8+dXJuOnNjaGVtYXMteG1sc29hcC1vcmc6d3M6MjAwNTowNDpkaXNjb3Zlcnk8L3dzYTpUbz48d3NhOkFjdGlvbj5odHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA0L2Rpc2NvdmVyeS9Qcm9iZTwvd3NhOkFjdGlvbj48d3NhOk1lc3NhZ2VJRD51cm46dXVpZDozODVlNjBkOC0wOTJhLTRiMmItYmRmYy02YzJkMWQ1MGFjNDI8L3dzYTpNZXNzYWdlSUQ+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6UHJvYmU+PHdzZDpUeXBlcz53c2RwOkRldmljZTwvd3NkOlR5cGVzPjwvd3NkOlByb2JlPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="}
-00627{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":88,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15469,"flow_last_seen":15469,"flow_idle_time":200000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":624,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":15469,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63965,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
+00627{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":88,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15469,"flow_last_seen":15469,"flow_idle_time":200000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":624,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":15469,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63965,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":89,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15469,"flow_last_seen":15469,"flow_idle_time":200000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":624,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":15469,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63964,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 01258{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":89,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_last_seen":15469,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":666,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":666,"pkt_l4_len":632,"thread_ts_msec":15469,"pkt":"AQBef\/\/6CAAn5uVZCABFAAKM4JIAAAER2sUKAAIP7\/\/\/+vncDnYCeP4aPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5IiB4bWxuczp3c2RwPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA2LzAyL2RldnByb2YiPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvUHJvYmU8L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6Mzg1ZTYwZDgtMDkyYS00YjJiLWJkZmMtNmMyZDFkNTBhYzQyPC93c2E6TWVzc2FnZUlEPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOlByb2JlPjx3c2Q6VHlwZXM+d3NkcDpEZXZpY2U8L3dzZDpUeXBlcz48L3dzZDpQcm9iZT48L3NvYXA6Qm9keT48L3NvYXA6RW52ZWxvcGU+"}
-00619{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":89,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15469,"flow_last_seen":15469,"flow_idle_time":200000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":624,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":15469,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63964,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
+00619{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":89,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15469,"flow_last_seen":15469,"flow_idle_time":200000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":624,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":15469,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63964,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
 00579{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":90,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_last_seen":15500,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":157,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":157,"pkt_l4_len":103,"thread_ts_msec":15500,"pkt":"MzMAAAAMCAAn5uVZht1gDyjoAGcRBP6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dgHbABnVAhNLVNFQVJDSCAqIEhUVFAvMS4xDQpIb3N0OiBbRkYwMjo6Q106MTkwMA0KU1Q6IHVwbnA6cm9vdGRldmljZQ0KTWFuOiAic3NkcDpkaXNjb3ZlciINCk1YOiAzDQoNCg=="}
 00562{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":91,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":3,"flow_last_seen":15500,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":143,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":143,"pkt_l4_len":109,"thread_ts_msec":15500,"pkt":"AQBef\/\/6CAAn5uVZCABFAACB4JMAAAQR2c8KAAIP7\/\/\/+vnaB2wAbXqpTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClNUOiB1cG5wOnJvb3RkZXZpY2UNCk1hbjogInNzZHA6ZGlzY292ZXIiDQpNWDogMw0KDQo="}
 01284{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":93,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_last_seen":15624,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":686,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":686,"pkt_l4_len":632,"thread_ts_msec":15624,"pkt":"MzMAAAAMCAAn5uVZht1gCQFeAngRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+d0OdgJ4bjk8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiIHhtbG5zOndzZHA9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDYvMDIvZGV2cHJvZiI+PHNvYXA6SGVhZGVyPjx3c2E6VG8+dXJuOnNjaGVtYXMteG1sc29hcC1vcmc6d3M6MjAwNTowNDpkaXNjb3Zlcnk8L3dzYTpUbz48d3NhOkFjdGlvbj5odHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA0L2Rpc2NvdmVyeS9Qcm9iZTwvd3NhOkFjdGlvbj48d3NhOk1lc3NhZ2VJRD51cm46dXVpZDozODVlNjBkOC0wOTJhLTRiMmItYmRmYy02YzJkMWQ1MGFjNDI8L3dzYTpNZXNzYWdlSUQ+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6UHJvYmU+PHdzZDpUeXBlcz53c2RwOkRldmljZTwvd3NkOlR5cGVzPjwvd3NkOlByb2JlPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="}
@@ -84,26 +84,26 @@
 01259{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":100,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":3,"flow_last_seen":16062,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":666,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":666,"pkt_l4_len":632,"thread_ts_msec":16062,"pkt":"AQBef\/\/6CAAn5uVZCABFAAKM4JcAAAER2sAKAAIP7\/\/\/+vncDnYCeP4aPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5IiB4bWxuczp3c2RwPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA2LzAyL2RldnByb2YiPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvUHJvYmU8L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6Mzg1ZTYwZDgtMDkyYS00YjJiLWJkZmMtNmMyZDFkNTBhYzQyPC93c2E6TWVzc2FnZUlEPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOlByb2JlPjx3c2Q6VHlwZXM+d3NkcDpEZXZpY2U8L3dzZDpUeXBlcz48L3dzZDpQcm9iZT48L3NvYXA6Qm9keT48L3NvYXA6RW52ZWxvcGU+"}
 00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":101,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":16487,"flow_last_seen":16487,"flow_idle_time":200000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":16487,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00699{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":101,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_last_seen":16487,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":243,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":243,"pkt_l4_len":209,"thread_ts_msec":16487,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAADlHPgAAIARBAMKAAIPCgAC\/wCKAIoA0aFXEQKcLAoAAg8AigC7AAAgRU5GREVGRUVFSEVGRkhFSkVPREJEQUNBQ0FDQUNBQ0EAIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUJOAP9TTUIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQAAIQAAAAAAAAAAAOgDAAAAAAAAAAAhAFYAAwABAAAAAgAyAFxNQUlMU0xPVFxCUk9XU0UAAQBg6gAATVNFREdFV0lOMTAAAAAAAAoAAxAAAA8BVaoA"}
-00739{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":101,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":16487,"flow_last_seen":16487,"flow_idle_time":200000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":16487,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
+00739{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":101,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":16487,"flow_last_seen":16487,"flow_idle_time":200000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":16487,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
 00462{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":104,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":17749,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":70,"pkt_l4_len":16,"thread_ts_msec":17749,"pkt":"MzMAAAACCAAn5uVZht1gAAAAABA6\/\/6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAChQDYkwAAAAABAQgAJ+blWQ=="}
 00580{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":107,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":3,"flow_last_seen":18297,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":157,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":157,"pkt_l4_len":103,"thread_ts_msec":18297,"pkt":"MzMAAAAMCAAn5uVZht1gDyjoAGcRBP6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dgHbABnVAhNLVNFQVJDSCAqIEhUVFAvMS4xDQpIb3N0OiBbRkYwMjo6Q106MTkwMA0KU1Q6IHVwbnA6cm9vdGRldmljZQ0KTWFuOiAic3NkcDpkaXNjb3ZlciINCk1YOiAzDQoNCg=="}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":125,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40005,"flow_last_seen":40005,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":40005,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":55708,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00659{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":125,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_last_seen":40005,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":40005,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4KUAAAER3HQKAAIP7\/\/\/+tmcB2wAthOSTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"}
-00620{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":125,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40005,"flow_last_seen":40005,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":40005,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":55708,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00620{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":125,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40005,"flow_last_seen":40005,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":40005,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":55708,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00474{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":126,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":3,"flow_last_seen":40185,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"thread_ts_msec":40185,"pkt":"AQBeAAD7CAAn5uVZCABFAABEaF8AAAERZEAKAAIP4AAA+xTpFOkAMJ6ZAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
 00504{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":127,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":3,"flow_last_seen":40185,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"thread_ts_msec":40185,"pkt":"MzMAAAD7CAAn5uVZht1gBGNuADARAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw\/soAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
 00568{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":133,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":62539,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":133,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_last_seen":40232,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"thread_ts_msec":40232,"pkt":"MzMAAQADCAAn5uVZht1gAihOACARAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQAD9EsU6wAgDPv9UAAAAAEAAAAAAAAGcHVwcGV0AAABAAE="}
-00628{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":133,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":62539,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
+00628{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":133,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":62539,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
 00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":134,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":62539,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":134,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_last_seen":40232,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":40232,"pkt":"AQBeAAD8CAAn5uVZCABFAAA0pMcAAAERJ+cKAAIP4AAA\/PRLFOsAIKvR\/VAAAAABAAAAAAAABnB1cHBldAAAAQAB"}
-00614{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":134,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":62539,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
+00614{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":134,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":62539,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
 00568{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":135,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":50435,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":135,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_last_seen":40232,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"thread_ts_msec":40232,"pkt":"MzMAAQADCAAn5uVZht1gAiZUACARAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQADxQMU6wAgtlmDHwAAAAEAAAAAAAAGcHVwcGV0AAAcAAE="}
-00628{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":135,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":50435,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
+00628{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":135,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":50435,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
 00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":136,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":50435,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":136,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_last_seen":40232,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":40232,"pkt":"AQBeAAD8CAAn5uVZCABFAAA0pMgAAAERJ+YKAAIP4AAA\/MUDFOsAIFUwgx8AAAABAAAAAAAABnB1cHBldAAAHAAB"}
-00614{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":136,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":50435,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
+00614{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":136,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":50435,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
 00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":137,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_last_seen":40630,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"thread_ts_msec":40630,"pkt":"MzMAAQADCAAn5uVZht1gAiZUACARAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQADxQMU6wAgtlmDHwAAAAEAAAAAAAAGcHVwcGV0AAAcAAE="}
 00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":138,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_last_seen":40630,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"thread_ts_msec":40630,"pkt":"MzMAAQADCAAn5uVZht1gAihOACARAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQAD9EsU6wAgDPv9UAAAAAEAAAAAAAAGcHVwcGV0AAABAAE="}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":139,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_last_seen":40630,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":40630,"pkt":"AQBeAAD8CAAn5uVZCABFAAA0pMkAAAERJ+UKAAIP4AAA\/MUDFOsAIFUwgx8AAAABAAAAAAAABnB1cHBldAAAHAAB"}
@@ -150,11 +150,11 @@
 00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":178,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":3,"flow_last_seen":63234,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":63234,"pkt":"UlQAEjUCCAAn5uVZCABFAAAouwVAAIAG0BMKAAIPL5M0FcQXj3g4QcNPAGOcAlAQ+vBZpgAA"}
 00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":179,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_last_seen":63250,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":63250,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAocAAEAGiwHa+gY7CgACDzEMxBQAZJYBrKXgdGAS\/\/+SMQAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":180,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":3,"flow_last_seen":63250,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":63250,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoLR5AAIAG4G0KAAIP2voGO8QUMQyspeB0AGSWAlAQ+vCu\/QAA"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":181,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":38,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":63001,"flow_last_seen":63261,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":63261,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":50199,"dst_port":36728,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":182,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":35,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":63000,"flow_last_seen":63261,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":63261,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.250.6.59","src_port":50196,"dst_port":12556,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":181,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":38,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":63001,"flow_last_seen":63261,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":63261,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":50199,"dst_port":36728,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":182,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":35,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":63000,"flow_last_seen":63261,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":63261,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.250.6.59","src_port":50196,"dst_port":12556,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":185,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_last_seen":63297,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":63297,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAooAAEAG5kR2qA9HCgACDw9bxBUAZZABIZ4f2mAS\/\/9gyQAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":186,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":3,"flow_last_seen":63297,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":63297,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoTFBAAIAGHIIKAAIPdqgPR8QVD1shnh\/aAGWQAlAQ+vB9lQAA"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":187,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":36,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":63001,"flow_last_seen":63309,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":63309,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":50197,"dst_port":3931,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":187,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":36,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":63001,"flow_last_seen":63309,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":63309,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":50197,"dst_port":3931,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":203,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":42,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":64030,"flow_last_seen":64030,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":64030,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":50202,"dst_port":57648,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":203,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_last_seen":64030,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":64030,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0GZhAAIAG6a4KAAIPPe6tgMQa4TAr3W0hAAAAAIAC+vA+WAAAAgQFtAEDAwgBAQQC"}
 00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":43,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":64031,"flow_last_seen":64031,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":64031,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":50203,"dst_port":18994,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
@@ -170,10 +170,10 @@
 00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":209,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":2,"flow_last_seen":64213,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":64213,"pkt":"CAAn5uVZUlQAEjUCCABFAAAoApQAAP8Gwb497q2ACgACD+EwxBoAAAAAK91tIlAUAAB6CAAA"}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":210,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":2,"flow_last_seen":64275,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":64275,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsApUAAEAGjec93qBjCgACD0oyxBsAZ4QBK6ojSGAS\/\/\/MHQAAAgQFtA=="}
 00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":211,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":3,"flow_last_seen":64276,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":64276,"pkt":"UlQAEjUCCAAn5uVZCABFAAAocDVAAIAGoEoKAAIPPd6gY8QbSjIrqiNIAGeEAlAQ+vDo6QAA"}
-00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":212,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":43,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":64031,"flow_last_seen":64276,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":64276,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":50203,"dst_port":18994,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":212,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":43,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":64031,"flow_last_seen":64276,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":64276,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":50203,"dst_port":18994,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":214,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":2,"flow_last_seen":64291,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":64291,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsApcAAEAGH32vtZz0CgACDyA\/xB4AaH4BbaXa1mAS\/\/+UGgAAAgQFtA=="}
 00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":215,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":3,"flow_last_seen":64291,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":64291,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoyBJAAIAG2gQKAAIPr7Wc9MQeID9tpdrWAGh+AlAQ+vCw5gAA"}
-00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":216,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":46,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":64032,"flow_last_seen":64291,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":304,"flow_tot_l4_payload_len":304,"flow_avg_l4_payload_len":76,"midstream":0,"thread_ts_msec":64291,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.181.156.244","src_port":50206,"dst_port":8255,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":216,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":46,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":64032,"flow_last_seen":64291,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":304,"flow_tot_l4_payload_len":304,"flow_avg_l4_payload_len":76,"midstream":0,"thread_ts_msec":64291,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.181.156.244","src_port":50206,"dst_port":8255,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":227,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":3,"flow_last_seen":64717,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":64717,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0GZlAAIAG6a0KAAIPPe6tgMQa4TAr3W0hAAAAAIAC+vA+WAAAAgQFtAEDAwgBAQQC"}
 00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":229,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":48,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":65061,"flow_last_seen":65061,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":65061,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":50208,"dst_port":8683,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":229,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_last_seen":65061,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":65061,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0q8tAAIAGVuYKAAIPd+10FsQgIevuSsSrAAAAAIAC+vDjCgAAAgQFtAEDAwgBAQQC"}
@@ -189,12 +189,12 @@
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":234,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_last_seen":65063,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":65063,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0DWpAAIAG8s4KAAIPVXWZB8Qlw9oAc\/5TAAAAAIAC+vDyzAAAAgQFtAEDAwgBAQQC"}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":54,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":65065,"flow_last_seen":65065,"flow_idle_time":200000,"flow_min_l4_payload_len":182,"flow_max_l4_payload_len":182,"flow_tot_l4_payload_len":182,"flow_avg_l4_payload_len":182,"midstream":0,"thread_ts_msec":65065,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57623,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00671{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_last_seen":65065,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":224,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":224,"pkt_l4_len":190,"thread_ts_msec":65065,"pkt":"AQBef\/\/6CAAn5uVZCABFAADS4KkAAAER3GgKAAIP7\/\/\/+uEXB2wAvizBTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClVTRVItQUdFTlQ6IGd0ay1nbnV0ZWxsYS8xLjIuMiAoMjAyMi0wMi0yNSkNCk1BTjogInNzZHA6ZGlzY292ZXIiDQpTVDogdXJuOnNjaGVtYXMtdXBucC1vcmc6ZGV2aWNlOkludGVybmV0R2F0ZXdheURldmljZToyDQpNWDogMw0KDQo="}
-00620{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":54,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":65065,"flow_last_seen":65065,"flow_idle_time":200000,"flow_min_l4_payload_len":182,"flow_max_l4_payload_len":182,"flow_tot_l4_payload_len":182,"flow_avg_l4_payload_len":182,"midstream":0,"thread_ts_msec":65065,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57623,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00620{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":54,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":65065,"flow_last_seen":65065,"flow_idle_time":200000,"flow_min_l4_payload_len":182,"flow_max_l4_payload_len":182,"flow_tot_l4_payload_len":182,"flow_avg_l4_payload_len":182,"midstream":0,"thread_ts_msec":65065,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57623,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00671{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":236,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":2,"flow_last_seen":65065,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":224,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":224,"pkt_l4_len":190,"thread_ts_msec":65065,"pkt":"AQBef\/\/6CAAn5uVZCABFAADS4KoAAAER3GcKAAIP7\/\/\/+uEXB2wAvi3BTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClVTRVItQUdFTlQ6IGd0ay1nbnV0ZWxsYS8xLjIuMiAoMjAyMi0wMi0yNSkNCk1BTjogInNzZHA6ZGlzY292ZXIiDQpTVDogdXJuOnNjaGVtYXMtdXBucC1vcmc6ZGV2aWNlOkludGVybmV0R2F0ZXdheURldmljZToxDQpNWDogMw0KDQo="}
 00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":237,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":3,"flow_last_seen":65065,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":219,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":219,"pkt_l4_len":185,"thread_ts_msec":65065,"pkt":"AQBef\/\/6CAAn5uVZCABFAADN4KsAAAER3GsKAAIP7\/\/\/+uEXB2wAuZDETS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClVTRVItQUdFTlQ6IGd0ay1nbnV0ZWxsYS8xLjIuMiAoMjAyMi0wMi0yNSkNCk1BTjogInNzZHA6ZGlzY292ZXIiDQpTVDogdXJuOnNjaGVtYXMtdXBucC1vcmc6c2VydmljZTpXQU5JUENvbm5lY3Rpb246Mg0KTVg6IDMNCg0K"}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":241,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":2,"flow_last_seen":65240,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":65240,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAp8AAEAGUxwOxwo8CgACD1uixCMAa2wB\/Z82JWAS\/\/+zDQAAAgQFtA=="}
 00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":242,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":3,"flow_last_seen":65241,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":65241,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoSFFAAIAGjW0KAAIPDscKPMQjW6L9nzYlAGtsAlAQ+vDP2QAA"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":243,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":51,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":65062,"flow_last_seen":65241,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":65241,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.199.10.60","src_port":50211,"dst_port":23458,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":243,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":51,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":65062,"flow_last_seen":65241,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":65241,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.199.10.60","src_port":50211,"dst_port":23458,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":252,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_last_seen":66017,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":66017,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xttAAIAGndgKAAIPsIDZgMQYsIr8Y98AAAAAAIAC+vCOBwAAAgQFtAEDAwgBAQQC"}
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":253,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":2,"flow_last_seen":66017,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":66017,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0B1tAAIAGzIQKAAIPVoHEVMQWJrsID0+\/AAAAAIAC+vAKmwAAAgQFtAEDAwgBAQQC"}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":254,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":2,"flow_last_seen":66017,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":66017,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Iq1AAIAGH9UKAAIPTnpducQZGMpcVbolAAAAAIAC+vDIfgAAAgQFtAEDAwgBAQQC"}
@@ -248,7 +248,7 @@
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":284,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":3,"flow_last_seen":68170,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68170,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0k7pAAIAGcS8KAAIPJOnE4sQsDuwTBJqfAAAAAIAC+vD9iAAAAgQFtAEDAwgBAQQC"}
 00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":286,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":2,"flow_last_seen":68368,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":68368,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAqgAAEAGVIJ08aKiCgACDz09xDIAcUgB9bSpG2AS\/\/+LwQAAAgQFtA=="}
 00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":287,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":3,"flow_last_seen":68368,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":68368,"pkt":"UlQAEjUCCAAn5uVZCABFAAAobmNAAIAGaMoKAAIPdPGiosQyPT31tKkbAHFIAlAQ+vCojQAA"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":67,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":68108,"flow_last_seen":68372,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":68372,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":50226,"dst_port":15677,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":67,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":68108,"flow_last_seen":68372,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":68372,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":50226,"dst_port":15677,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":290,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":2,"flow_last_seen":68425,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":68425,"pkt":"CAAn5uVZUlQAEjUCCABFAAAoAqoAAP8GHcZv8R9gCgACDzgwxDQAAAAAU1SN+lAUAAA2vQAA"}
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":298,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":3,"flow_last_seen":68935,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68935,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0KIpAAIAGNtoKAAIPb\/EfYMQ0ODBTVI35AAAAAIAC+vD7DAAAAgQFtAEDAwgBAQQC"}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":299,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":2,"flow_last_seen":69076,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":69076,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0ZdpAAIAGUVsKAAIPtpuA5MQoDLg79XydAAAAAIAC+vCnHQAAAgQFtAEDAwgBAQQC"}
@@ -271,17 +271,17 @@
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":311,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":1,"flow_last_seen":69142,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":69142,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0lydAAIAGNGMKAAIPWHvKr8Q9lBZfEvXQAAAAAIAC+vCXrgAAAgQFtAEDAwgBAQQC"}
 00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":312,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":2,"flow_last_seen":69169,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":69169,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAq8AAEAGhyBdHYfRCgACDxjKxDwAczwBOuMML2AS\/\/9GjAAAAgQFtA=="}
 00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":313,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":3,"flow_last_seen":69169,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":69169,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoZ6tAAIAGoicKAAIPXR2H0cQ8GMo64wwvAHM8AlAQ+vBjWAAA"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":314,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":77,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":69142,"flow_last_seen":69174,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":302,"flow_tot_l4_payload_len":302,"flow_avg_l4_payload_len":75,"midstream":0,"thread_ts_msec":69174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.29.135.209","src_port":50236,"dst_port":6346,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":314,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":77,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":69142,"flow_last_seen":69174,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":302,"flow_tot_l4_payload_len":302,"flow_avg_l4_payload_len":75,"midstream":0,"thread_ts_msec":69174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.29.135.209","src_port":50236,"dst_port":6346,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":316,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":2,"flow_last_seen":69182,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":69182,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsArEAAEAGyG4tWHZGCgACDxr6xDsAdDYBRmqi+GAS\/\/\/pWwAAAgQFtA=="}
 00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":317,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":3,"flow_last_seen":69182,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":69182,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoAgRAAIAGSR8KAAIPLVh2RsQ7GvpGaqL4AHQ2AlAQ+vAGKAAA"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":318,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":76,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":69142,"flow_last_seen":69182,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":69182,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.118.70","src_port":50235,"dst_port":6906,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":318,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":76,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":69142,"flow_last_seen":69182,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":69182,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.118.70","src_port":50235,"dst_port":6906,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":327,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":3,"flow_last_seen":69360,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":69360,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsArgAAEAG3qdZSzQTCgACD7O6xBEAXroBd2GZhGAS\/\/+7lwAAAgQFtA=="}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":328,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":3,"flow_last_seen":69360,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":69360,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsArkAAEAG56stQVcYCgACDz9JxBAAXcABhPHErWAS\/\/\/6VgAAAgQFtA=="}
 00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":329,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":3,"flow_last_seen":69360,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":69360,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAroAAEAG+PjPJqPkCgACDxp6xA8AYK4B6qFHeGAS\/\/9Z9wAAAgQFtA=="}
 00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":330,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":3,"flow_last_seen":69360,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":69360,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsArsAAEAG2+NQjD+TCgACD3NpxA4AX7QBeWsMs2AS\/\/+J8QAAAgQFtA=="}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":331,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":2,"flow_last_seen":69360,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":69360,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsArwAAEAGwoS2m\/LhCgACDzrcxDgAdioBOrzIf2AS\/\/+1wgAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":332,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":3,"flow_last_seen":69360,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":69360,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoLcFAAIAGF4MKAAIPtpvy4cQ4Otw6vMh\/AHYqAlAQ+vDSjgAA"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":333,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":73,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":69141,"flow_last_seen":69361,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":69361,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.242.225","src_port":50232,"dst_port":15068,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":333,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":73,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":69141,"flow_last_seen":69361,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":69361,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.242.225","src_port":50232,"dst_port":15068,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":343,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":2,"flow_last_seen":70110,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70110,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0UtFAAIAGDgYKAAIPTn0\/YcQwGMq9KdLlAAAAAIAC+vBtKAAAAgQFtAEDAwgBAQQC"}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":344,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":2,"flow_last_seen":70110,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70110,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0faJAAIAGiKUKAAIPO2itBcQtwyRMUgplAAAAAIAC+vChmQAAAgQFtAEDAwgBAQQC"}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":345,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":2,"flow_last_seen":70110,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70110,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0R01AAIAGN+QKAAIPdqf43MQv9oQzn2SqAAAAAIAC+vCljgAAAgQFtAEDAwgBAQQC"}
@@ -324,10 +324,10 @@
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":371,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":1,"flow_last_seen":71205,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71205,"pkt":"UlQAEjUCCAAn5uVZCABFAAA08yJAAIAG8AwKAAIPVtC0tcRJszsghBY3AAAAAIAC+vCuSgAAAgQFtAEDAwgBAQQC"}
 00519{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":372,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71216,"flow_last_seen":71216,"flow_idle_time":140000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":71216,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3}
 00461{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":372,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":1,"flow_last_seen":71216,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":71216,"pkt":"CAAn5uVZUlQAEjUCCABFwAA4AsYAAP8BoC4KAAICCgACDwMBntkAAAAARQAANGWZQAB\/BrMICgACD0xEis\/EN7AX1ucS7g=="}
-00597{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":372,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71216,"flow_last_seen":71216,"flow_idle_time":140000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":71216,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":4.521641}
+00597{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":372,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71216,"flow_last_seen":71216,"flow_idle_time":140000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":71216,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"6":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":4.521641}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":373,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":2,"flow_last_seen":71312,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":71312,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAscAAEAGYHFW0LS1CgACD7M7xEkAehIBIIQWOGAS\/\/+\/xQAAAgQFtA=="}
 00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":374,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":3,"flow_last_seen":71312,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":71312,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo8yNAAIAG8BcKAAIPVtC0tcRJszsghBY4AHoSAlAQ+vDckQAA"}
-00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":375,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":94,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":71205,"flow_last_seen":71313,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":303,"flow_tot_l4_payload_len":303,"flow_avg_l4_payload_len":75,"midstream":0,"thread_ts_msec":71313,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.208.180.181","src_port":50249,"dst_port":45883,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":375,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":94,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":71205,"flow_last_seen":71313,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":303,"flow_tot_l4_payload_len":303,"flow_avg_l4_payload_len":75,"midstream":0,"thread_ts_msec":71313,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.208.180.181","src_port":50249,"dst_port":45883,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":381,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":96,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71535,"flow_last_seen":71535,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71535,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.160.214.137","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":381,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":1,"flow_last_seen":71535,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71535,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gnYAAIARfQoKAAIPWKDWiXAJGMoAINufR05EED6TAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":382,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":97,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71535,"flow_last_seen":71535,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71535,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.78.134.188","src_port":28681,"dst_port":49046,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
@@ -376,7 +376,7 @@
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":403,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":1,"flow_last_seen":71541,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71541,"pkt":"UlQAEjUCCAAn5uVZCABFAAA02U0AAIAREUUKAAIPBbQ+ZHAJtTEAICo0R05EED6pAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":405,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":2,"flow_last_seen":71605,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":71605,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAswAAEAGY0Nt1prYCgACDxjKxEgAewwBHNfF\/mAS\/\/+29AAAAgQFtA=="}
 00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":406,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":3,"flow_last_seen":71605,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":71605,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo5AxAAIAGAgYKAAIPbdaa2MRIGMoc18X+AHsMAlAQ+vDTwAAA"}
-00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":407,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":93,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":71205,"flow_last_seen":71608,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":304,"flow_tot_l4_payload_len":304,"flow_avg_l4_payload_len":76,"midstream":0,"thread_ts_msec":71608,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.214.154.216","src_port":50248,"dst_port":6346,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":407,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":93,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":71205,"flow_last_seen":71608,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":304,"flow_tot_l4_payload_len":304,"flow_avg_l4_payload_len":76,"midstream":0,"thread_ts_msec":71608,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.214.154.216","src_port":50248,"dst_port":6346,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":411,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":3,"flow_last_seen":72031,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72031,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0B1xAAIAGzIMKAAIPVoHEVMQWJrsID0+\/AAAAAIAC+vAKmwAAAgQFtAEDAwgBAQQC"}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":412,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":3,"flow_last_seen":72031,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72031,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xtxAAIAGndcKAAIPsIDZgMQYsIr8Y98AAAAAAIAC+vCOBwAAAgQFtAEDAwgBAQQC"}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":413,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":3,"flow_last_seen":72031,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72031,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Iq5AAIAGH9QKAAIPTnpducQZGMpcVbolAAAAAIAC+vDIfgAAAgQFtAEDAwgBAQQC"}
@@ -395,13 +395,13 @@
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":1,"flow_last_seen":72267,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72267,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gnJAAIAGzTgKAAIPGE6GvMROv5bJBoRLAAAAAIAC+vD3zgAAAgQFtAEDAwgBAQQC"}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":422,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":2,"flow_last_seen":72462,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":72462,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAs8AAEAGtlsbXpo1CgACDxjKxEoAfQABvj80X2AS\/\/8GQwAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":423,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":3,"flow_last_seen":72462,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":72462,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoalRAAIAGztkKAAIPG16aNcRKGMq+PzRfAH0AAlAQ+vAjDwAA"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":424,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":119,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72264,"flow_last_seen":72463,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":72463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"27.94.154.53","src_port":50250,"dst_port":6346,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":424,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":119,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72264,"flow_last_seen":72463,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":72463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"27.94.154.53","src_port":50250,"dst_port":6346,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":426,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":121,"flow_packet_id":2,"flow_last_seen":72471,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":72471,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAtEAAEAG0LF7yh9xCgACD004xEwAfvQBVTNjAWAS\/\/8ykwAAAgQFtA=="}
 00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":427,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":121,"flow_packet_id":3,"flow_last_seen":72472,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":72472,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoVqZAAIAG\/N8KAAIPe8ofccRMTThVM2MBAH70AlAQ+vBPXwAA"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":428,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":121,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72266,"flow_last_seen":72472,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":72472,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.202.31.113","src_port":50252,"dst_port":19768,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":428,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":121,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72266,"flow_last_seen":72472,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":72472,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.202.31.113","src_port":50252,"dst_port":19768,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":433,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":2,"flow_last_seen":72595,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":72595,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAtUAAEAGmJxn6GtkCgACD6n0xE0Af+4BiO6DFWAS\/\/9P9AAAAgQFtA=="}
 00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":434,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":3,"flow_last_seen":72596,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":72596,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo0UVAAIAGSi8KAAIPZ+hrZMRNqfSI7oMVAH\/uAlAQ+vBswAAA"}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":435,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":122,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72266,"flow_last_seen":72596,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":72596,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":50253,"dst_port":43508,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":435,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":122,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72266,"flow_last_seen":72596,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":72596,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":50253,"dst_port":43508,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":450,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":124,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72848,"flow_last_seen":72848,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72848,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"170.254.19.6","src_port":28681,"dst_port":24180,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":450,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":1,"flow_last_seen":72848,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72848,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0XAwAAIARFJoKAAIPqv4TBnAJXnQAIAcER05EED6qAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":125,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72849,"flow_last_seen":72849,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72849,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.92.178.182","src_port":28681,"dst_port":57302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
@@ -477,10 +477,10 @@
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":506,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":1,"flow_last_seen":74329,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74329,"pkt":"UlQAEjUCCAAn5uVZCABFAAA07XNAAIAG0w0KAAIPUD3d9sRWd3H5FzmMAAAAAIAC+vDLcAAAAgQFtAEDAwgBAQQC"}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":507,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":2,"flow_last_seen":74362,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":74362,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAuYAAEAGPaRQPd32CgACD3dxxFYAg9YB+Rc5jWAS\/\/8Y4gAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":508,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":3,"flow_last_seen":74362,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":74362,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo7XRAAIAG0xgKAAIPUD3d9sRWd3H5FzmNAIPWAlAQ+vA1rgAA"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":509,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":149,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":74329,"flow_last_seen":74362,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":74362,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":50262,"dst_port":30577,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":509,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":149,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":74329,"flow_last_seen":74362,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":74362,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":50262,"dst_port":30577,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":517,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":2,"flow_last_seen":74510,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":74510,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAuwAAEAGWa63s1pwCgACDyZ8xFMAhNABNL0aJWAS\/\/9vrAAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":518,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":3,"flow_last_seen":74510,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":74510,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo4oxAAIAG+hAKAAIPt7NacMRTJnw0vRolAITQAlAQ+vCMeAAA"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":519,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":146,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":74327,"flow_last_seen":74511,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":74511,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.90.112","src_port":50259,"dst_port":9852,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":519,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":146,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":74327,"flow_last_seen":74511,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":74511,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.90.112","src_port":50259,"dst_port":9852,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":527,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":3,"flow_last_seen":75077,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75077,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0ZdtAAIAGUVoKAAIPtpuA5MQoDLg79XydAAAAAIAC+vCnHQAAAgQFtAEDAwgBAQQC"}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":528,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":3,"flow_last_seen":75077,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75077,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0FTlAAIAG3SgKAAIPUMGrksQm0jCYt6bIAAAAAIAC+vCV5QAAAgQFtAEDAwgBAQQC"}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":529,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":3,"flow_last_seen":75077,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75077,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0d8RAAIAGrlIKAAIPcfxWosQp1q4KULlcAAAAAIAC+vBA7QAAAgQFtAEDAwgBAQQC"}
@@ -499,7 +499,7 @@
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":539,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":153,"flow_packet_id":1,"flow_last_seen":75359,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75359,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0DLlAAIAGV04KAAIP20avZ8RaENsT5fMFAAAAAIAC+vABQgAAAgQFtAEDAwgBAQQC"}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":540,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":2,"flow_last_seen":75482,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":75482,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAvIAAEAGpZCcOSoCCgACD4LExFUAh74BMu52DGAS\/\/8XLwAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":541,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":3,"flow_last_seen":75482,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":75482,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoZAVAAIAGxIAKAAIPnDkqAsRVgsQy7nYMAIe+AlAQ+vAz+wAA"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":542,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":148,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":74328,"flow_last_seen":75501,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":597,"flow_tot_l4_payload_len":597,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":75501,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"156.57.42.2","src_port":50261,"dst_port":33476,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":542,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":148,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":74328,"flow_last_seen":75501,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":597,"flow_tot_l4_payload_len":597,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":75501,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"156.57.42.2","src_port":50261,"dst_port":33476,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":545,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":153,"flow_packet_id":2,"flow_last_seen":75731,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":75731,"pkt":"CAAn5uVZUlQAEjUCCABFAAAoAvQAAP8GIh\/bRq9nCgACDxDbxFoAAAAAE+XzBlAUAAA88gAA"}
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":546,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":3,"flow_last_seen":76122,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":76122,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0UtJAAIAGDgUKAAIPTn0\/YcQwGMq9KdLlAAAAAIAC+vBtKAAAAgQFtAEDAwgBAQQC"}
 00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":547,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":3,"flow_last_seen":76122,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":76122,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0R05AAIAGN+MKAAIPdqf43MQv9oQzn2SqAAAAAIAC+vCljgAAAgQFtAEDAwgBAQQC"}
@@ -520,7 +520,7 @@
 00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":565,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":151,"flow_packet_id":2,"flow_last_seen":78374,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":78374,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0GYhAAIAGqN8KAAIPXwrNQ8RYvPy3IUp\/AAAAAIAC+vC4zAAAAgQFtAEDAwgBAQQC"}
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":566,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":2,"flow_last_seen":78374,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":78374,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xOdAAIAGV+0KAAIPSbaIKsRXbOGIdOVZAAAAAIAC+vD3KAAAAgQFtAEDAwgBAQQC"}
 00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":567,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":152,"flow_packet_id":2,"flow_last_seen":78374,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":78374,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0bsZAAIAGE88KAAIPcf\/6IMRZzacG03PuAAAAAIAC+vDvLQAAAgQFtAEDAwgBAQQC"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":570,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":63001,"flow_last_seen":78517,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":99,"midstream":0,"thread_ts_msec":78517,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":50198,"dst_port":9915,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":570,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":63001,"flow_last_seen":78517,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":99,"midstream":0,"thread_ts_msec":78517,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":50198,"dst_port":9915,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":577,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":3,"flow_last_seen":79200,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":79200,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0KchAAIAGHhYKAAIPfNop\/cQ+5wgF3IcnAAAAAIAC+vCI7gAAAgQFtAEDAwgBAQQC"}
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":578,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":3,"flow_last_seen":79201,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":79201,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0UW1AAIAGasEKAAIPsIqB\/MRDbToYK0huAAAAAIAC+vCjcgAAAgQFtAEDAwgBAQQC"}
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":579,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":3,"flow_last_seen":79201,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":79201,"pkt":"UlQAEjUCCAAn5uVZCABFAAA01kRAAIAGdAUKAAIPcGk0AsQ\/GPASVmSCAAAAAIAC+vBvnQAAAgQFtAEDAwgBAQQC"}
@@ -677,7 +677,7 @@
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":675,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":1,"flow_last_seen":83805,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":83805,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0d8ZAAIAGrlAKAAIPcfxWosRbJBfMcOElAAAAAIAC+vAJaQAAAgQFtAEDAwgBAQQC"}
 00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":676,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":2,"flow_last_seen":84026,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":84026,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAwcAAEAGoxhx\/FaiCgACDyQXxFsAmFgBzHDhJmAS\/\/\/UxQAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":677,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":3,"flow_last_seen":84026,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":84026,"pkt":"UlQAEjUCCAAn5uVZCABFAAAod8dAAIAGrlsKAAIPcfxWosRbJBfMcOEmAJhYAlAQ+vDxkQAA"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":678,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":221,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":83805,"flow_last_seen":84027,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":84027,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":50267,"dst_port":9239,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":678,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":221,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":83805,"flow_last_seen":84027,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":84027,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":50267,"dst_port":9239,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":685,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":151,"flow_packet_id":3,"flow_last_seen":84388,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":84388,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0GYlAAIAGqN4KAAIPXwrNQ8RYvPy3IUp\/AAAAAIAC+vC4zAAAAgQFtAEDAwgBAQQC"}
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":686,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":3,"flow_last_seen":84388,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":84388,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xOhAAIAGV+wKAAIPSbaIKsRXbOGIdOVZAAAAAIAC+vD3KAAAAgQFtAEDAwgBAQQC"}
 00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":687,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":152,"flow_packet_id":3,"flow_last_seen":84388,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":84388,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0bsdAAIAGE84KAAIPcf\/6IMRZzacG03PuAAAAAIAC+vDvLQAAAgQFtAEDAwgBAQQC"}
@@ -691,10 +691,10 @@
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":691,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":225,"flow_packet_id":1,"flow_last_seen":84593,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":84593,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0KpdAAIAGI14KAAIP2qTGG8Rf6yo8NHW4AAAAAIAC+vBl2QAAAgQFtAEDAwgBAQQC"}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":692,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":2,"flow_last_seen":84824,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":84824,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAwwAAEAGn4vS0flUCgACD2CvxFwAmkwBaX1M0WAS\/\/+X6wAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":693,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":3,"flow_last_seen":84824,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":84824,"pkt":"UlQAEjUCCAAn5uVZCABFAAAov8FAAIAGYtkKAAIP0tH5VMRcYK9pfUzRAJpMAlAQ+vC0twAA"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":694,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":222,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":84592,"flow_last_seen":84825,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":84825,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"210.209.249.84","src_port":50268,"dst_port":24751,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":694,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":222,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":84592,"flow_last_seen":84825,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":84825,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"210.209.249.84","src_port":50268,"dst_port":24751,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":696,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":223,"flow_packet_id":2,"flow_last_seen":84862,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":84862,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAw4AAEAGBkbaZ4sCCgACDwxyxF0Am0YBMJyEhWAS\/\/9aEAAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":697,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":223,"flow_packet_id":3,"flow_last_seen":84863,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":84863,"pkt":"UlQAEjUCCAAn5uVZCABFAAAosEBAAIAG2RYKAAIP2meLAsRdDHIwnISFAJtGAlAQ+vB23AAA"}
-00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":698,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":223,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":84592,"flow_last_seen":84863,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":84863,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":50269,"dst_port":3186,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":698,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":223,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":84592,"flow_last_seen":84863,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":84863,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":50269,"dst_port":3186,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":710,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":226,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":85607,"flow_last_seen":85607,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":85607,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.172.184.48","src_port":50272,"dst_port":13298,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
 00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":710,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":226,"flow_packet_id":1,"flow_last_seen":85607,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":85607,"pkt":"UlQAEjUCCAAn5uVZCABFAAA07jxAAIAGRpwKAAIPAay4MMRgM\/L4VuGpAAAAAIAC+vDb4AAAAgQFtAEDAwgBAQQC"}
 00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":711,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":227,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":85607,"flow_last_seen":85607,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":85607,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.179.18.242","src_port":50273,"dst_port":47329,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
@@ -737,10 +737,10 @@
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":743,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":1,"flow_last_seen":88706,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":88706,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0QYJAAIAGx78KAAIPYteCnMRvMHWjnzXtAAAAAIAC+vC0KwAAAgQFtAEDAwgBAQQC"}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":746,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":239,"flow_packet_id":2,"flow_last_seen":88816,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":88816,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAyoAAEAGurFLhWVdCgACD8yPxG0AoxYBwnfwg2AS\/\/+AiAAAAgQFtA=="}
 00439{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":747,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":239,"flow_packet_id":3,"flow_last_seen":88816,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":88816,"pkt":"UlQAEjUCCAAn5uVZCABFAAAocclAAIAGzBUKAAIPS4VlXcRtzI\/Cd\/CDAKMWAlAQ+vCdVAAA"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":748,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":239,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":88704,"flow_last_seen":88817,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":88817,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":50285,"dst_port":52367,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":748,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":239,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":88704,"flow_last_seen":88817,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":88817,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":50285,"dst_port":52367,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":750,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":238,"flow_packet_id":2,"flow_last_seen":88832,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":88832,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAywAAEAGIK1onOJICgACD9AKxGwApBABxlioc2AS\/\/8tOgAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":751,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":238,"flow_packet_id":3,"flow_last_seen":88832,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":88832,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo5t9AAIAGvPwKAAIPaJziSMRs0ArGWKhzAKQQAlAQ+vBKBgAA"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":752,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":238,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":88704,"flow_last_seen":88833,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":88833,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":50284,"dst_port":53258,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":752,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":238,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":88704,"flow_last_seen":88833,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":88833,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":50284,"dst_port":53258,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00460{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":754,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":3,"flow_last_seen":88897,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":88897,"pkt":"CAAn5uVZUlQAEjUCCABFwAA4Ay4AAP8Bn8YKAAICCgACDwMBvHoAAAAARQAANFAnQAB\/BsDKCgACD3p1ZE7EYyMyoRe31g=="}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":758,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":242,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":88941,"flow_last_seen":88941,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":88941,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":28681,"dst_port":52367,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00462{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":758,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":242,"flow_packet_id":1,"flow_last_seen":88941,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":88941,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ccwAAIARC\/gKAAIPS4VlXXAJzI8AJKBHjeQxAkkpJRz\/KX356SYEAwABAAUAAADDglFLQA=="}
@@ -760,71 +760,71 @@
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":784,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":245,"flow_packet_id":1,"flow_last_seen":89733,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":89733,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0nYFAAIAGGXcKAAIPSsPs+cRxSH3g2g3bAAAAAIAC+vA0rwAAAgQFtAEDAwgBAQQC"}
 00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":786,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89829,"flow_last_seen":89829,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89829,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":28681,"dst_port":35481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":786,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":1,"flow_last_seen":89829,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":89829,"pkt":"UlQAEjUCCAAn5uVZCABFAABtBGAAAIARhQ4KAAIPYEFEwnAJipkAWRiep7MxAim3LsYw33fFcko2zkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00751{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":786,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89829,"flow_last_seen":89829,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89829,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":28681,"dst_port":35481,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00751{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":786,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89829,"flow_last_seen":89829,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89829,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":28681,"dst_port":35481,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":787,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89829,"flow_last_seen":89829,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89829,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.84.178.16","src_port":28681,"dst_port":60262,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":787,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":1,"flow_last_seen":89829,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":89829,"pkt":"UlQAEjUCCAAn5uVZCABFAABtYHgAAIARZpQKAAIPtVSyEHAJ62YAWWkRdMAxAjueygYrMQV+6lVI4UQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":787,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89829,"flow_last_seen":89829,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89829,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.84.178.16","src_port":28681,"dst_port":60262,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":787,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89829,"flow_last_seen":89829,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89829,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.84.178.16","src_port":28681,"dst_port":60262,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":788,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89829,"flow_last_seen":89829,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89829,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":12012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":788,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":1,"flow_last_seen":89829,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":89829,"pkt":"UlQAEjUCCAAn5uVZCABFAABtDeAAAIARAL4KAAIPQh7dtXAJLuwAWQScCKYxAn7wSVwJearIKZuX\/UQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":788,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89829,"flow_last_seen":89829,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89829,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":12012,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":788,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89829,"flow_last_seen":89829,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89829,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":12012,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01407{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":789,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":2,"flow_last_seen":89964,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":89964,"pkt":"CAAn5uVZUlQAEjUCCABFAALzAzsAAEARw61gQUTCCgACD4qZcAkC3\/jzp7MxAim3LsYw33fFcko2zkQAAMACAAAGR1RLRwAAKfRYs\/Fa1CmeYJshGT65b9iJmmUEYEFEwoqZAQAAAARL51cQFEdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqg=="}
 00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":790,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89966,"flow_last_seen":89966,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89966,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.218","src_port":28681,"dst_port":6909,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":790,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_packet_id":1,"flow_last_seen":89966,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":89966,"pkt":"UlQAEjUCCAAn5uVZCABFAABthPwAAIARBkMKAAIPLVh12nAJGv0AWWOTCPExAoCeF40w0KwTJyzTOUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00751{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":790,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89966,"flow_last_seen":89966,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89966,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.218","src_port":28681,"dst_port":6909,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00751{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":790,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89966,"flow_last_seen":89966,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89966,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.218","src_port":28681,"dst_port":6909,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":791,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89966,"flow_last_seen":89966,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89966,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":26253,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":791,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":1,"flow_last_seen":89966,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":89966,"pkt":"UlQAEjUCCAAn5uVZCABFAABteN4AAIAR6HgKAAIPM0SZ1nAJZo0AWRfF0U0xAgQATbK3Z+3BHrxn1kQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":791,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89966,"flow_last_seen":89966,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89966,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":26253,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":791,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89966,"flow_last_seen":89966,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89966,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":26253,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89967,"flow_last_seen":89967,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.203.218.92","src_port":28681,"dst_port":56962,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":1,"flow_last_seen":89967,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":89967,"pkt":"UlQAEjUCCAAn5uVZCABFAABtv\/sAAIAR2k0KAAIPucvaXHAJ3oIAWehILgsxAjPZohvFNPL\/fzMDzUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89967,"flow_last_seen":89967,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.203.218.92","src_port":28681,"dst_port":56962,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89967,"flow_last_seen":89967,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.203.218.92","src_port":28681,"dst_port":56962,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01405{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":793,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":2,"flow_last_seen":90003,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90003,"pkt":"CAAn5uVZUlQAEjUCCABFAALzAzwAAEARm5UzRJnWCgACD2aNcAkC356C0U0xAgQATbK3Z+3BHrxn1kQAAMACAAAGR1RLRwAAP8uu0MEeyu8HazDjgCpjZAKtBhAEM0SZ1maNAQAAAAT9K4fbFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqg=="}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":794,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90004,"flow_last_seen":90004,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90004,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.140.120.41","src_port":28681,"dst_port":47739,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":794,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_packet_id":1,"flow_last_seen":90004,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90004,"pkt":"UlQAEjUCCAAn5uVZCABFAABtaUEAAIARBHsKAAIPSIx4KXAJunsAWfVM+10xAo9f69NRsDNb4\/pKE0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":794,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90004,"flow_last_seen":90004,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90004,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.140.120.41","src_port":28681,"dst_port":47739,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":794,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90004,"flow_last_seen":90004,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90004,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.140.120.41","src_port":28681,"dst_port":47739,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":795,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90005,"flow_last_seen":90005,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90005,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":28681,"dst_port":61616,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":795,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":1,"flow_last_seen":90005,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90005,"pkt":"UlQAEjUCCAAn5uVZCABFAABtgogAAIAR60AKAAIPwSX\/gnAJ8LAAWXkqrf0xAupVi8ylWZxhuwdOwkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":795,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90005,"flow_last_seen":90005,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90005,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":28681,"dst_port":61616,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":795,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90005,"flow_last_seen":90005,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90005,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":28681,"dst_port":61616,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":796,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90005,"flow_last_seen":90005,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90005,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":28681,"dst_port":24562,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":796,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":1,"flow_last_seen":90005,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90005,"pkt":"UlQAEjUCCAAn5uVZCABFAABt+\/sAAIARkCYKAAIPWHhJ13AJX\/IAWfWM7VYxAm\/Ch\/PFy9OUV6XMR0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":796,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90005,"flow_last_seen":90005,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90005,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":28681,"dst_port":24562,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":796,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90005,"flow_last_seen":90005,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90005,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":28681,"dst_port":24562,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01410{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":797,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":2,"flow_last_seen":90038,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90038,"pkt":"CAAn5uVZUlQAEjUCCABFAALzAz0AAEARxl9YeEnXCgACD1\/ycAkC3xJi7VYxAm\/Ch\/PFy9OUV6XMR0QAAMACAAAGR1RLRwAADJe19wd9tDyoR\/wXh6nJoKWkNEIEWHhJ11\/yAQAAAATxtX5bFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqkdUS0cAABK1XVsEZ16ugW6JpsS4xfhpSq81BEjJ0DmW2Q=="}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":798,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90039,"flow_last_seen":90039,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90039,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":30577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":798,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_packet_id":1,"flow_last_seen":90039,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90039,"pkt":"UlQAEjUCCAAn5uVZCABFAABt7XgAAIAREsUKAAIPUD3d9nAJd3EAWbzbp0UxAokhPuR+ZJu6wwLrOkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":798,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90039,"flow_last_seen":90039,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90039,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":30577,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":798,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90039,"flow_last_seen":90039,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90039,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":30577,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":799,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90039,"flow_last_seen":90039,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90039,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":50297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":799,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_packet_id":1,"flow_last_seen":90039,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90039,"pkt":"UlQAEjUCCAAn5uVZCABFAABtEcIAAIARHzsKAAIPYPacfnAJxHkAWRCy7dwxAiOKI2B1HBL1\/IoOJUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":799,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90039,"flow_last_seen":90039,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90039,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":50297,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":799,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90039,"flow_last_seen":90039,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90039,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":50297,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":800,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90039,"flow_last_seen":90039,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90039,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":28681,"dst_port":36368,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":800,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_packet_id":1,"flow_last_seen":90039,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90039,"pkt":"UlQAEjUCCAAn5uVZCABFAABtsx4AAIARLMMKAAIPUrX72nAJjhAAWVPSkYYxArzIs2GmVy70sFjiYEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":800,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90039,"flow_last_seen":90039,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90039,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":28681,"dst_port":36368,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":800,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90039,"flow_last_seen":90039,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90039,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":28681,"dst_port":36368,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01407{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":801,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_packet_id":2,"flow_last_seen":90071,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90071,"pkt":"CAAn5uVZUlQAEjUCCABFAALzAz4AAEAROnpQPd32CgACD3dxcAkC3wb\/p0UxAokhPuR+ZJu6wwLrOkQAAMACAAAGR1RLRwAADWk0EbJTji7xq2N2EERly+h8FzIEUD3d9ndxAQAAAATOg6hoFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqg=="}
 00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":802,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90072,"flow_last_seen":90072,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90072,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.26.216.95","src_port":28681,"dst_port":13889,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":802,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_packet_id":1,"flow_last_seen":90072,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90072,"pkt":"UlQAEjUCCAAn5uVZCABFAABthFwAAIARuZsKAAIPGBrYX3AJNkEAWZh4MEMxAu0STIEN6nLhhZZqvEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00751{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":802,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90072,"flow_last_seen":90072,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90072,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.26.216.95","src_port":28681,"dst_port":13889,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00751{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":802,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90072,"flow_last_seen":90072,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90072,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.26.216.95","src_port":28681,"dst_port":13889,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":803,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90072,"flow_last_seen":90072,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90072,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":28681,"dst_port":43508,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":803,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_packet_id":1,"flow_last_seen":90072,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90072,"pkt":"UlQAEjUCCAAn5uVZCABFAABt0UkAAIARidsKAAIPZ+hrZHAJqfQAWVSlBkIxAi75axRUS7XsWs\/C60QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":803,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90072,"flow_last_seen":90072,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90072,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":28681,"dst_port":43508,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":803,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90072,"flow_last_seen":90072,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90072,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":28681,"dst_port":43508,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":804,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90073,"flow_last_seen":90073,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90073,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":804,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_packet_id":1,"flow_last_seen":90073,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90073,"pkt":"UlQAEjUCCAAn5uVZCABFAABtDzkAAIARfk0KAAIPLoBya3AJGbIAWQrBwagxArEYlVcnjAyV6XOvHEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":804,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90073,"flow_last_seen":90073,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90073,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":28681,"dst_port":6578,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":804,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90073,"flow_last_seen":90073,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90073,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":28681,"dst_port":6578,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01407{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":809,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":2,"flow_last_seen":90132,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90132,"pkt":"CAAn5uVZUlQAEjUCCABFAALzA0EAAEARqALBJf+CCgACD\/CwcAkC35hMrf0xAupVi8ylWZxhuwdOwkQAAMACAAAGR1RLRwAAC5wNVaWmIUX476YAPO2IwX6VsyAEwSX\/gvCwAQAAAASWmcaYFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqg=="}
 01406{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":810,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_packet_id":2,"flow_last_seen":90137,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90137,"pkt":"CAAn5uVZUlQAEjUCCABFAALzA0IAAEARx74ugHJrCgACDxmycAkC32FSwagxArEYlVcnjAyV6XOvHEQAAMACAAAGR1RLRwAAGIXhRHN5ftV2L3caNPMmmEQDSzUELoByaxmyAQAAAARlWXO2FEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqg=="}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":811,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90138,"flow_last_seen":90138,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90138,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":28681,"dst_port":21301,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":811,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_packet_id":1,"flow_last_seen":90138,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90138,"pkt":"UlQAEjUCCAAn5uVZCABFAABtxUwAAIAR+3EKAAIPPPEwwnAJUzUAWWdCqc0xAhWpgpzJQk2EqzRt70QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":811,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90138,"flow_last_seen":90138,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90138,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":28681,"dst_port":21301,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":811,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90138,"flow_last_seen":90138,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90138,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":28681,"dst_port":21301,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":812,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90138,"flow_last_seen":90138,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90138,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":28681,"dst_port":46010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":812,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_packet_id":1,"flow_last_seen":90138,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90138,"pkt":"UlQAEjUCCAAn5uVZCABFAABtRC0AAIARXOYKAAIPWUs0E3AJs7oAWZEdEsYxApinpNiOVYwKMx8qLUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00750{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":812,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90138,"flow_last_seen":90138,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90138,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":28681,"dst_port":46010,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00750{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":812,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90138,"flow_last_seen":90138,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90138,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":28681,"dst_port":46010,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":813,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90138,"flow_last_seen":90138,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90138,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.217.176.52","src_port":28681,"dst_port":7446,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":813,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_packet_id":1,"flow_last_seen":90138,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90138,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTM8AAIAR3pQKAAIPUtmwNHAJHRYAWfrhGukxApDm6ECPcKUTk+0ioUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00751{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":813,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90138,"flow_last_seen":90138,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90138,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.217.176.52","src_port":28681,"dst_port":7446,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00751{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":813,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90138,"flow_last_seen":90138,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90138,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.217.176.52","src_port":28681,"dst_port":7446,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01406{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":814,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_packet_id":2,"flow_last_seen":90182,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90182,"pkt":"CAAn5uVZUlQAEjUCCABFAALzA0MAAEAR20pZSzQTCgACD7O6cAkC35hjEsYxApinpNiOVYwKMx8qLUQAAMACAAAGR1RLRwAAGcOxs9Yotu5YI3ngDJa2NEz7hxIEWUs0E7O6AQAAAAQphpmTFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjVdTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNVdTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqkdUS0cAABZMZh8YJqCRZ8rsFWpJujOrF1VMBFHNWy2cyQ=="}
 00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":816,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90183,"flow_last_seen":90183,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90183,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":28681,"dst_port":11603,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":816,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_packet_id":1,"flow_last_seen":90183,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90183,"pkt":"UlQAEjUCCAAn5uVZCABFAABtGYoAAIAR6JkKAAIPXwrNQ3AJLVMAWdsMrwExAn9FQ02TKgtsdnbe2UQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00751{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":816,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90183,"flow_last_seen":90183,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90183,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":28681,"dst_port":11603,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00751{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":816,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90183,"flow_last_seen":90183,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90183,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":28681,"dst_port":11603,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":817,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90184,"flow_last_seen":90184,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90184,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":1194,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":817,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_packet_id":1,"flow_last_seen":90184,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90184,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTH0AAIARTyMKAAIPy9zG9HAJBKoAWeojZPExAoo7ciOaCRHkTxe8NEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":817,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90184,"flow_last_seen":90184,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90184,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":1194,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":817,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90184,"flow_last_seen":90184,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90184,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":1194,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01408{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":818,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":2,"flow_last_seen":90267,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90267,"pkt":"CAAn5uVZUlQAEjUCCABFAALzA0QAAEARAUO1VLIQCgACD+tmcAkC3zlLdMAxAjueygYrMQV+6lVI4UQAAMACAAAGR1RLRwAAKnLYr\/aGTLaMbt4HEbnkS5LKRh0EtVSyEOtmAQAAAAQDkoiwFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjVdTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqkdUS0cAAGqU5DC0wpx7Tt\/+AtuQJkODlGIrBC\/cuoxr+UdUS0cAAGSQPhJYYczqO9fA1uqwCWebPjcpBMEgftbozEdUS0cAAGfwY9tAxh1AXF0ZU2EOIfqDQ08tBHbwRccYzA=="}
 01408{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":819,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_packet_id":2,"flow_last_seen":90386,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90386,"pkt":"CAAn5uVZUlQAEjUCCABFAALzA0UAAEARlVpn6GtkCgACD6n0cAkC312iBkIxAi75axRUS7XsWs\/C60QAAMACAAAGR1RLRwAABkx5M4bYu4J4fOkW\/7Sl8nWo53gEZ+hrZKn0AQAAAASAlqYNFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqg=="}
 01406{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":820,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_packet_id":2,"flow_last_seen":90452,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90452,"pkt":"CAAn5uVZUlQAEjUCCABFAALzA0YAAEAR+vI88TDCCgACD1M1cAkC31EXqc0xAhWpgpzJQk2EqzRt70QAAMACAAAGR1RLRwAAGN\/m\/5SuT3RX9Y8zGKdBIhyITj8EPPEwwlM1AQAAAASjKCcfFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqg=="}
@@ -902,52 +902,52 @@
 00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":859,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":299,"flow_packet_id":1,"flow_last_seen":90747,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90747,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0eN9AAIAGqLsKAAIPM0SZ1sSTZo3Cj79BAAAAAIAC+vDuAwAAAgQFtAEDAwgBAQQC"}
 00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":860,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":276,"flow_packet_id":2,"flow_last_seen":90760,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90760,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA0kAAEAGeoC8PTS3CgACDy5MxHwAp\/gBiFqWg2AS\/\/+QwwAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":861,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":276,"flow_packet_id":3,"flow_last_seen":90760,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90760,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoc0ZAAIAGioYKAAIPvD00t8R8LkyIWpaDAKf4AlAQ+vCtjwAA"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":862,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":276,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90742,"flow_last_seen":90763,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90763,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":50300,"dst_port":11852,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":862,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":276,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90742,"flow_last_seen":90763,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90763,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":50300,"dst_port":11852,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":864,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":292,"flow_packet_id":2,"flow_last_seen":90767,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90767,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA0sAAEAGN+GOhKUNCgACD3dmxIwAqPIB4YpKRGAS\/\/\/+CQAAAgQFtA=="}
 00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":865,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":2,"flow_last_seen":90767,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90767,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA0wAAEAGSwNNOtM0CgACDw7exHgAqewBNESdzWAS\/\/\/ZhQAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":866,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":292,"flow_packet_id":3,"flow_last_seen":90767,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90767,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoxkxAAIAG9OIKAAIPjoSlDcSMd2bhikpEAKjyAlAQ+vAa1gAA"}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":867,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":3,"flow_last_seen":90768,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90768,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoHOhAAIAGsWoKAAIPTTrTNMR4Dt40RJ3NAKnsAlAQ+vD2UQAA"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":868,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":292,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90768,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90768,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":50316,"dst_port":30566,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":868,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":292,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90768,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90768,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":50316,"dst_port":30566,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":870,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":296,"flow_packet_id":2,"flow_last_seen":90768,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90768,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA04AAEAG9E3Co7R+CgACDypJxJAAquYBYmFhZWAS\/\/97mQAAAgQFtA=="}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":871,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":272,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90741,"flow_last_seen":90771,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90771,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.58.211.52","src_port":50296,"dst_port":3806,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":871,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":272,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90741,"flow_last_seen":90771,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90771,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.58.211.52","src_port":50296,"dst_port":3806,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":873,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":296,"flow_packet_id":3,"flow_last_seen":90772,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90772,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoSs1AAIAGLNIKAAIPwqO0fsSQKkliYWFlAKrmAlAQ+vCYZQAA"}
 00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":874,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":295,"flow_packet_id":2,"flow_last_seen":90772,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90772,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA1AAAEAGZwW5u0qtCgACD9DxxI8Aq+ABnMSfU2AS\/\/\/VWAAAAgQFtA=="}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":875,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":293,"flow_packet_id":2,"flow_last_seen":90772,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90772,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA1EAAEAG4wi8pcu+CgACD1XrxI0ArNoBciGOTGAS\/\/8ODwAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":876,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":295,"flow_packet_id":3,"flow_last_seen":90772,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90772,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoOIRAAIAGsdQKAAIPubtKrcSP0PGcxJ9TAKvgAlAQ+vDyJAAA"}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":877,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":296,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90747,"flow_last_seen":90772,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90772,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":50320,"dst_port":10825,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":877,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":296,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90747,"flow_last_seen":90772,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90772,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":50320,"dst_port":10825,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":879,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":293,"flow_packet_id":3,"flow_last_seen":90772,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90772,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoxP5AAIAGoV4KAAIPvKXLvsSNVetyIY5MAKzaAlAQ+vAq2wAA"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":880,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":295,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90747,"flow_last_seen":90772,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90772,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":50319,"dst_port":53489,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":882,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":293,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90772,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90772,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":50317,"dst_port":21995,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":880,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":295,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90747,"flow_last_seen":90772,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90772,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":50319,"dst_port":53489,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":882,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":293,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90772,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90772,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":50317,"dst_port":21995,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":884,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":279,"flow_packet_id":2,"flow_last_seen":90776,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90776,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA1UAAEAGyRlYeEnXCgACD1\/yxH8ArdQBY7MtEWAS\/\/9f0wAAAgQFtA=="}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":885,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":294,"flow_packet_id":2,"flow_last_seen":90776,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90776,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA1YAAEAGK3HBIH7WCgACD+jMxI4Ars4ByU6XnmAS\/\/9vGAAAAgQFtA=="}
 00440{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":886,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":279,"flow_packet_id":3,"flow_last_seen":90776,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90776,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo+\/1AAIAGUHQKAAIPWHhJ18R\/X\/Jjsy0RAK3UAlAQ+vB8nwAA"}
 00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":887,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":288,"flow_packet_id":2,"flow_last_seen":90776,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90776,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA1cAAEAGVX5o7qz6CgACD1v8xIgAr8gBAIGaT2AS\/\/\/yGAAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":888,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":294,"flow_packet_id":3,"flow_last_seen":90776,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90776,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoYpBAAIAGTDoKAAIPwSB+1sSO6MzJTpeeAK7OAlAQ+vCL5AAA"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":889,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":279,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90744,"flow_last_seen":90776,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90776,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":50303,"dst_port":24562,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":889,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":279,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90744,"flow_last_seen":90776,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90776,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":50303,"dst_port":24562,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00439{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":891,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":288,"flow_packet_id":3,"flow_last_seen":90777,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90777,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoBk9AAIAG0okKAAIPaO6s+sSIW\/wAgZpPAK\/IAlAQ+vAO5QAA"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":892,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":294,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90777,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90777,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.32.126.214","src_port":50318,"dst_port":59596,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":894,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":288,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":90777,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90777,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":50312,"dst_port":23548,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":892,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":294,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90777,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90777,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.32.126.214","src_port":50318,"dst_port":59596,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":894,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":288,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":90777,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90777,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":50312,"dst_port":23548,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":901,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":280,"flow_packet_id":2,"flow_last_seen":90784,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90784,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA14AAEAG805VqCJpCgACD5vkxIAAsMIB8fB5WWAS\/\/+FlQAAAgQFtA=="}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":902,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":277,"flow_packet_id":2,"flow_last_seen":90784,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90784,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA18AAEAG3PlXezbqCgACD9NyxH0AsbwBqI15YWAS\/\/+HEAAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":903,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":280,"flow_packet_id":3,"flow_last_seen":90785,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90785,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo3DZAAIAGmnkKAAIPVagiacSAm+Tx8HlZALDCAlAQ+vCiYQAA"}
 00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":904,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":299,"flow_packet_id":2,"flow_last_seen":90785,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90785,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA2AAAEAGnkMzRJnWCgACD2aNxJMAsrYBwo+\/QmAS\/\/9bRgAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":905,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":277,"flow_packet_id":3,"flow_last_seen":90785,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90785,"pkt":"UlQAEjUCCAAn5uVZCABFAAAooEJAAIAGwBkKAAIPV3s26sR903KojXlhALG8AlAQ+vCj3AAA"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":906,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":280,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90744,"flow_last_seen":90785,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90785,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.168.34.105","src_port":50304,"dst_port":39908,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":906,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":280,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90744,"flow_last_seen":90785,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90785,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.168.34.105","src_port":50304,"dst_port":39908,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":908,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":299,"flow_packet_id":3,"flow_last_seen":90785,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90785,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoeOBAAIAGqMYKAAIPM0SZ1sSTZo3Cj79CALK2AlAQ+vB4EgAA"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":909,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":299,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90747,"flow_last_seen":90785,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90785,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":50323,"dst_port":26253,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":911,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":277,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90743,"flow_last_seen":90785,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90785,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":50301,"dst_port":54130,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":909,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":299,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90747,"flow_last_seen":90785,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90785,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":50323,"dst_port":26253,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":911,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":277,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90743,"flow_last_seen":90785,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90785,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":50301,"dst_port":54130,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":918,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_packet_id":2,"flow_last_seen":90787,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90787,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA2cAAEAGHo9QB\/zACgACDxroxIoAs7ABAD7ueWAS\/\/\/AYAAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":919,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_packet_id":3,"flow_last_seen":90787,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90787,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoIw9AAIAGfuoKAAIPUAf8wMSKGugAPu55ALOwAlAQ+vDdLAAA"}
-01138{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":920,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90787,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":264,"flow_tot_l4_payload_len":264,"flow_avg_l4_payload_len":66,"midstream":0,"thread_ts_msec":90787,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":50314,"dst_port":6888,"l4_proto":"tcp","ndpi": {"flow_risk": {"5": {"risk":"Known Proto on Non Std Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"15": {"risk":"TLS (probably) Not Carrying HTTPS","severity":"Low","risk_score": {"total":760,"client":680,"server":80}},"24": {"risk":"Missing SNI TLS Extn","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"4":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"","ja3":"6992dc627532d4fbccd43fb03d3bdeb4","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+01138{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":920,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90787,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":264,"flow_tot_l4_payload_len":264,"flow_avg_l4_payload_len":66,"midstream":0,"thread_ts_msec":90787,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":50314,"dst_port":6888,"l4_proto":"tcp","ndpi": {"flow_risk": {"5": {"risk":"Known Proto on Non Std Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"15": {"risk":"TLS (probably) Not Carrying HTTPS","severity":"Low","risk_score": {"total":760,"client":680,"server":80}},"24": {"risk":"Missing SNI TLS Extn","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"6":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"","ja3":"6992dc627532d4fbccd43fb03d3bdeb4","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":930,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":274,"flow_packet_id":2,"flow_last_seen":90795,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90795,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA24AAEAGymQugHJrCgACDxmyxHoAtKoBziHWF2AS\/\/++AAAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":932,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":274,"flow_packet_id":3,"flow_last_seen":90796,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90796,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoDztAAIAGPpsKAAIPLoBya8R6GbLOIdYXALSqAlAQ+vDazAAA"}
 00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":938,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":298,"flow_packet_id":2,"flow_last_seen":90799,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90799,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA3IAAEAGvK6khAoZCgACD9gGxJIAtaQBToGf\/mAS\/\/+tmgAAAgQFtA=="}
 00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":939,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":298,"flow_packet_id":3,"flow_last_seen":90799,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90799,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoptFAAIAGmVIKAAIPpIQKGcSS2AZOgZ\/+ALWkAlAQ+vDKZgAA"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":942,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":274,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90741,"flow_last_seen":90799,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90799,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":50298,"dst_port":6578,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":944,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":298,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90747,"flow_last_seen":90800,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90800,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":50322,"dst_port":55302,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":942,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":274,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90741,"flow_last_seen":90799,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90799,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":50298,"dst_port":6578,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":944,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":298,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90747,"flow_last_seen":90800,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90800,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":50322,"dst_port":55302,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":946,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":283,"flow_packet_id":2,"flow_last_seen":90800,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90800,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA3YAAEAGCtCwY7AUCgACDxjKxIMAtp4BeVRy4GAS\/\/\/DVQAAAgQFtA=="}
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":947,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":283,"flow_packet_id":3,"flow_last_seen":90801,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90801,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoGLRAAIAGdZUKAAIPsGOwFMSDGMp5VHLgALaeAlAQ+vDgIQAA"}
-00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":948,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":283,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":90801,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90801,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":50307,"dst_port":6346,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":948,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":283,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":90801,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90801,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":50307,"dst_port":6346,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":300,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90809,"flow_last_seen":90809,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":90809,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":300,"flow_packet_id":1,"flow_last_seen":90809,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":90809,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4BlIAAIAREmwKAAIPaO6s+nAJW\/wAJA6KHB0xAtgN+vD\/0M\/t\/ONIAwABAAUAAADDglFLQA=="}
 00562{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":986,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":300,"flow_packet_id":2,"flow_last_seen":90840,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":143,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":143,"pkt_l4_len":109,"thread_ts_msec":90840,"pkt":"CAAn5uVZUlQAEjUCCABFAACBA44AAEARVOdo7qz6CgACD1v8cAkAbdSrHB0xAtgN+vD\/0M\/t\/ONIAwEBAE4AAAD8W2jurPoAAAAACAAAAMMCVkNFR1RLR2IDR1VFQQICVVBDAgEGAkRVQl9jATZQIAEZ8HQAiAgAAAAAAAEAAQNESFRDAAABglFLRIDlHEU="}
@@ -955,8 +955,8 @@
 00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":997,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":271,"flow_packet_id":3,"flow_last_seen":90843,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90843,"pkt":"UlQAEjUCCAAn5uVZCABFAAAopBpAAIAGrC4KAAIPJo536sR3wkQjIZHCALeYAlAQ+vA2AwAA"}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":999,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":301,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90845,"flow_last_seen":90845,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":90845,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":28681,"dst_port":11852,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":999,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":301,"flow_packet_id":1,"flow_last_seen":90845,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":90845,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4c0wAAIARymUKAAIPvD00t3AJLkwAJK1JGu4xAkJx0f\/\/24\/JSJ6wAwABAAUAAADDglFLQA=="}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1005,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":271,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90740,"flow_last_seen":90850,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90850,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":50295,"dst_port":49732,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-01553{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":1011,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90746,"flow_last_seen":90857,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":1724,"flow_avg_l4_payload_len":287,"midstream":0,"thread_ts_msec":90857,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":50314,"dst_port":6888,"l4_proto":"tcp","ndpi": {"flow_risk": {"5": {"risk":"Known Proto on Non Std Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"6": {"risk":"Self-signed Cert","severity":"High","risk_score": {"total":500,"client":450,"server":50}},"9": {"risk":"TLS Cert Expired","severity":"High","risk_score": {"total":260,"client":230,"server":30}},"15": {"risk":"TLS (probably) Not Carrying HTTPS","severity":"Low","risk_score": {"total":760,"client":680,"server":80}},"24": {"risk":"Missing SNI TLS Extn","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"4":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"","ja3":"6992dc627532d4fbccd43fb03d3bdeb4","ja3s":"1249fb68f48c0444718e4d3b48b27188","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"CN=gtk-gnutella\/1.2.1","subjectDN":"CN=gtk-gnutella\/1.2.1","fingerprint":"E8:DD:F0:B2:FF:8C:27:5A:12:75:D4:AE:60:1B:D9:87:E8:FF:45:93"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1005,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":271,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90740,"flow_last_seen":90850,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90850,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":50295,"dst_port":49732,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+01553{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":1011,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90746,"flow_last_seen":90857,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":1724,"flow_avg_l4_payload_len":287,"midstream":0,"thread_ts_msec":90857,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":50314,"dst_port":6888,"l4_proto":"tcp","ndpi": {"flow_risk": {"5": {"risk":"Known Proto on Non Std Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"6": {"risk":"Self-signed Cert","severity":"High","risk_score": {"total":500,"client":450,"server":50}},"9": {"risk":"TLS Cert Expired","severity":"High","risk_score": {"total":260,"client":230,"server":30}},"15": {"risk":"TLS (probably) Not Carrying HTTPS","severity":"Low","risk_score": {"total":760,"client":680,"server":80}},"24": {"risk":"Missing SNI TLS Extn","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"6":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"","ja3":"6992dc627532d4fbccd43fb03d3bdeb4","ja3s":"1249fb68f48c0444718e4d3b48b27188","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"CN=gtk-gnutella\/1.2.1","subjectDN":"CN=gtk-gnutella\/1.2.1","fingerprint":"E8:DD:F0:B2:FF:8C:27:5A:12:75:D4:AE:60:1B:D9:87:E8:FF:45:93"}}
 00546{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1016,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":301,"flow_packet_id":2,"flow_last_seen":90857,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"thread_ts_msec":90857,"pkt":"CAAn5uVZUlQAEjUCCABFAAB0A6AAAEAReda8PTS3CgACDy5McAkAYD84Gu4xAkJx0f\/\/24\/JSJ6wAwEBAEEAAABMLrw9NLcAAAAACAAAAMMCVkNFR1RLR1cDR1VFQQICVVBDAgEHAkRVQ4BRAQNUTFNAA0RIVEMAAAGCUUtE7kD0pA=="}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1026,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90864,"flow_last_seen":90864,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":90864,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":53489,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1026,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_packet_id":1,"flow_last_seen":90864,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":90864,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4OIoAAIAR8bMKAAIPubtKrXAJ0PEAJMQW\/3wxAm1gREr\/fw\/7dxmzAwABAAUAAADDglFLQA=="}
@@ -964,42 +964,42 @@
 00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1030,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":303,"flow_packet_id":1,"flow_last_seen":90871,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":90871,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4xlIAAIARNMIKAAIPjoSlDXAJd2YAJJzV5\/IxAvsVo43\/HfOSkBgzAwABAAUAAADDglFLQA=="}
 00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1031,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":284,"flow_packet_id":2,"flow_last_seen":90872,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90872,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA6gAAEAGqm3BJf+CCgACD\/CwxIQAuJIBv98bx2AS\/\/+nyQAAAgQFtA=="}
 00440{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1032,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":284,"flow_packet_id":3,"flow_last_seen":90872,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90872,"pkt":"UlQAEjUCCAAn5uVZCABFAAAogopAAIAGq44KAAIPwSX\/gsSE8LC\/3xvHALiSAlAQ+vDElQAA"}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1033,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":284,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":90873,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90873,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":50308,"dst_port":61616,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1033,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":284,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":90873,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90873,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":50308,"dst_port":61616,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1036,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":304,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90880,"flow_last_seen":90880,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":90880,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.32.126.214","src_port":28681,"dst_port":59596,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1036,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":304,"flow_packet_id":1,"flow_last_seen":90880,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":90880,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4YpYAAIARjBkKAAIPwSB+1nAJ6MwAJJ5bn1UxAqnqa\/T\/ZYYW3VylAwABAAUAAADDglFLQA=="}
 00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1037,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":289,"flow_packet_id":2,"flow_last_seen":90882,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90882,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA6sAAEAGxg9gQUTCCgACD4qZxIkAuYwBsqFtYmAS\/\/\/rIgAAAgQFtA=="}
 00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1038,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":289,"flow_packet_id":3,"flow_last_seen":90882,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90882,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoBGJAAIAGRVwKAAIPYEFEwsSJipmyoW1iALmMAlAQ+vAH7wAA"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1039,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":289,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90883,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90883,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":50313,"dst_port":35481,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1039,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":289,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90883,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90883,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":50313,"dst_port":35481,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1041,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":291,"flow_packet_id":2,"flow_last_seen":90885,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90885,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA60AAEAGpYEtH5hwCgACD2jjxIsAuoYB181ecmAS\/\/\/cDQAAAgQFtA=="}
 00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1042,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":291,"flow_packet_id":3,"flow_last_seen":90885,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90885,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoe4VAAIAGrawKAAIPLR+YcMSLaOPXzV5yALqGAlAQ+vD42QAA"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1043,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":291,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90885,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90885,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":50315,"dst_port":26851,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1043,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":291,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90885,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90885,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":50315,"dst_port":26851,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00573{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1046,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_packet_id":2,"flow_last_seen":90892,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":149,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":149,"pkt_l4_len":115,"thread_ts_msec":90892,"pkt":"CAAn5uVZUlQAEjUCCABFAACHA68AAEARZkC5u0qtCgACD9DxcAkAc8xj\/3wxAm1gREr\/fw\/7dxmzAwEBAFQAAADx0Lm7Sq0AAAAACAAAAMMCVkNFR1RLR1cDR1VFQQICVVBDAgEJAkRVQ4BRAQE2UCoBbuAAAQAAAAAAAP\/\/C64DVExTQANESFRDAAABglFLRB3BTv4="}
 00570{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1047,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":303,"flow_packet_id":2,"flow_last_seen":90892,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":149,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":149,"pkt_l4_len":115,"thread_ts_msec":90892,"pkt":"CAAn5uVZUlQAEjUCCABFAACHA7AAAEARNxaOhKUNCgACD3dmcAkAc2nw5\/IxAvsVo43\/HfOSkBgzAwEBAFQAAABmd46EpQ0AAAAACAAAAMMCVkNFR1RLR2IDR1VFQQICVVBDAv8HAkRVQ4BRAQE2UCoBBPgcHBMlAAAAAAAAAAEDVExTQANESFRDAAABglFLRFrK9p0="}
 00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1048,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":278,"flow_packet_id":2,"flow_last_seen":90896,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90896,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA7EAAEAGGR5LQAavCgACDxKHxH4Au4ABJ3TJMGAS\/\/\/xsQAAAgQFtA=="}
 00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1049,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":278,"flow_packet_id":3,"flow_last_seen":90896,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90896,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo3P5AAIAGv9MKAAIPS0AGr8R+EocndMkwALuAAlAQ+vAOfgAA"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1050,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":278,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90743,"flow_last_seen":90897,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":597,"flow_tot_l4_payload_len":597,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90897,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.64.6.175","src_port":50302,"dst_port":4743,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1050,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":278,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90743,"flow_last_seen":90897,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":597,"flow_tot_l4_payload_len":597,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90897,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.64.6.175","src_port":50302,"dst_port":4743,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1052,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":269,"flow_packet_id":2,"flow_last_seen":90899,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90899,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA7MAAEAGUiNhU7eUCgACDyK6xHUAvHoBhjAS2WAS\/\/94KQAAAgQFtA=="}
 00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1053,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":269,"flow_packet_id":3,"flow_last_seen":90899,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90899,"pkt":"UlQAEjUCCAAn5uVZCABFAAAos+9AAIAGIeoKAAIPYVO3lMR1IrqGMBLZALx6AlAQ+vCU9QAA"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1058,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":269,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90739,"flow_last_seen":90905,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90905,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":50293,"dst_port":8890,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1058,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":269,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90739,"flow_last_seen":90905,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90905,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":50293,"dst_port":8890,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00545{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1062,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":304,"flow_packet_id":2,"flow_last_seen":90907,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"thread_ts_msec":90907,"pkt":"CAAn5uVZUlQAEjUCCABFAAB0A7gAAEARKrzBIH7WCgACD+jMcAkAYGMhn1UxAqnqa\/T\/ZYYW3VylAwEBAEEAAADM6MEgftYIAAAAAAACAMMCVkNFR1RLR2IDR1VFQQICVVBDAgEFAkRVQ4BRAQNUTFNAA0RIVEMAAAGCUUtEmpBNrg=="}
 00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1088,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":287,"flow_packet_id":2,"flow_last_seen":91051,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":91051,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA8YAAEAGMiyVHKOvCgACD8MkxIcAvm4BvtmXiWAS\/\/8GbQAAAgQFtA=="}
 00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1089,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":287,"flow_packet_id":3,"flow_last_seen":91052,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":91052,"pkt":"UlQAEjUCCAAn5uVZCABFAAAozKZAAIAG6U4KAAIPlRyjr8SHwyS+2ZeJAL5uAlAQ+vAjOQAA"}
 00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1090,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":275,"flow_packet_id":2,"flow_last_seen":91057,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":91057,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA8cAAEAG2CXL3Mb0CgACDwSqxHsAv2gBodiVp2AS\/\/+P0AAAAgQFtA=="}
 00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":275,"flow_packet_id":3,"flow_last_seen":91057,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":91057,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoTH9AAIAGD3EKAAIPy9zG9MR7BKqh2JWnAL9oAlAQ+vCsnAAA"}
 00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1092,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":282,"flow_packet_id":2,"flow_last_seen":91058,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":91058,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA8gAAEAG\/LTc7pFSCgACD4L3xIIAwGIBECov1GAS\/\/8zjQAAAgQFtA=="}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1093,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":287,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":91058,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91058,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":50311,"dst_port":49956,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1093,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":287,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":91058,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91058,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":50311,"dst_port":49956,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00439{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1094,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":282,"flow_packet_id":3,"flow_last_seen":91058,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":91058,"pkt":"UlQAEjUCCAAn5uVZCABFAAAouGtAAIAGyBQKAAIP3O6RUsSCgvcQKi\/UAMBiAlAQ+vBQWQAA"}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":282,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90744,"flow_last_seen":91058,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91058,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.238.145.82","src_port":50306,"dst_port":33527,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1098,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":275,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90742,"flow_last_seen":91059,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91059,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":50299,"dst_port":1194,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":282,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90744,"flow_last_seen":91058,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91058,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.238.145.82","src_port":50306,"dst_port":33527,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1098,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":275,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90742,"flow_last_seen":91059,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91059,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":50299,"dst_port":1194,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00450{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1100,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":285,"flow_packet_id":2,"flow_last_seen":91062,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":91062,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA8wAAEAG\/T488TDCCgACD1M1xIUAwVwBVNBhD2AS\/\/\/z9wAAAgQFtA=="}
 00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1101,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":285,"flow_packet_id":3,"flow_last_seen":91062,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":91062,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoxU5AAIAGu78KAAIPPPEwwsSFUzVU0GEPAMFcAlAQ+vAQxAAA"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1102,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":285,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":91062,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":91062,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":50309,"dst_port":21301,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1102,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":285,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":91062,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":91062,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":50309,"dst_port":21301,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00450{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1104,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":270,"flow_packet_id":2,"flow_last_seen":91074,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":91074,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA84AAEAGXEIOyP\/lCgACD5DCxHYAwlYBrXv\/HGAS\/\/8kxQAAAgQFtA=="}
 00440{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1105,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":270,"flow_packet_id":3,"flow_last_seen":91074,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":91074,"pkt":"UlQAEjUCCAAn5uVZCABFAAAotiFAAIAGKfIKAAIPDsj\/5cR2kMKte\/8cAMJWAlAQ+vBBkQAA"}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1106,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":270,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90740,"flow_last_seen":91075,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91075,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":50294,"dst_port":37058,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1106,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":270,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90740,"flow_last_seen":91075,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91075,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":50294,"dst_port":37058,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1108,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":273,"flow_packet_id":2,"flow_last_seen":91076,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":91076,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA9AAAEAGXEAOyP\/lCgACD7KOxHkAw1ABv2bicWAS\/\/8TtQAAAgQFtA=="}
 00440{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1110,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":273,"flow_packet_id":3,"flow_last_seen":91076,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":91076,"pkt":"UlQAEjUCCAAn5uVZCABFAAAotiNAAIAGKfAKAAIPDsj\/5cR5so6\/ZuJxAMNQAlAQ+vAwgQAA"}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1111,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":273,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90741,"flow_last_seen":91076,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91076,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":50297,"dst_port":45710,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1111,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":273,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90741,"flow_last_seen":91076,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91076,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":50297,"dst_port":45710,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1185,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":2,"flow_last_seen":91716,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":91716,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0QYNAAIAGx74KAAIPYteCnMRvMHWjnzXtAAAAAIAC+vC0KwAAAgQFtAEDAwgBAQQC"}
 00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1186,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":240,"flow_packet_id":2,"flow_last_seen":91717,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":91717,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0QNNAAIAG5KUKAAIPVHZ0xsRurkgo6JHMAAAAAIAC+vBxaAAAAgQFtAEDAwgBAQQC"}
 00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1197,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":245,"flow_packet_id":2,"flow_last_seen":92750,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":92750,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0nYJAAIAGGXYKAAIPSsPs+cRxSH3g2g3bAAAAAIAC+vA0rwAAAgQFtAEDAwgBAQQC"}
@@ -1022,18 +1022,18 @@
 00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1218,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":228,"flow_packet_id":3,"flow_last_seen":94638,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":94638,"pkt":"UlQAEjUCCAAn5uVZCABFAAA03z1AAIAGuFYKAAIPRK4Sc8RixfcTIeyiAAAAAIAC+vCG0QAAAgQFtAEDAwgBAQQC"}
 00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1222,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95216,"flow_last_seen":95216,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95216,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.201.208.57","src_port":28681,"dst_port":38617,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1222,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_packet_id":1,"flow_last_seen":95216,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95216,"pkt":"UlQAEjUCCAAn5uVZCABFAABtOX8AAIAR2+8KAAIPSMnQOXAJltkAWSBpTGIxAqnQz8i8hdkTM6c6p0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1222,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95216,"flow_last_seen":95216,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95216,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.201.208.57","src_port":28681,"dst_port":38617,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1222,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95216,"flow_last_seen":95216,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95216,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.201.208.57","src_port":28681,"dst_port":38617,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1223,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95264,"flow_last_seen":95264,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95264,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":40137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1223,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_packet_id":1,"flow_last_seen":95264,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95264,"pkt":"UlQAEjUCCAAn5uVZCABFAABteh0AAIARB1oKAAIPUc1bLXAJnMkAWTuNUisxAvjRH\/hajsQp0x+4CkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1223,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95264,"flow_last_seen":95264,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95264,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":40137,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1223,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95264,"flow_last_seen":95264,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95264,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":40137,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1224,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95264,"flow_last_seen":95264,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95264,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.220.186.140","src_port":28681,"dst_port":27641,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1224,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_packet_id":1,"flow_last_seen":95264,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95264,"pkt":"UlQAEjUCCAAn5uVZCABFAABtBMUAAIARP0QKAAIPL9y6jHAJa\/kAWcmWUFgxAsm+7Dhb\/+NPw\/hwmEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1224,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95264,"flow_last_seen":95264,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95264,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.220.186.140","src_port":28681,"dst_port":27641,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1224,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95264,"flow_last_seen":95264,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95264,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.220.186.140","src_port":28681,"dst_port":27641,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01410{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1225,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_packet_id":2,"flow_last_seen":95411,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95411,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBAUAAEARfX4v3LqMCgACD2v5cAkC33tEUFgxAsm+7Dhb\/+NPw\/hwmEQAAMACAAAGR1RLRwAAapTkMLTCnHtO3\/4C25AmQ4OUYisEL9y6jGv5AQAAAAR8wXsRFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtUw=="}
 00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1226,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":304,"flow_packet_id":3,"flow_last_seen":95412,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95412,"pkt":"UlQAEjUCCAAn5uVZCABFAABtYpsAAIARi98KAAIPwSB+1nAJ6MwAWeiNeJExAmLu0Xk4X2RsSVj1uUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
 00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1228,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95443,"flow_last_seen":95443,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95443,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.240.69.199","src_port":28681,"dst_port":6348,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1228,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_packet_id":1,"flow_last_seen":95443,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95443,"pkt":"UlQAEjUCCAAn5uVZCABFAABtP0UAAIARMnUKAAIPdvBFx3AJGMwAWTV1zcQxAjBRcglTz+ngOj6nIkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1228,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95443,"flow_last_seen":95443,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95443,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.240.69.199","src_port":28681,"dst_port":6348,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1228,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95443,"flow_last_seen":95443,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95443,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.240.69.199","src_port":28681,"dst_port":6348,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1230,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":231,"flow_packet_id":3,"flow_last_seen":95653,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":95653,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0sx9AAIAG7QUKAAIPUrX72sRljhBQLtKuAAAAAIAC+vCkLQAAAgQFtAEDAwgBAQQC"}
 00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1231,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":233,"flow_packet_id":3,"flow_last_seen":95653,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":95653,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0vENAAIAGZKwKAAIPcfxbycRnEMmMdJG3AAAAAIAC+vCm7gAAAgQFtAEDAwgBAQQC"}
 00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1232,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":3,"flow_last_seen":95653,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":95653,"pkt":"UlQAEjUCCAAn5uVZCABFAAA04CVAAIAGre0KAAIPJOc7u8Rm8xqBNdLHAAAAAIAC+vD77wAAAgQFtAEDAwgBAQQC"}
@@ -1043,64 +1043,64 @@
 00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1237,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_packet_id":3,"flow_last_seen":95685,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95685,"pkt":"UlQAEjUCCAAn5uVZCABFAABtBMYAAIARP0MKAAIPL9y6jHAJa\/kAWT8LpTgxAh8vpCECmjOT1kHZjEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1239,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95715,"flow_last_seen":95715,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95715,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.188.98","src_port":28681,"dst_port":62851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1239,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_packet_id":1,"flow_last_seen":95715,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95715,"pkt":"UlQAEjUCCAAn5uVZCABFAABtSkUAAIARukUKAAIPbYS8YnAJ9YMAWQnlOt4xAkt+phdWa3WZX\/1iLEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1239,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95715,"flow_last_seen":95715,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95715,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.188.98","src_port":28681,"dst_port":62851,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1239,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95715,"flow_last_seen":95715,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95715,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.188.98","src_port":28681,"dst_port":62851,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1240,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95716,"flow_last_seen":95716,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95716,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.167.201.53","src_port":28681,"dst_port":47282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1240,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_packet_id":1,"flow_last_seen":95716,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95716,"pkt":"UlQAEjUCCAAn5uVZCABFAABtyVMAAIARg0EKAAIPGKfJNXAJuLIAWdvQozIxAmeG11K2Zk+mg8cBskQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1240,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95716,"flow_last_seen":95716,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95716,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.167.201.53","src_port":28681,"dst_port":47282,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1240,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95716,"flow_last_seen":95716,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95716,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.167.201.53","src_port":28681,"dst_port":47282,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1241,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95716,"flow_last_seen":95716,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95716,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1241,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_packet_id":1,"flow_last_seen":95716,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95716,"pkt":"UlQAEjUCCAAn5uVZCABFAABtGLgAAIARtUEKAAIPsGOwFHAJGMoAWdWFw\/gxApkT0lWtd136yOWRcEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1241,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95716,"flow_last_seen":95716,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95716,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1241,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95716,"flow_last_seen":95716,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95716,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01405{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1242,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_packet_id":2,"flow_last_seen":95753,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95753,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBAoAAEARPftthLxiCgACD\/WDcAkC3zUCOt4xAkt+phdWa3WZX\/1iLEQAAMACAAAGR1RLRwAA4JsjIdkeuStic2CcxenuP1eRs7wEbYS8YvWDAQAAAATOKYIxFFdTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="}
 00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1243,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":300,"flow_packet_id":3,"flow_last_seen":95754,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95754,"pkt":"UlQAEjUCCAAn5uVZCABFAABtBlcAAIAREjIKAAIPaO6s+nAJW\/wAWVUmk6UxAqo+0NIYX4FTPMU3uEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
 00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1244,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":314,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95754,"flow_last_seen":95754,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95754,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.237.202.91","src_port":28681,"dst_port":16117,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1244,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":314,"flow_packet_id":1,"flow_last_seen":95754,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95754,"pkt":"UlQAEjUCCAAn5uVZCABFAABt5WoAAIARNr4KAAIPR+3KW3AJPvUAWTG5sdMxAjDioXa7maFRwy28tUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1244,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":314,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95754,"flow_last_seen":95754,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95754,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.237.202.91","src_port":28681,"dst_port":16117,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1244,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":314,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95754,"flow_last_seen":95754,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95754,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.237.202.91","src_port":28681,"dst_port":16117,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1245,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95754,"flow_last_seen":95754,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95754,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.217.84.16","src_port":28681,"dst_port":20223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1245,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_packet_id":1,"flow_last_seen":95754,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95754,"pkt":"UlQAEjUCCAAn5uVZCABFAABtX54AAIARHeoKAAIPXNlUEHAJTv8AWaUwJBUxAlN7nQQgyNq1K1wDakQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1245,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95754,"flow_last_seen":95754,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95754,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.217.84.16","src_port":28681,"dst_port":20223,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1245,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95754,"flow_last_seen":95754,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95754,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.217.84.16","src_port":28681,"dst_port":20223,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01403{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1246,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_packet_id":2,"flow_last_seen":95773,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95773,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBAsAAEARB2mwY7AUCgACDxjKcAkC343Vw\/gxApkT0lWtd136yOWRcEQAAMACAAAGR1RLRwAA8snLCFuSuhsM38lDoCe4Q7IZIaMEsGOwFBjKAQAAAARm60BZFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="}
 00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1248,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95784,"flow_last_seen":95784,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95784,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":63637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1248,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_packet_id":1,"flow_last_seen":95784,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95784,"pkt":"UlQAEjUCCAAn5uVZCABFAABtMiYAAIARW8MKAAIPXjZCUnAJ+JUAWU8lLkYxAuq77b+oti7DkMaMrEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00751{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1248,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95784,"flow_last_seen":95784,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95784,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":63637,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00751{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1248,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95784,"flow_last_seen":95784,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95784,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":63637,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1249,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95784,"flow_last_seen":95784,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95784,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.236.205.7","src_port":28681,"dst_port":34794,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1249,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_packet_id":1,"flow_last_seen":95784,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95784,"pkt":"UlQAEjUCCAAn5uVZCABFAABtkeMAAIARbpoKAAIPYOzNB3AJh+oAWd3xqy0xAvOz2v7bFV7JjaoOuEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1249,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95784,"flow_last_seen":95784,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95784,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.236.205.7","src_port":28681,"dst_port":34794,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1249,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95784,"flow_last_seen":95784,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95784,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.236.205.7","src_port":28681,"dst_port":34794,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1250,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95784,"flow_last_seen":95784,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95784,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.183.183.110","src_port":28681,"dst_port":59920,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1250,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_packet_id":1,"flow_last_seen":95784,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95784,"pkt":"UlQAEjUCCAAn5uVZCABFAABtcekAAIARV2IKAAIPrbe3bnAJ6hAAWRURh5oxAjZAPvXTOccHXf+KmUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1250,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95784,"flow_last_seen":95784,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95784,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.183.183.110","src_port":28681,"dst_port":59920,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1250,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95784,"flow_last_seen":95784,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95784,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.183.183.110","src_port":28681,"dst_port":59920,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01406{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1251,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_packet_id":2,"flow_last_seen":95818,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95818,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBA0AAEARtvVc2VQQCgACD07\/cAkC3\/0wJBUxAlN7nQQgyNq1K1wDakQAAMACAAAGR1RLRwAA9cCVEE\/2P06nFdVsmWWAWjUBRZwEXNlUEE7\/AQAAAATtCo4VFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="}
 01403{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1253,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_packet_id":2,"flow_last_seen":95892,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95892,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBA8AAEAROelg7M0HCgACD4fqcAkC3\/BRqy0xAvOz2v7bFV7JjaoOuEQAAMACAAAGR1RLRwAA+Ts9p8WeGiSZuDZKSPQI3121aXEEYOzNB4fqAQAAAASVRD4TFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSEdUS0cAALFbZ+HgSIrho0RaGRNTd1qTgMZFBC0fmHBo4w=="}
 00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1254,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95893,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":55302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1254,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_packet_id":1,"flow_last_seen":95893,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95893,"pkt":"UlQAEjUCCAAn5uVZCABFAABtptYAAIAR2P0KAAIPpIQKGXAJ2AYAWVxSIsUxAlnYy6KYCQUz3Ng+pkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1254,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95893,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":55302,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1254,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95893,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":55302,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1255,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":320,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95893,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.236.200.137","src_port":28681,"dst_port":48142,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1255,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":320,"flow_packet_id":1,"flow_last_seen":95893,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95893,"pkt":"UlQAEjUCCAAn5uVZCABFAABtLrQAAIARfUcKAAIPuezIiXAJvA4AWfki1SYxAiU091nTuxkeneMv2EQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1255,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":320,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95893,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.236.200.137","src_port":28681,"dst_port":48142,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1255,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":320,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95893,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.236.200.137","src_port":28681,"dst_port":48142,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1256,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95893,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":21995,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1256,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_packet_id":1,"flow_last_seen":95893,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95893,"pkt":"UlQAEjUCCAAn5uVZCABFAABtxQIAAIAR4QoKAAIPvKXLvnAJVesAWQc1IDExAvwLw9eirMeJjOQnPkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1256,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95893,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":21995,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1256,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95893,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":21995,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01403{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1258,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_packet_id":2,"flow_last_seen":95918,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95918,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBBEAAEAR33a8pcu+CgACD1XrcAkC37R2IDExAvwLw9eirMeJjOQnPkQAAMACAAAGR1RLRwAA0WC9XX1Cv4OMIP5Uj2dxFVfelx8EvKXLvlXrAQAAAAT+NOnnFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DldTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1259,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":322,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95923,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.219","src_port":28681,"dst_port":6909,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1259,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":322,"flow_packet_id":1,"flow_last_seen":95923,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95923,"pkt":"UlQAEjUCCAAn5uVZCABFAABtLi4AAIARXRAKAAIPLVh123AJGv0AWeqxHFUxAta++c2ylLcKBb\/ez0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1259,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":322,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95923,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.219","src_port":28681,"dst_port":6909,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1259,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":322,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95923,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.219","src_port":28681,"dst_port":6909,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1260,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":323,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95923,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":56070,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1260,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":323,"flow_packet_id":1,"flow_last_seen":95923,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95923,"pkt":"UlQAEjUCCAAn5uVZCABFAABtEcQAAIARHzkKAAIPYPacfnAJ2wYAWfibSFoxAjjwuKgFGYZC9XxYD0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1260,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":323,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95923,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":56070,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1260,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":323,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95923,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":56070,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1261,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95923,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.250.179.237","src_port":28681,"dst_port":20848,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1261,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_packet_id":1,"flow_last_seen":95923,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95923,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTeMAAIAR4qYKAAIPSfqz7XAJUXAAWYypWMIxAuib5nRI0KcHRTGrFEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1261,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95923,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.250.179.237","src_port":28681,"dst_port":20848,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1261,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95923,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.250.179.237","src_port":28681,"dst_port":20848,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01403{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1262,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_packet_id":2,"flow_last_seen":95941,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95941,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBBIAAEARuTykhAoZCgACD9gGcAkC39H3IsUxAlnYy6KYCQUz3Ng+pkQAAMACAAAGR1RLRwAAwkI+xsLIWLYQq6EiNHwU7EsyAwwEpIQKGdgGAQAAAAQMPEZKFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="}
 01404{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1263,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_packet_id":2,"flow_last_seen":95956,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95956,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBBMAAEARArOtt7duCgACD+oQcAkC3zGfh5oxAjZAPvXTOccHXf+KmUQAAMACAAAGR1RLRwAA\/YvF6OaM0g0Esl9zeFHFBmeEb50Erbe3buoQAQAAAASYSwA1FEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSEdUS0cAALFbZ+HgSIrho0RaGRNTd1qTgMZFBC0fmHBo4w=="}
 01404{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1264,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_packet_id":2,"flow_last_seen":96048,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":96048,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBBQAAEARafBJ+rPtCgACD1FwcAkC30eYWMIxAuib5nRI0KcHRTGrFEQAAMACAAAGR1RLRwAA1jyfIL1wKx4dMkSe+\/yFksXUYD4ESfqz7VFwAQAAAASK6DCmFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="}
 00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1265,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":325,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":96049,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.160.143.48","src_port":28681,"dst_port":37036,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1265,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":325,"flow_packet_id":1,"flow_last_seen":96049,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":96049,"pkt":"UlQAEjUCCAAn5uVZCABFAABtwDYAAIARi2oKAAIPU6CPMHAJkKwAWa9gWsoxAsGbN6aupxEpyf\/jN0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1265,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":325,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":96049,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.160.143.48","src_port":28681,"dst_port":37036,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1265,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":325,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":96049,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.160.143.48","src_port":28681,"dst_port":37036,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1266,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":96049,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.1.231.138","src_port":28681,"dst_port":56558,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1266,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_packet_id":1,"flow_last_seen":96049,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":96049,"pkt":"UlQAEjUCCAAn5uVZCABFAABtFDIAAIARzrMKAAIPZAHninAJ3O4AWZFZFoUxAuK7tbNnNS+8oB5EGUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1266,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":96049,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.1.231.138","src_port":28681,"dst_port":56558,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1266,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":96049,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.1.231.138","src_port":28681,"dst_port":56558,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1267,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":96049,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.28.53.225","src_port":28681,"dst_port":44859,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1267,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_packet_id":1,"flow_last_seen":96049,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":96049,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTdQAAIARVqAKAAIPVBw14XAJrzsAWZ3TvxoxApctlOGi4VjuIFMFmUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1267,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":96049,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.28.53.225","src_port":28681,"dst_port":44859,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1267,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":96049,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.28.53.225","src_port":28681,"dst_port":44859,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1273,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":301,"flow_packet_id":3,"flow_last_seen":96404,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":96404,"pkt":"UlQAEjUCCAAn5uVZCABFAAA8c1IAAIARylsKAAIPvD00t3AJLkwAKChuYiUKBgACAwMAAAAAAAAAADEBAAkAAABHVEtHCQABAAA="}
 00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1277,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":235,"flow_packet_id":3,"flow_last_seen":96685,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":96685,"pkt":"UlQAEjUCCAAn5uVZCABFAAA068VAAIAGCcsKAAIPXoaansRp03KjrVDkAAAAAIAC+vDifQAAAgQFtAEDAwgBAQQC"}
 00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1278,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":234,"flow_packet_id":3,"flow_last_seen":96685,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":96685,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0IMxAAIAG1hsKAAIPY8eUBsRoEPJVbcPeAAAAAIAC+vCBnAAAAgQFtAEDAwgBAQQC"}
@@ -1118,17 +1118,17 @@
 01405{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1320,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_packet_id":2,"flow_last_seen":100920,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":100920,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBEAAAEARxyNeNkJSCgACD\/iVcAkC34d4LkYxAuq77b+oti7DkMaMrEQAAMACAAAGR1RLRwAA+wNHJRwgXbAuWugSpAUSxJsCHL8EXjZCUviVAQAAAAR+IhyrFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="}
 00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1450,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":328,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101122,"flow_last_seen":101122,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101122,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.105.27","src_port":28681,"dst_port":19260,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1450,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":328,"flow_packet_id":1,"flow_last_seen":101122,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101122,"pkt":"UlQAEjUCCAAn5uVZCABFAABt2AwAAIARIW0KAAIPy9xpG3AJSzwAWVR20YMxAsOjfW6uj7unlpr730QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1450,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":328,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101122,"flow_last_seen":101122,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101122,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.105.27","src_port":28681,"dst_port":19260,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1450,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":328,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101122,"flow_last_seen":101122,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101122,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.105.27","src_port":28681,"dst_port":19260,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":329,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101122,"flow_last_seen":101122,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101122,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.117.249.98","src_port":28681,"dst_port":6815,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":329,"flow_packet_id":1,"flow_last_seen":101122,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101122,"pkt":"UlQAEjUCCAAn5uVZCABFAABt42oAAIAR9S4KAAIPXHX5YnAJGp8AWRo4clsxAgMe5rjiFfxxH3X\/E0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":329,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101122,"flow_last_seen":101122,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101122,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.117.249.98","src_port":28681,"dst_port":6815,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":329,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101122,"flow_last_seen":101122,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101122,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.117.249.98","src_port":28681,"dst_port":6815,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1452,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101122,"flow_last_seen":101122,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101122,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.64.44.11","src_port":28681,"dst_port":1352,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1452,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_packet_id":1,"flow_last_seen":101122,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101122,"pkt":"UlQAEjUCCAAn5uVZCABFAABt9MQAAIARu2EKAAIPUkAsC3AJBUgAWavKICYxAiIojdyDEATTYjr6S0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1452,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101122,"flow_last_seen":101122,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101122,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.64.44.11","src_port":28681,"dst_port":1352,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1452,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101122,"flow_last_seen":101122,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101122,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.64.44.11","src_port":28681,"dst_port":1352,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01405{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1453,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_packet_id":2,"flow_last_seen":101161,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":101161,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBIEAAEAR6R9SQCwLCgACDwVIcAkC356IICYxAiIojdyDEATTYjr6S0QAAMACAAAGR1RLRwAAs3LU9XX2K5mbs3OMTMwDrBQ47bYEUkAsCwVIAQAAAASFeL+FFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIanw=="}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1454,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101162,"flow_last_seen":101162,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101162,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":26851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1454,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_packet_id":1,"flow_last_seen":101162,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101162,"pkt":"UlQAEjUCCAAn5uVZCABFAABte4oAAIAR7VcKAAIPLR+YcHAJaOMAWVACTGsxArv8OnSqKZfgjqpR7EQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1454,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101162,"flow_last_seen":101162,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101162,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":26851,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1454,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101162,"flow_last_seen":101162,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101162,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":26851,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1456,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":3,"flow_last_seen":101163,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101163,"pkt":"UlQAEjUCCAAn5uVZCABFAABtYHkAAIARZpMKAAIPtVSyEHAJ62YAWXddengxAvwV4+vWhWE2kdf1ukQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1458,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":3,"flow_last_seen":101259,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101259,"pkt":"UlQAEjUCCAAn5uVZCABFAABtBGcAAIARhQcKAAIPYEFEwnAJipkAWaF8mwwxArcB6GYWxEVcLYtOuEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1459,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":3,"flow_last_seen":101259,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101259,"pkt":"UlQAEjUCCAAn5uVZCABFAABteOQAAIAR6HIKAAIPM0SZ1nAJZo0AWYTH3zwxAjTRxsrRaTsZKs8ZWEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
@@ -1136,13 +1136,13 @@
 01404{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1463,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_packet_id":2,"flow_last_seen":101305,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":101305,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBIUAAEARodctH5hwCgACD2jjcAkC3267TGsxArv8OnSqKZfgjqpR7EQAAMACAAAGR1RLRwAAsVtn4eBIiuGjRFoZE1N3WpOAxkUELR+YcGjjAQAAAAQ+cByLFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO0dUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="}
 00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1479,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101837,"flow_last_seen":101837,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101837,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1479,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_packet_id":1,"flow_last_seen":101837,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101837,"pkt":"UlQAEjUCCAAn5uVZCABFAABtAsIAAIAR5ekKAAIP1eVv4HAJEwwAWTJ5PKcxAijtzcGdOPipHVZyGEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1479,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101837,"flow_last_seen":101837,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101837,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1479,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101837,"flow_last_seen":101837,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101837,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1538,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":3,"flow_last_seen":106200,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":106200,"pkt":"UlQAEjUCCAAn5uVZCABFAABtgo8AAIAR6zkKAAIPwSX\/gnAJ8LAAWcdbqxExAsF5aprYo0LmkOznoEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1539,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_packet_id":3,"flow_last_seen":106200,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":106200,"pkt":"UlQAEjUCCAAn5uVZCABFAABt7XkAAIAREsQKAAIPUD3d9nAJd3EAWRpRkUIxAvIfqgvF6WkSbnxZFUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1905,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":2,"flow_last_seen":106314,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":106314,"pkt":"UlQAEjUCCAAn5uVZCABFAABtDeEAAIARAL0KAAIPQh7dtXAJLuwAWUvy0dkxAnflHs8XZg0HoKrR0EQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
 00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1906,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_packet_id":2,"flow_last_seen":106314,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":106314,"pkt":"UlQAEjUCCAAn5uVZCABFAABthP0AAIARBkIKAAIPLVh12nAJGv0AWUikdrExAmyl2\/D4Flpgn2PiMkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
 00539{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1907,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":2,"flow_last_seen":106314,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":106314,"pkt":"UlQAEjUCCAAn5uVZCABFAABtv\/wAAIAR2kwKAAIPucvaXHAJ3oIAWXW3EqAxAn\/MqZ\/PxBBVRWBQQEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1911,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":267,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90738,"flow_last_seen":106390,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":99,"midstream":0,"thread_ts_msec":106390,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.7.155.210","src_port":50291,"dst_port":28365,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1911,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":267,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90738,"flow_last_seen":106390,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":99,"midstream":0,"thread_ts_msec":106390,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.7.155.210","src_port":50291,"dst_port":28365,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1940,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_packet_id":2,"flow_last_seen":111377,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111377,"pkt":"UlQAEjUCCAAn5uVZCABFAABtaUIAAIARBHoKAAIPSIx4KXAJunsAWR8sGNIxAigwQqvDAye6DaSDvEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
 00538{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1942,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":3,"flow_last_seen":111378,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111378,"pkt":"UlQAEjUCCAAn5uVZCABFAABt\/AEAAIARkCAKAAIPWHhJ13AJX\/IAWXHaSscxAtAehZxkzy2fwIIymUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1945,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_packet_id":2,"flow_last_seen":111410,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111410,"pkt":"UlQAEjUCCAAn5uVZCABFAABtEcUAAIARHzgKAAIPYPacfnAJxHkAWT0ZQMwxAkCcLpcbJhOCUhZqY0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
@@ -1161,16 +1161,16 @@
 00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1969,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":334,"flow_packet_id":1,"flow_last_seen":114930,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":114930,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0z\/pAAIAGGNQKAAIPvZNIU8SYZfyEcE5AAAAAAIAC+vBk5AAAAgQFtAEDAwgBAQQC"}
 00451{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1970,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":333,"flow_packet_id":2,"flow_last_seen":115039,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":115039,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsBeIAAEAGgIBFdqLlCgACD7c6xJcA8yoBKsf7BWAS\/\/\/XGAAAAgQFtA=="}
 00441{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1971,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":333,"flow_packet_id":3,"flow_last_seen":115039,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":115039,"pkt":"UlQAEjUCCAAn5uVZCABFAAAobAxAAIAGmlkKAAIPRXai5cSXtzoqx\/sFAPMqAlAQ+vDz5AAA"}
-00871{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1972,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":333,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":114930,"flow_last_seen":115040,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":533,"flow_tot_l4_payload_len":533,"flow_avg_l4_payload_len":133,"midstream":0,"thread_ts_msec":115040,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50327,"dst_port":46906,"l4_proto":"tcp","ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00871{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1972,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":333,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":114930,"flow_last_seen":115040,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":533,"flow_tot_l4_payload_len":533,"flow_avg_l4_payload_len":133,"midstream":0,"thread_ts_msec":115040,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50327,"dst_port":46906,"l4_proto":"tcp","ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00450{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1974,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":334,"flow_packet_id":2,"flow_last_seen":115124,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":115124,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsBeQAAEAGYvO9k0hTCgACD2X8xJgA9CQBhHBOQWAS\/\/9j5QAAAgQFtA=="}
 00441{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1975,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":334,"flow_packet_id":3,"flow_last_seen":115126,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":115126,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoz\/tAAIAGGN8KAAIPvZNIU8SYZfyEcE5BAPQkAlAQ+vCAsQAA"}
-00870{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1976,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":334,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":114930,"flow_last_seen":115127,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":538,"flow_tot_l4_payload_len":538,"flow_avg_l4_payload_len":134,"midstream":0,"thread_ts_msec":115127,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"189.147.72.83","src_port":50328,"dst_port":26108,"l4_proto":"tcp","ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00870{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1976,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":334,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":114930,"flow_last_seen":115127,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":538,"flow_tot_l4_payload_len":538,"flow_avg_l4_payload_len":134,"midstream":0,"thread_ts_msec":115127,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"189.147.72.83","src_port":50328,"dst_port":26108,"l4_proto":"tcp","ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1980,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":335,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":115369,"flow_last_seen":115369,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":115369,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":28681,"dst_port":37058,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1980,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":335,"flow_packet_id":1,"flow_last_seen":115369,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":115369,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ticAAIARadEKAAIPDsj\/5XAJkMIAJDeaLGAxAs8iaaH\/Df9W3JltAwABAAUAAADDglFLQA=="}
 00491{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1982,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":335,"flow_packet_id":2,"flow_last_seen":115702,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":115702,"pkt":"CAAn5uVZUlQAEjUCCABFAABKBegAAEARWf8OyP\/lCgACD5DCcAkANl\/hLGAxAs8iaaH\/Df9W3JltAwEBABcAAADCkA7I\/+WyNgAAAAAgAMOCUUtEGERIlw=="}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1999,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":116628,"flow_last_seen":116628,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":116628,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":6888,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1999,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_packet_id":1,"flow_last_seen":116628,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":116628,"pkt":"UlQAEjUCCAAn5uVZCABFAABtIxgAAIARvpEKAAIPUAf8wHAJGugAWSw6p+kxAjYZLonacBdkV9ywAUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
-00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1999,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":116628,"flow_last_seen":116628,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":116628,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":6888,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1999,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":116628,"flow_last_seen":116628,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":116628,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":6888,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01411{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2000,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_packet_id":2,"flow_last_seen":116679,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":116679,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBfMAAEARGTFQB\/zACgACDxrocAkC3\/Iip+kxAjYZLonacBdkV9ywAUQAAMACAAAGR1RLRwAAZxkkdSip9v6JKj37UBrDicBfjMAEUAf8wBroAQAAAASysOQuFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtUw=="}
 00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2003,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_packet_id":3,"flow_last_seen":116776,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":116776,"pkt":"UlQAEjUCCAAn5uVZCABFAABte4sAAIAR7VYKAAIPLR+YcHAJaOMAWSdx+0cxAtvllYjgRR1H\/sPbPUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
 00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2005,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_packet_id":3,"flow_last_seen":116859,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":116859,"pkt":"UlQAEjUCCAAn5uVZCABFAABt9MUAAIARu2AKAAIPUkAsC3AJBUgAWR\/CHmUxAhaifRIPh7YCtQDKL0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"}
@@ -1182,58 +1182,58 @@
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2111,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_packet_id":3,"flow_last_seen":123877,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":123877,"pkt":"UlQAEjUCCAAn5uVZCABFAABtptcAAIAR2PwKAAIPpIQKGXAJ2AYAWdpE9ZMxAnuYArMNMRKsJogRPUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2113,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":337,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":123912,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.116.64.132","src_port":28681,"dst_port":51227,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2113,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":337,"flow_packet_id":1,"flow_last_seen":123912,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":123912,"pkt":"UlQAEjUCCAAn5uVZCABFAABtUhMAAIARg2YKAAIPGHRAhHAJyBsAWUp2fKAxAtxaLOqCcitFlOv4V0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2113,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":337,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":123912,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.116.64.132","src_port":28681,"dst_port":51227,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2113,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":337,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":123912,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.116.64.132","src_port":28681,"dst_port":51227,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2114,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":338,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":123912,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.198.205.196","src_port":28681,"dst_port":20778,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2114,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":338,"flow_packet_id":1,"flow_last_seen":123912,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":123912,"pkt":"UlQAEjUCCAAn5uVZCABFAABt60MAAIARl6IKAAIP3cbNxHAJUSoAWRoYg28xAvjrsUFUSfHbBKidMkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00758{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2114,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":338,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":123912,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.198.205.196","src_port":28681,"dst_port":20778,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00758{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2114,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":338,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":123912,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.198.205.196","src_port":28681,"dst_port":20778,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2115,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":339,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":123912,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":54130,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2115,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":339,"flow_packet_id":1,"flow_last_seen":123912,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":123912,"pkt":"UlQAEjUCCAAn5uVZCABFAABtoEYAAIAR\/8UKAAIPV3s26nAJ03IAWfTcKgkxAlGmPJUzLkH07Ma7h0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2115,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":339,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":123912,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":54130,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2115,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":339,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":123912,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":54130,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01410{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2118,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":338,"flow_packet_id":2,"flow_last_seen":124065,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":124065,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBkcAAEARuhndxs3ECgACD1EqcAkC3zKOg28xAvjrsUFUSfHbBKidMkQAAMACAAAGR1RLRwAAhAWx\/4G\/aeOxkw5wrlcHOTlCresE3cbNxFEqAQAAAAT9knizFEdUS0cAAIPPdMtTw3ywAQrcKHskULaFt8T9BFd7NurTckdUS0cAAIBDDfCNVDqFgBWTNBe\/R1a2V7AXBLm7Sq3Q8UdUS0cAAI1c\/QX9I39S2eczHf8bGxQqBh3SBCaOd+rCRFdTSFIAAIsML3baZ9qjEzov01XuwUWPp8CvBBiB6TxOFldTSFIAAIgInuBYn2DWNYTpgSOhE3nGOSSqBGLQGpoTgldTSFIAAJMpLUy99S6l5+o3G\/7HZbY0zUPGBFnUW5sUS1NOT1cAAJJLJdecP9uDvZhuUeP7MwcedtuWBM8mo+QaekdUS0cAAJ6Xxzbx1oA8a67zMFTEYzHds+ukBEziVWkYyldTSFIAAJ7Bez1ZQQgPxovuLAykgS8CMrDdBLAKqQox\/0dUS0cAAJp\/6ofTpH0Z7c9sfONgy\/6jjg5ZBFTFYV4FUFdTSFIAAJgFqYyWS9v2Yq4KyYrmzTVJWc5SBGP6\/WMuK0dUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO0dUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAALd6AZ7svQKtiRxAHRTzpxSemu\/LBNXlb+ATDEdUS0cAALSr6ArQaneMzMJ81PWuqjO12gqLBLV2NdR1LkdUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSEdUS0cAALFbZ+HgSIrho0RaGRNTd1qTgMZFBC0fmHBo40dUS0cAAL1cZVAaZZhJTOPlkpw6jfT8aYRtBD\/kr6kHkA=="}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2119,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_packet_id":3,"flow_last_seen":124065,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":124065,"pkt":"UlQAEjUCCAAn5uVZCABFAABtOI8AAIAR8XkKAAIPubtKrXAJ0PEAWeogCGsxAoAKiW4WeGL5TjmTYEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
 00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2120,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124066,"flow_last_seen":124066,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124066,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49732,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2120,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_packet_id":1,"flow_last_seen":124066,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":124066,"pkt":"UlQAEjUCCAAn5uVZCABFAABtpB8AAIAR69kKAAIPJo536nAJwkQAWcjqSEIxAiBrw4qXLe42xzCJ9UQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2120,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124066,"flow_last_seen":124066,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124066,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49732,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2120,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124066,"flow_last_seen":124066,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124066,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49732,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2121,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":341,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124066,"flow_last_seen":124066,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124066,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.129.233.60","src_port":28681,"dst_port":19990,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2121,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":341,"flow_packet_id":1,"flow_last_seen":124066,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":124066,"pkt":"UlQAEjUCCAAn5uVZCABFAABtsCgAAIARfIsKAAIPGIHpPHAJThYAWZr\/PMAxAkVlEJdEiTyKQUzsekQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2121,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":341,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124066,"flow_last_seen":124066,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124066,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.129.233.60","src_port":28681,"dst_port":19990,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2121,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":341,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124066,"flow_last_seen":124066,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124066,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.129.233.60","src_port":28681,"dst_port":19990,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2123,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.208.26.154","src_port":28681,"dst_port":4994,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2123,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_packet_id":1,"flow_last_seen":124090,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":124090,"pkt":"UlQAEjUCCAAn5uVZCABFAABtt4sAAIAR+XsKAAIPYtAamnAJE4IAWYPzFGQxAgG2rIRjjgWOdH93UEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2123,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.208.26.154","src_port":28681,"dst_port":4994,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2123,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.208.26.154","src_port":28681,"dst_port":4994,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2124,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":343,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.212.91.155","src_port":28681,"dst_port":5195,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2124,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":343,"flow_packet_id":1,"flow_last_seen":124090,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":124090,"pkt":"UlQAEjUCCAAn5uVZCABFAABt2TsAAIARn8YKAAIPWdRbm3AJFEsAWd1KrbwxApZ9ZL+wNENsMFG4eUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2124,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":343,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.212.91.155","src_port":28681,"dst_port":5195,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2124,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":343,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.212.91.155","src_port":28681,"dst_port":5195,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2125,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"207.38.163.228","src_port":28681,"dst_port":6778,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2125,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_packet_id":1,"flow_last_seen":124090,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":124090,"pkt":"UlQAEjUCCAAn5uVZCABFAABtN+oAAIARg3wKAAIPzyaj5HAJGnoAWUl8GqIxAsDHb8ARC\/TCVyKtTkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2125,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"207.38.163.228","src_port":28681,"dst_port":6778,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2125,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"207.38.163.228","src_port":28681,"dst_port":6778,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01408{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2126,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_packet_id":2,"flow_last_seen":124181,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":124181,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBkkAAEARxyomjnfqCgACD8JEcAkC3z99SEIxAiBrw4qXLe42xzCJ9UQAAMACAAAGR1RLRwAAjVz9Bf0jf1LZ5zMd\/xsbFCoGHdIEJo536sJEAQAAAAT9X3JyFEdUS0cAAIQFsf+Bv2njsZMOcK5XBzk5Qq3rBN3GzcRRKkdUS0cAAIPPdMtTw3ywAQrcKHskULaFt8T9BFd7NurTckdUS0cAAIBDDfCNVDqFgBWTNBe\/R1a2V7AXBLm7Sq3Q8VdTSFIAAIsML3baZ9qjEzov01XuwUWPp8CvBBiB6TxOFldTSFIAAIgInuBYn2DWNYTpgSOhE3nGOSSqBGLQGpoTgldTSFIAAJMpLUy99S6l5+o3G\/7HZbY0zUPGBFnUW5sUS1NOT1cAAJJLJdecP9uDvZhuUeP7MwcedtuWBM8mo+QaekdUS0cAAJ6Xxzbx1oA8a67zMFTEYzHds+ukBEziVWkYyldTSFIAAJ7Bez1ZQQgPxovuLAykgS8CMrDdBLAKqQox\/0dUS0cAAJp\/6ofTpH0Z7c9sfONgy\/6jjg5ZBFTFYV4FUFdTSFIAAJgFqYyWS9v2Yq4KyYrmzTVJWc5SBGP6\/WMuK0dUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO0dUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAALd6AZ7svQKtiRxAHRTzpxSemu\/LBNXlb+ATDEdUS0cAALSr6ArQaneMzMJ81PWuqjO12gqLBLV2NdR1LkdUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSEdUS0cAALFbZ+HgSIrho0RaGRNTd1qTgMZFBC0fmHBo40dUS0cAAL1cZVAaZZhJTOPlkpw6jfT8aYRtBD\/kr6kHkA=="}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2164,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":345,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":126831,"flow_last_seen":126831,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":126831,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50330,"dst_port":46906,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2164,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":345,"flow_packet_id":1,"flow_last_seen":126831,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":126831,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0bCBAAIAGmjkKAAIPRXai5cSatzq0d6IdAAAAAIAC+vCtSgAAAgQFtAEDAwgBAQQC"}
 00451{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2165,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":345,"flow_packet_id":2,"flow_last_seen":126943,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":126943,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsBmMAAEAGf\/9FdqLlCgACD7c6xJoBCaABtHeiHmAS\/\/8wNgAAAgQFtA=="}
 00440{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2166,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":345,"flow_packet_id":3,"flow_last_seen":126943,"flow_idle_time":7580000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":126943,"pkt":"UlQAEjUCCAAn5uVZCABFAAAobCFAAIAGmkQKAAIPRXai5cSatzq0d6IeAQmgAlAQ+vBNAgAA"}
-00871{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2167,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":345,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":126831,"flow_last_seen":126944,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":513,"flow_tot_l4_payload_len":513,"flow_avg_l4_payload_len":128,"midstream":0,"thread_ts_msec":126944,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50330,"dst_port":46906,"l4_proto":"tcp","ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00871{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2167,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":345,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":126831,"flow_last_seen":126944,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":513,"flow_tot_l4_payload_len":513,"flow_avg_l4_payload_len":128,"midstream":0,"thread_ts_msec":126944,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50330,"dst_port":46906,"l4_proto":"tcp","ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2197,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":346,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.226.85.105","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2197,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":346,"flow_packet_id":1,"flow_last_seen":129174,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":129174,"pkt":"UlQAEjUCCAAn5uVZCABFAABtuPMAAIAR0zIKAAIPTOJVaXAJGMoAWVtEeBkxArN0R\/zFhR7fMHiNqUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2197,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":346,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.226.85.105","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2197,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":346,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.226.85.105","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2198,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":347,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.10.169.10","src_port":28681,"dst_port":12799,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2198,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":347,"flow_packet_id":1,"flow_last_seen":129174,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":129174,"pkt":"UlQAEjUCCAAn5uVZCABFAABt3TUAAIAR+CYKAAIPsAqpCnAJMf8AWSFl+80xAiQL9J1qTYJox\/q2yUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2198,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":347,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.10.169.10","src_port":28681,"dst_port":12799,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2198,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":347,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.10.169.10","src_port":28681,"dst_port":12799,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2199,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":348,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.197.97.94","src_port":28681,"dst_port":1360,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2199,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":348,"flow_packet_id":1,"flow_last_seen":129174,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":129174,"pkt":"UlQAEjUCCAAn5uVZCABFAABttG4AAIARw98KAAIPVMVhXnAJBVAAWURxEsIxAlakBl2ebhXyeemOeEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2199,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":348,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.197.97.94","src_port":28681,"dst_port":1360,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2199,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":348,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.197.97.94","src_port":28681,"dst_port":1360,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00532{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2200,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":349,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129210,"flow_last_seen":129210,"flow_idle_time":140000,"flow_min_l4_payload_len":117,"flow_max_l4_payload_len":117,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":117,"midstream":0,"thread_ts_msec":129210,"l3_proto":"ip4","src_ip":"84.197.97.94","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3}
 00576{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2200,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":349,"flow_packet_id":1,"flow_last_seen":129210,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":151,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":151,"pkt_l4_len":117,"thread_ts_msec":129210,"pkt":"CAAn5uVZUlQAEjUCCABFwACJBngAAH8BcgpUxWFeCgACDwMDv5kAAAAARQAAbbRuAAB\/EcTfCgACD1TFYV5wCQVQAFlEcRLCMQJWpAZdnm4V8nnpjnhEAAA6AAAABUdUS0cAACidCo0G3v\/IJjwziXwskXn9hKthBF0v4jVwCQEBAACHpNmcaMjLrgz72SMJ7seAsLgKkg=="}
-00610{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2200,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":349,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129210,"flow_last_seen":129210,"flow_idle_time":140000,"flow_min_l4_payload_len":117,"flow_max_l4_payload_len":117,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":117,"midstream":0,"thread_ts_msec":129210,"l3_proto":"ip4","src_ip":"84.197.97.94","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":5.868061}
+00610{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2200,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":349,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129210,"flow_last_seen":129210,"flow_idle_time":140000,"flow_min_l4_payload_len":117,"flow_max_l4_payload_len":117,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":117,"midstream":0,"thread_ts_msec":129210,"l3_proto":"ip4","src_ip":"84.197.97.94","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"6":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":5.868061}
 01408{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2201,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":346,"flow_packet_id":2,"flow_last_seen":129344,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":129344,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBnkAAEARwydM4lVpCgACDxjKcAkC3ybmeBkxArN0R\/zFhR7fMHiNqUQAAMACAAAGR1RLRwAAnpfHNvHWgDxrrvMwVMRjMd2z66QETOJVaRjKAQAAAAS4IqVOFEdUS0cAAIQFsf+Bv2njsZMOcK5XBzk5Qq3rBN3GzcRRKkdUS0cAAIPPdMtTw3ywAQrcKHskULaFt8T9BFd7NurTckdUS0cAAIBDDfCNVDqFgBWTNBe\/R1a2V7AXBLm7Sq3Q8UdUS0cAAI1c\/QX9I39S2eczHf8bGxQqBh3SBCaOd+rCRFdTSFIAAIsML3baZ9qjEzov01XuwUWPp8CvBBiB6TxOFldTSFIAAIgInuBYn2DWNYTpgSOhE3nGOSSqBGLQGpoTgldTSFIAAJMpLUy99S6l5+o3G\/7HZbY0zUPGBFnUW5sUS1NOT1cAAJJLJdecP9uDvZhuUeP7MwcedtuWBM8mo+QaeldTSFIAAJ7Bez1ZQQgPxovuLAykgS8CMrDdBLAKqQox\/0dUS0cAAJp\/6ofTpH0Z7c9sfONgy\/6jjg5ZBFTFYV4FUFdTSFIAAJgFqYyWS9v2Yq4KyYrmzTVJWc5SBGP6\/WMuK0dUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO0dUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAALSr6ArQaneMzMJ81PWuqjO12gqLBLV2NdR1LkdUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSEdUS0cAALFbZ+HgSIrho0RaGRNTd1qTgMZFBC0fmHBo40dUS0cAAL1cZVAaZZhJTOPlkpw6jfT8aYRtBD\/kr6kHkEdUS0cAALyzuhm5M4uYhLkABGRqZbdy38iOBGIjVe59rQ=="}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2202,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":350,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129345,"flow_last_seen":129345,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129345,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.250.253.99","src_port":28681,"dst_port":11819,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2202,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":350,"flow_packet_id":1,"flow_last_seen":129345,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":129345,"pkt":"UlQAEjUCCAAn5uVZCABFAABtA3wAAIARyZcKAAIPY\/r9Y3AJLisAWcb1VskxAtkesLI2UdbrHnvJmEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2202,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":350,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129345,"flow_last_seen":129345,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129345,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.250.253.99","src_port":28681,"dst_port":11819,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2202,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":350,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129345,"flow_last_seen":129345,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129345,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.250.253.99","src_port":28681,"dst_port":11819,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2203,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_packet_id":2,"flow_last_seen":129345,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":129345,"pkt":"UlQAEjUCCAAn5uVZCABFAABtFDMAAIARzrIKAAIPZAHninAJ3O4AWa5oGAExAiz8sZobXXh7jKY+cEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_packet_id":2,"flow_last_seen":129345,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":129345,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTdUAAIARVp8KAAIPVBw14XAJrzsAWRB8uXsxAsNFs8rL71MevwvUD0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00636{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":10750,"flow_last_seen":10750,"flow_idle_time":140000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":130927,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
-00621{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":140000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":130927,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ffa4:e108","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
-00636{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":2235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":9752,"flow_last_seen":17749,"flow_idle_time":140000,"flow_min_l4_payload_len":8,"flow_max_l4_payload_len":16,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":13,"midstream":0,"thread_ts_msec":130927,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
-00640{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":2235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":9752,"flow_last_seen":14765,"flow_idle_time":140000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":412,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":130927,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
+00636{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":10750,"flow_last_seen":10750,"flow_idle_time":140000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":130927,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
+00621{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":140000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":130927,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ffa4:e108","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
+00636{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":2235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":9752,"flow_last_seen":17749,"flow_idle_time":140000,"flow_min_l4_payload_len":8,"flow_max_l4_payload_len":16,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":13,"midstream":0,"thread_ts_msec":130927,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
+00640{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":2235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":9752,"flow_last_seen":14765,"flow_idle_time":140000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":412,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":130927,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2247,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":351,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":131668,"flow_last_seen":131668,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":131668,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"187.37.87.189","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2247,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":351,"flow_packet_id":1,"flow_last_seen":131668,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131668,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0FboAAIARBg4KAAIPuyVXvXAJGMoAIPd5R05EED8AAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2248,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":2,"flow_last_seen":131668,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131668,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0f68AAIAR17kKAAIPd+BfYXAJtRQAIJbPR05EED8BAQFUC1FLUlAGUk5BXS\/iNQlw"}
@@ -1283,25 +1283,25 @@
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2310,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_packet_id":2,"flow_last_seen":134428,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":134428,"pkt":"UlQAEjUCCAAn5uVZCABFAABtAsMAAIAR5egKAAIP1eVv4HAJEwwAWfhP39IxAiTPawjpKg8FqMjKpUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
 00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2360,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139506,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.118.53.212","src_port":28681,"dst_port":29998,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2360,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_packet_id":1,"flow_last_seen":139506,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139506,"pkt":"UlQAEjUCCAAn5uVZCABFAABtAv8AAIARQCgKAAIPtXY11HAJdS4AWScUhfMxArbJ5SyHh4zpjzvfRkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2360,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139506,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.118.53.212","src_port":28681,"dst_port":29998,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2360,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139506,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.118.53.212","src_port":28681,"dst_port":29998,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2361,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139506,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"63.228.175.169","src_port":28681,"dst_port":1936,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2361,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_packet_id":1,"flow_last_seen":139506,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139506,"pkt":"UlQAEjUCCAAn5uVZCABFAABtYr4AAIAR3CUKAAIPP+SvqXAJB5AAWZrqJBYxAlmizjMkdrKTCQRuaEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2361,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139506,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"63.228.175.169","src_port":28681,"dst_port":1936,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2361,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139506,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"63.228.175.169","src_port":28681,"dst_port":1936,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2362,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":357,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139506,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.35.85.238","src_port":28681,"dst_port":32173,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2362,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":357,"flow_packet_id":1,"flow_last_seen":139506,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139506,"pkt":"UlQAEjUCCAAn5uVZCABFAABtewQAAIAR+1sKAAIPYiNV7nAJfa0AWf9BqZoxAuJR0ARRd\/sw16p3JUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2362,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":357,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139506,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.35.85.238","src_port":28681,"dst_port":32173,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2362,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":357,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139506,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.35.85.238","src_port":28681,"dst_port":32173,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01408{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2372,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_packet_id":2,"flow_last_seen":139668,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":139668,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBs0AAEARedS1djXUCgACD3UucAkC3zh9hfMxArbJ5SyHh4zpjzvfRkQAAMACAAAGR1RLRwAAtKvoCtBqd4zMwnzU9a6qM7XaCosEtXY11HUuAQAAAARfhHP4FEdUS0cAAIQFsf+Bv2njsZMOcK5XBzk5Qq3rBN3GzcRRKkdUS0cAAIBDDfCNVDqFgBWTNBe\/R1a2V7AXBLm7Sq3Q8UdUS0cAAI1c\/QX9I39S2eczHf8bGxQqBh3SBCaOd+rCRFdTSFIAAIsML3baZ9qjEzov01XuwUWPp8CvBBiB6TxOFldTSFIAAIgInuBYn2DWNYTpgSOhE3nGOSSqBGLQGpoTgldTSFIAAJMpLUy99S6l5+o3G\/7HZbY0zUPGBFnUW5sUS1NOT1cAAJJLJdecP9uDvZhuUeP7MwcedtuWBM8mo+QaekdUS0cAAJ6Xxzbx1oA8a67zMFTEYzHds+ukBEziVWkYyldTSFIAAJ7Bez1ZQQgPxovuLAykgS8CMrDdBLAKqQox\/0dUS0cAAJp\/6ofTpH0Z7c9sfONgy\/6jjg5ZBFTFYV4FUFdTSFIAAJgFqYyWS9v2Yq4KyYrmzTVJWc5SBGP6\/WMuK0dUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO0dUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSEdUS0cAALFbZ+HgSIrho0RaGRNTd1qTgMZFBC0fmHBo40dUS0cAAL1cZVAaZZhJTOPlkpw6jfT8aYRtBD\/kr6kHkEdUS0cAALyzuhm5M4uYhLkABGRqZbdy38iOBGIjVe59rUdUS0cAALrtVGIh6HCMeHje7ytMi7+QCmj9BC\/grq4Yyg=="}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2373,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":358,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139669,"flow_last_seen":139669,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139669,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.224.174.174","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2373,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":358,"flow_packet_id":1,"flow_last_seen":139669,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139669,"pkt":"UlQAEjUCCAAn5uVZCABFAABtmlYAAIARtYwKAAIPL+CurnAJGMoAWfYTyxgxAvXWHJDN+FF7HrIjWEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2373,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":358,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139669,"flow_last_seen":139669,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139669,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.224.174.174","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2373,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":358,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139669,"flow_last_seen":139669,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139669,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.224.174.174","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2374,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_packet_id":3,"flow_last_seen":139669,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139669,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTeQAAIAR4qUKAAIPSfqz7XAJUXAAWTtzDAwxAhYFwQyFnvxYxDh4UUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2375,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_packet_id":3,"flow_last_seen":139669,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139669,"pkt":"UlQAEjUCCAAn5uVZCABFAABtxQMAAIAR4QkKAAIPvKXLvnAJVesAWccLy3UxAr1ooy\/Zmhwx1EOQ8UQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2379,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_packet_id":3,"flow_last_seen":139695,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139695,"pkt":"UlQAEjUCCAAn5uVZCABFAABtX58AAIARHekKAAIPXNlUEHAJTv8AWRxrcuoxAvEddJz1CNyRxwOe00QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
 01409{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2380,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_packet_id":2,"flow_last_seen":139713,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":139713,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBs8AAEARdY8\/5K+pCgACDweQcAkC3wv2JBYxAlmizjMkdrKTCQRuaEQAAMACAAAGR1RLRwAAvVxlUBplmElM4+WSnDqN9PxphG0EP+SvqQeQAQAAAAQC89xEFEdUS0cAAISEnKMAahWoBBfUee10B\/B49\/r0BBh0QITIG0dUS0cAAIQFsf+Bv2njsZMOcK5XBzk5Qq3rBN3GzcRRKkdUS0cAAIPPdMtTw3ywAQrcKHskULaFt8T9BFd7NurTckdUS0cAAIBDDfCNVDqFgBWTNBe\/R1a2V7AXBLm7Sq3Q8UdUS0cAAI1c\/QX9I39S2eczHf8bGxQqBh3SBCaOd+rCRFdTSFIAAIsML3baZ9qjEzov01XuwUWPp8CvBBiB6TxOFldTSFIAAIgInuBYn2DWNYTpgSOhE3nGOSSqBGLQGpoTgldTSFIAAJMpLUy99S6l5+o3G\/7HZbY0zUPGBFnUW5sUS1NOT1cAAJJLJdecP9uDvZhuUeP7MwcedtuWBM8mo+QaekdUS0cAAJ6Xxzbx1oA8a67zMFTEYzHds+ukBEziVWkYyldTSFIAAJ7Bez1ZQQgPxovuLAykgS8CMrDdBLAKqQox\/0dUS0cAAJp\/6ofTpH0Z7c9sfONgy\/6jjg5ZBFTFYV4FUFdTSFIAAJgFqYyWS9v2Yq4KyYrmzTVJWc5SBGP6\/WMuK0dUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO0dUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAALSr6ArQaneMzMJ81PWuqjO12gqLBLV2NdR1LkdUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSEdUS0cAALFbZ+HgSIrho0RaGRNTd1qTgMZFBC0fmHBo4w=="}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2382,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_packet_id":3,"flow_last_seen":139724,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139724,"pkt":"UlQAEjUCCAAn5uVZCABFAABtGLkAAIARtUAKAAIPsGOwFHAJGMoAWZkZdrExAg1GSrdXL+O9TXzC9kQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2383,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_packet_id":3,"flow_last_seen":139724,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139724,"pkt":"UlQAEjUCCAAn5uVZCABFAABtceoAAIARV2EKAAIPrbe3bnAJ6hAAWRX5yaAxAh\/9BvdPXg4EHkta+EQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"}
-00638{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2407,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":9752,"flow_last_seen":14765,"flow_idle_time":140000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":412,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":140848,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
-00634{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2407,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":9752,"flow_last_seen":17749,"flow_idle_time":140000,"flow_min_l4_payload_len":8,"flow_max_l4_payload_len":16,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":13,"midstream":0,"thread_ts_msec":140848,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
+00638{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2407,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":9752,"flow_last_seen":14765,"flow_idle_time":140000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":412,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":140848,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
+00634{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2407,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":9752,"flow_last_seen":17749,"flow_idle_time":140000,"flow_min_l4_payload_len":8,"flow_max_l4_payload_len":16,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":13,"midstream":0,"thread_ts_msec":140848,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2525,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":3,"flow_last_seen":152618,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":152618,"pkt":"UlQAEjUCCAAn5uVZCABFAABtv\/0AAIAR2ksKAAIPucvaXHAJ3oIAWWGJo3cxAvUqie+XZ8I4MOlY7kQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2526,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":3,"flow_last_seen":152619,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":152619,"pkt":"UlQAEjUCCAAn5uVZCABFAABtDeIAAIARALwKAAIPQh7dtXAJLuwAWUb9hToxArVYIH1ZKsd\/uJMQM0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2527,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_packet_id":3,"flow_last_seen":152619,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":152619,"pkt":"UlQAEjUCCAAn5uVZCABFAABthP4AAIARBkEKAAIPLVh12nAJGv0AWYQlGHcxArF+TA2rx0u82pqvx0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"}
@@ -1309,7 +1309,7 @@
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2585,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_packet_id":3,"flow_last_seen":157736,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":157736,"pkt":"UlQAEjUCCAAn5uVZCABFAABtGY8AAIAR6JQKAAIPXwrNQ3AJLVMAWaXpjUExAjTUCUmhKozUcF9w9kQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"}
 00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2611,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":359,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":160009,"flow_last_seen":160009,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":160009,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":51685,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2611,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":359,"flow_packet_id":1,"flow_last_seen":160009,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":160009,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4K8AAAER3GoKAAIP7\/\/\/+snlB2wAtiNJTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"}
-00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2611,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":359,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":160009,"flow_last_seen":160009,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":160009,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":51685,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2611,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":359,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":160009,"flow_last_seen":160009,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":160009,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":51685,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2621,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":359,"flow_packet_id":2,"flow_last_seen":161017,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":161017,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LAAAAER3GkKAAIP7\/\/\/+snlB2wAtiNJTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"}
 00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2635,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":359,"flow_packet_id":3,"flow_last_seen":162017,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":162017,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LEAAAER3GgKAAIP7\/\/\/+snlB2wAtiNJTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"}
 00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2645,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_packet_id":3,"flow_last_seen":162802,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":162802,"pkt":"UlQAEjUCCAAn5uVZCABFAABtOYEAAIAR2+0KAAIPSMnQOXAJltkAWe6G\/a8xAp990wTPUYO\/Pfo6nUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"}
@@ -1323,39 +1323,39 @@
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2725,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_packet_id":3,"flow_last_seen":168391,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":168391,"pkt":"UlQAEjUCCAAn5uVZCABFAABtAwAAAIARQCcKAAIPtXY11HAJdS4AWVKoRtYxAgh8ZUKNU31EKcU+K0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2727,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":360,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168428,"flow_last_seen":168428,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168428,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"198.58.218.12","src_port":28681,"dst_port":47912,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2727,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":360,"flow_packet_id":1,"flow_last_seen":168428,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":168428,"pkt":"UlQAEjUCCAAn5uVZCABFAABtVroAAIARN3AKAAIPxjraDHAJuygAWfAoVB4xAiIUq1VNOT5K4PsAnkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2727,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":360,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168428,"flow_last_seen":168428,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168428,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"198.58.218.12","src_port":28681,"dst_port":47912,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2727,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":360,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168428,"flow_last_seen":168428,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168428,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"198.58.218.12","src_port":28681,"dst_port":47912,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2732,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168555,"flow_last_seen":168555,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168555,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":28681,"dst_port":9915,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2732,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_packet_id":1,"flow_last_seen":168555,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":168555,"pkt":"UlQAEjUCCAAn5uVZCABFAABtB2EAAIARDDsKAAIPVoHEVHAJJrsAWdbAQsoxAjcNEhOQ8aGFyag54kQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2732,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168555,"flow_last_seen":168555,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168555,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":28681,"dst_port":9915,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2732,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168555,"flow_last_seen":168555,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168555,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":28681,"dst_port":9915,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01408{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2733,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_packet_id":2,"flow_last_seen":168593,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":168593,"pkt":"CAAn5uVZUlQAEjUCCABFAALzB7wAAEARSVpWgcRUCgACDya7cAkC37LQQsoxAjcNEhOQ8aGFyag54kQAAMACAAAGR1RLRwAAUhNI53eBGeJh0nCkclkfZJnzMvMEVoHEVCa7AQAAAATmnBkoFEdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegkdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzukdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj1dTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqkdUS0cAABK1XVsEZ16ugW6JpsS4xfhpSq81BEjJ0DmW2UdUS0cAABZMZh8YJqCRZ8rsFWpJujOrF1VMBFHNWy2cyVdTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEA=="}
 00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2734,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168594,"flow_last_seen":168594,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168594,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.192.210.182","src_port":28681,"dst_port":6754,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2734,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_packet_id":1,"flow_last_seen":168594,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":168594,"pkt":"UlQAEjUCCAAn5uVZCABFAABtbeQAAIARLxYKAAIPvsDStnAJGmIAWe\/nYtExAgjn\/Ke847x2NG4oVEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2734,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168594,"flow_last_seen":168594,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168594,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.192.210.182","src_port":28681,"dst_port":6754,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2734,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168594,"flow_last_seen":168594,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168594,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.192.210.182","src_port":28681,"dst_port":6754,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2742,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":363,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168840,"flow_last_seen":168840,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168840,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":38297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2742,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":363,"flow_packet_id":1,"flow_last_seen":168840,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":168840,"pkt":"UlQAEjUCCAAn5uVZCABFAABteiAAAIARB1cKAAIPUc1bLXAJlZkAWXbGOhUxApJjO\/JuqWKA3F9q70QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2742,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":363,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168840,"flow_last_seen":168840,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168840,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":38297,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2742,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":363,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168840,"flow_last_seen":168840,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168840,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":38297,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01410{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2744,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_packet_id":2,"flow_last_seen":168854,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":168854,"pkt":"CAAn5uVZUlQAEjUCCABFAALzB8MAAEAR0rG+wNK2CgACDxpicAkC32qFYtExAgjn\/Ke847x2NG4oVEQAAMACAAAGR1RLRwAAVhpgfx\/FIwIUkbHoonVeeVgxwBsEvsDSthpiAQAAAAQZ71djFEdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegkdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzukdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj1dTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqkdUS0cAABK1XVsEZ16ugW6JpsS4xfhpSq81BEjJ0DmW2UdUS0cAABZMZh8YJqCRZ8rsFWpJujOrF1VMBFHNWy2cyVdTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeQ=="}
 00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2803,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_packet_id":3,"flow_last_seen":174268,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174268,"pkt":"UlQAEjUCCAAn5uVZCABFAABybeUAAIARLxAKAAIPvsDStnAJGmIAXsbRDJkxAiMikaZOqXdSUPahXUQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="}
 00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2804,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_packet_id":3,"flow_last_seen":174269,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174269,"pkt":"UlQAEjUCCAAn5uVZCABFAAByB2IAAIARDDUKAAIPVoHEVHAJJrsAXjsDcFExAhHLtY5GdmAVhlELQEQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="}
 00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2806,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174303,"flow_last_seen":174303,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174303,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":28681,"dst_port":10825,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00545{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2806,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_packet_id":1,"flow_last_seen":174303,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174303,"pkt":"UlQAEjUCCAAn5uVZCABFAAByStEAAIARbHkKAAIPwqO0fnAJKkkAXkeElzExAuaUt3SA\/qxG7F60jUQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="}
-00758{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2806,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174303,"flow_last_seen":174303,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174303,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":28681,"dst_port":10825,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00758{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2806,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174303,"flow_last_seen":174303,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174303,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":28681,"dst_port":10825,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2807,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":360,"flow_packet_id":2,"flow_last_seen":174303,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174303,"pkt":"UlQAEjUCCAAn5uVZCABFAAByVrsAAIARN2oKAAIPxjraDHAJuygAXpm7NG4xAlN4rvcHLSWuyVzKGkQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="}
 00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2810,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":303,"flow_packet_id":3,"flow_last_seen":174321,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174321,"pkt":"UlQAEjUCCAAn5uVZCABFAAByxlcAAIARNIMKAAIPjoSlDXAJd2YAXu8TjWExApO4DvtDKbdx2klNVkQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2811,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":365,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174322,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.23.24.213","src_port":28681,"dst_port":18561,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00545{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2811,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":365,"flow_packet_id":1,"flow_last_seen":174322,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174322,"pkt":"UlQAEjUCCAAn5uVZCABFAABy\/iwAAIARW1MKAAIPvBcY1XAJSIEAXn4ZciIxAgUt47TCA6DBC1+HrEQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="}
-00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2811,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":365,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174322,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.23.24.213","src_port":28681,"dst_port":18561,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2811,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":365,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174322,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.23.24.213","src_port":28681,"dst_port":18561,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2812,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":366,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174322,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.8.55.158","src_port":28681,"dst_port":51140,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2812,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":366,"flow_packet_id":1,"flow_last_seen":174322,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174322,"pkt":"UlQAEjUCCAAn5uVZCABFAAByI9AAAIARdPYKAAIPXgg3nnAJx8QAXqKieDQxAq3mE0dDpkvWQzLgPUQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="}
-00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2812,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":366,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174322,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.8.55.158","src_port":28681,"dst_port":51140,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2812,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":366,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174322,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.8.55.158","src_port":28681,"dst_port":51140,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01410{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2813,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_packet_id":2,"flow_last_seen":174323,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":174323,"pkt":"CAAn5uVZUlQAEjUCCABFAALzB+sAAEAR7N7Co7R+CgACDypJcAkC36eTlzExAuaUt3SA\/qxG7F60jUQAAMACAAAGR1RLRwAAW5ZMJAC\/sp0EyBIYLqaZItjn8QIEwqO0fipJAQAAAAQkVMV3FEdUS0cAAFxg+taEWAYB1unX7flSWQRG3beNBGic4kjQCldTSFIAAFpCOi4aZIiG9lYEyciBumqkMMTzBMY62gy7KEdUS0cAAFf2jq05FgyfJOGIcRJLg6NdtQ1eBLw9NLcuTEdUS0cAAFYaYH8fxSMCFJGx6KJ1XnlYMcAbBL7A0rYaYkdUS0cAAFFI2BA3K8AVe0IqJAEnw9\/D630lBI6EpQ13ZkdUS0cAAFITSOd3gRniYdJwpHJZH2SZ8zLzBFaBxFQmu0dUS0cAAE3VqZZmQu9JEb4xS9XAL1zJJdrgBLwXGNVIgVdTSFIAAEwNRRSjJbzqx43c9rTKLbxkbHgKBF4IN57HxEdUS0cAAElxJg9dajjzW3txW7a4q7j8IGI0BFHNWy2VmUdUS0cAAEE1vJAZC\/Oid7YdKVGKEGbtSapFBJUco6\/DJFdTSFIAAEJDtkelhifx87ftq707Fzo\/U0PdBC+TNBWPeEdUS0cAAGqU5DC0wpx7Tt\/+AtuQJkODlGIrBC\/cuoxr+UdUS0cAAGSQPhJYYczqO9fA1uqwCWebPjcpBMEgftbozEdUS0cAAGfwY9tAxh1AXF0ZU2EOIfqDQ08tBHbwRccYzEdUS0cAAGcZJHUoqfb+iSo9+1Aaw4nAX4zABFAH\/MAa6EdUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzukdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mjw=="}
 00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2815,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":363,"flow_packet_id":2,"flow_last_seen":174342,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174342,"pkt":"UlQAEjUCCAAn5uVZCABFAAByeiEAAIARB1EKAAIPUc1bLXAJlZkAXranfCExAmltWPgHip8OOUDUwEQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="}
 00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2816,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174342,"flow_last_seen":174342,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174342,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":28681,"dst_port":49956,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2816,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_packet_id":1,"flow_last_seen":174342,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174342,"pkt":"UlQAEjUCCAAn5uVZCABFAAByzKsAAIARKPUKAAIPlRyjr3AJwyQAXo4hNNYxAkNtQBP87WWbzy94OkQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2816,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174342,"flow_last_seen":174342,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174342,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":28681,"dst_port":49956,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2816,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174342,"flow_last_seen":174342,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174342,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":28681,"dst_port":49956,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2817,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":368,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174343,"flow_last_seen":174343,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174343,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":28681,"dst_port":36728,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2817,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":368,"flow_packet_id":1,"flow_last_seen":174343,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174343,"pkt":"UlQAEjUCCAAn5uVZCABFAAByuwkAAIARD7sKAAIPL5M0FXAJj3gAXq06x7YxAq8Sv7XsAP61JE4GfUQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="}
-00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2817,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":368,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174343,"flow_last_seen":174343,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174343,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":28681,"dst_port":36728,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2817,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":368,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174343,"flow_last_seen":174343,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174343,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":28681,"dst_port":36728,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 01407{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2827,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_packet_id":2,"flow_last_seen":174648,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":174648,"pkt":"CAAn5uVZUlQAEjUCCABFAALzB\/MAAEARKy2VHKOvCgACD8MkcAkC37mfNNYxAkNtQBP87WWbzy94OkQAAMACAAAGR1RLRwAAQTW8kBkL86J3th0pUYoQZu1JqkUElRyjr8MkAQAAAAThq6+iFEdUS0cAAFxg+taEWAYB1unX7flSWQRG3beNBGic4kjQCkdUS0cAAFuWTCQAv7KdBMgSGC6mmSLY5\/ECBMKjtH4qSVdTSFIAAFpCOi4aZIiG9lYEyciBumqkMMTzBMY62gy7KEdUS0cAAFf2jq05FgyfJOGIcRJLg6NdtQ1eBLw9NLcuTEdUS0cAAFYaYH8fxSMCFJGx6KJ1XnlYMcAbBL7A0rYaYkdUS0cAAFFI2BA3K8AVe0IqJAEnw9\/D630lBI6EpQ13ZkdUS0cAAFITSOd3gRniYdJwpHJZH2SZ8zLzBFaBxFQmu1dTSFIAAEwNRRSjJbzqx43c9rTKLbxkbHgKBF4IN57HxEdUS0cAAElxJg9dajjzW3txW7a4q7j8IGI0BFHNWy2VmVdTSFIAAEJDtkelhifx87ftq707Fzo\/U0PdBC+TNBWPeEdUS0cAAGqU5DC0wpx7Tt\/+AtuQJkODlGIrBC\/cuoxr+UdUS0cAAGSQPhJYYczqO9fA1uqwCWebPjcpBMEgftbozEdUS0cAAGfwY9tAxh1AXF0ZU2EOIfqDQ08tBHbwRccYzEdUS0cAAGcZJHUoqfb+iSo9+1Aaw4nAX4zABFAH\/MAa6EdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzukdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZsldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAABZMZh8YJqCRZ8rsFWpJujOrF1VMBFHNWy2cyQ=="}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3065,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":2,"flow_last_seen":191700,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191700,"pkt":"UlQAEjUCCAAn5uVZCABFAAA00HEAAIARI3sKAAIPfCy+kXAJJ7oAIMCGR05EED8oAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3066,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":2,"flow_last_seen":191700,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191700,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0uoEAAIARu5gKAAIPXFhcOHAJUhEAIBhcR05EED8pAQFUC1FLUlAGUk5BXS\/iNQlw"}
@@ -1379,25 +1379,25 @@
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3084,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":156,"flow_packet_id":2,"flow_last_seen":191703,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191703,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0lsMAAIARXJwKAAIPVvTkVnAJJ5MAIMANR05EED87AQFUC1FLUlAGUk5BXS\/iNQlw"}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3085,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":190,"flow_packet_id":2,"flow_last_seen":191704,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191704,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0VboAAIARb2MKAAIPpanD43AJGMoAIKCTR05EED88AQFUC1FLUlAGUk5BXS\/iNQlw"}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3086,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":2,"flow_last_seen":191704,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191704,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0dUAAAIARISYKAAIPsKPnoHAJGMoAIHHbR05EED89AQFUC1FLUlAGUk5BXS\/iNQlw"}
-00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":35,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":63000,"flow_last_seen":63524,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":1137,"flow_avg_l4_payload_len":113,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.250.6.59","src_port":50196,"dst_port":12556,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00794{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":46,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":64032,"flow_last_seen":64562,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":304,"flow_tot_l4_payload_len":304,"flow_avg_l4_payload_len":33,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.181.156.244","src_port":50206,"dst_port":8255,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":77,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":69142,"flow_last_seen":70230,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":756,"flow_tot_l4_payload_len":1058,"flow_avg_l4_payload_len":105,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.29.135.209","src_port":50236,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":73,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":69141,"flow_last_seen":69581,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1141,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.242.225","src_port":50232,"dst_port":15068,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":67,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":68108,"flow_last_seen":68639,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1147,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":50226,"dst_port":15677,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":35,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":63000,"flow_last_seen":63524,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":1137,"flow_avg_l4_payload_len":113,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.250.6.59","src_port":50196,"dst_port":12556,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00794{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":46,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":64032,"flow_last_seen":64562,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":304,"flow_tot_l4_payload_len":304,"flow_avg_l4_payload_len":33,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.181.156.244","src_port":50206,"dst_port":8255,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":77,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":69142,"flow_last_seen":70230,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":756,"flow_tot_l4_payload_len":1058,"flow_avg_l4_payload_len":105,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.29.135.209","src_port":50236,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":73,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":69141,"flow_last_seen":69581,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1141,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.242.225","src_port":50232,"dst_port":15068,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":67,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":68108,"flow_last_seen":68639,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1147,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":50226,"dst_port":15677,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":42,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":64030,"flow_last_seen":65583,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":50202,"dst_port":57648,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00557{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":42,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":64030,"flow_last_seen":65583,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":50202,"dst_port":57648,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":36,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":63001,"flow_last_seen":63616,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1136,"flow_avg_l4_payload_len":113,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":50197,"dst_port":3931,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":36,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":63001,"flow_last_seen":63616,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1136,"flow_avg_l4_payload_len":113,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":50197,"dst_port":3931,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":63,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":67093,"flow_last_seen":69216,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":50222,"dst_port":6523,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00556{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":63,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":67093,"flow_last_seen":69216,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":50222,"dst_port":6523,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
 00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":61,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":67092,"flow_last_seen":69473,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.196.226","src_port":50220,"dst_port":3820,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00556{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":61,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":67092,"flow_last_seen":69473,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.196.226","src_port":50220,"dst_port":3820,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":43,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":64031,"flow_last_seen":64521,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1140,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":50203,"dst_port":18994,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":43,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":64031,"flow_last_seen":64521,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1140,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":50203,"dst_port":18994,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":69,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":68109,"flow_last_seen":70047,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.241.31.96","src_port":50228,"dst_port":14384,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00556{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":69,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":68109,"flow_last_seen":70047,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.241.31.96","src_port":50228,"dst_port":14384,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00792{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":38,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":63001,"flow_last_seen":63445,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":66,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":50199,"dst_port":36728,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":51,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":65062,"flow_last_seen":65418,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":1142,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.199.10.60","src_port":50211,"dst_port":23458,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00794{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":76,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":69142,"flow_last_seen":69227,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":1089,"flow_avg_l4_payload_len":108,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.118.70","src_port":50235,"dst_port":6906,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00622{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":71216,"flow_last_seen":95489,"flow_idle_time":140000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}}
+00792{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":38,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":63001,"flow_last_seen":63445,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":66,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":50199,"dst_port":36728,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":51,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":65062,"flow_last_seen":65418,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":1142,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.199.10.60","src_port":50211,"dst_port":23458,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00794{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":76,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":69142,"flow_last_seen":69227,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":1089,"flow_avg_l4_payload_len":108,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.118.70","src_port":50235,"dst_port":6906,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00622{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":71216,"flow_last_seen":95489,"flow_idle_time":140000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}}
 00703{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3099,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":3,"flow_last_seen":192636,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":243,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":243,"pkt_l4_len":209,"thread_ts_msec":192636,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAADlHP0AAIARA\/4KAAIPCgAC\/wCKAIoA0X6VEQKcLwoAAg8AigC7AAAgRU5GREVGRUVFSEVGRkhFSkVPREJEQUNBQ0FDQUNBQ0EAIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUJOAP9TTUIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQAAIQAAAAAAAAAAAOgDAAAAAAAAAAAhAFYAAwABAAAAAgAyAFxNQUlMU0xPVFxCUk9XU0UAAQCAqQMATVNFREdFV0lOMTAAAAAAAAoAAxAAAA8BVaoA"}
 00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3103,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":306,"flow_packet_id":2,"flow_last_seen":192907,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192907,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0J3gAAIARnXEKAAIPKfk\/yHAJWDYAIGDxR05EED8+AQFUC1FLUlAGUk5BXS\/iNQlw"}
 00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3104,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":2,"flow_last_seen":192907,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192907,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0H4EAAIARbHsKAAIPTB5WkHAJ0j0AIK37R05EED8\/AQFUC1FLUlAGUk5BXS\/iNQlw"}
@@ -1410,75 +1410,75 @@
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3111,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":141,"flow_packet_id":3,"flow_last_seen":192908,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192908,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0s0sAAIARB+8KAAIPrGHHDnAJGMoAIJamR05EED9GAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3112,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":3,"flow_last_seen":192908,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192908,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0jJQAAIARUAcKAAIPp3KqnHAJXSQAIHOsR05EED9HAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3113,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":139,"flow_packet_id":3,"flow_last_seen":192908,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192908,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0770AAIARtrQKAAIPpanijnAJGMoAIIHcR05EED9IAQFUC1FLUlAGUk5BXS\/iNQlw"}
-00667{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":13118,"flow_last_seen":15640,"flow_idle_time":200000,"flow_min_l4_payload_len":1073,"flow_max_l4_payload_len":1073,"flow_tot_l4_payload_len":12876,"flow_avg_l4_payload_len":1073,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
-00654{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":12446,"flow_last_seen":12446,"flow_idle_time":200000,"flow_min_l4_payload_len":314,"flow_max_l4_payload_len":314,"flow_tot_l4_payload_len":314,"flow_avg_l4_payload_len":314,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"DHCP","breed":"Acceptable","category":"Network"}}
-00649{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":12447,"flow_last_seen":12447,"flow_idle_time":200000,"flow_min_l4_payload_len":548,"flow_max_l4_payload_len":548,"flow_tot_l4_payload_len":548,"flow_avg_l4_payload_len":548,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","src_port":67,"dst_port":68,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"DHCP","breed":"Acceptable","category":"Network"}}
+00667{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":13118,"flow_last_seen":15640,"flow_idle_time":200000,"flow_min_l4_payload_len":1073,"flow_max_l4_payload_len":1073,"flow_tot_l4_payload_len":12876,"flow_avg_l4_payload_len":1073,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
+00654{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":12446,"flow_last_seen":12446,"flow_idle_time":200000,"flow_min_l4_payload_len":314,"flow_max_l4_payload_len":314,"flow_tot_l4_payload_len":314,"flow_avg_l4_payload_len":314,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"DHCP","breed":"Acceptable","category":"Network"}}
+00649{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":12447,"flow_last_seen":12447,"flow_idle_time":200000,"flow_min_l4_payload_len":548,"flow_max_l4_payload_len":548,"flow_tot_l4_payload_len":548,"flow_avg_l4_payload_len":548,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","src_port":67,"dst_port":68,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"DHCP","breed":"Acceptable","category":"Network"}}
 00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":143,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":73299,"flow_last_seen":75239,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.201.161","src_port":50256,"dst_port":2886,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00557{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":143,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":73299,"flow_last_seen":75239,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.201.161","src_port":50256,"dst_port":2886,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":149,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":74329,"flow_last_seen":74396,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1102,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":50262,"dst_port":30577,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00675{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":13118,"flow_last_seen":15640,"flow_idle_time":200000,"flow_min_l4_payload_len":1091,"flow_max_l4_payload_len":1091,"flow_tot_l4_payload_len":13092,"flow_avg_l4_payload_len":1091,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
-00666{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":15285,"flow_last_seen":21297,"flow_idle_time":200000,"flow_min_l4_payload_len":95,"flow_max_l4_payload_len":95,"flow_tot_l4_payload_len":475,"flow_avg_l4_payload_len":95,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63960,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
-00793{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":119,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":72264,"flow_last_seen":72720,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":848,"flow_avg_l4_payload_len":84,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"27.94.154.53","src_port":50250,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":121,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":72266,"flow_last_seen":72656,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":954,"flow_avg_l4_payload_len":95,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.202.31.113","src_port":50252,"dst_port":19768,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":149,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":74329,"flow_last_seen":74396,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1102,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":50262,"dst_port":30577,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00675{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":13118,"flow_last_seen":15640,"flow_idle_time":200000,"flow_min_l4_payload_len":1091,"flow_max_l4_payload_len":1091,"flow_tot_l4_payload_len":13092,"flow_avg_l4_payload_len":1091,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
+00666{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":15285,"flow_last_seen":21297,"flow_idle_time":200000,"flow_min_l4_payload_len":95,"flow_max_l4_payload_len":95,"flow_tot_l4_payload_len":475,"flow_avg_l4_payload_len":95,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63960,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00793{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":119,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":72264,"flow_last_seen":72720,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":848,"flow_avg_l4_payload_len":84,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"27.94.154.53","src_port":50250,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":121,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":72266,"flow_last_seen":72656,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":954,"flow_avg_l4_payload_len":95,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.202.31.113","src_port":50252,"dst_port":19768,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":153,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":75359,"flow_last_seen":77504,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.175.103","src_port":50266,"dst_port":4315,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00557{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":153,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":75359,"flow_last_seen":77504,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.175.103","src_port":50266,"dst_port":4315,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00794{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":63001,"flow_last_seen":78562,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1097,"flow_avg_l4_payload_len":91,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":50198,"dst_port":9915,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":146,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":74327,"flow_last_seen":74692,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":1108,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.90.112","src_port":50259,"dst_port":9852,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":122,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":72266,"flow_last_seen":72907,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1105,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":50253,"dst_port":43508,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00655{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":63717,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
-00669{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":63717,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
-00664{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":15469,"flow_last_seen":22405,"flow_idle_time":200000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":4368,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63964,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
-00656{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"finished","flow_packets_processed":15,"flow_first_seen":12827,"flow_last_seen":41755,"flow_idle_time":200000,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":966,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"NetBIOS","breed":"Acceptable","category":"System"}}
-00783{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":16487,"flow_last_seen":192636,"flow_idle_time":200000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":603,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
-00665{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"finished","flow_packets_processed":13,"flow_first_seen":15284,"flow_last_seen":23969,"flow_idle_time":200000,"flow_min_l4_payload_len":101,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":1601,"flow_avg_l4_payload_len":123,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
-00672{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":15469,"flow_last_seen":21843,"flow_idle_time":200000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":4368,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63965,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
-00655{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":12529,"flow_last_seen":43193,"flow_idle_time":200000,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":348,"flow_avg_l4_payload_len":38,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"}}
-00669{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":12529,"flow_last_seen":43193,"flow_idle_time":200000,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":348,"flow_avg_l4_payload_len":38,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"}}
-00669{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":12461,"flow_last_seen":75501,"flow_idle_time":200000,"flow_min_l4_payload_len":91,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":637,"flow_avg_l4_payload_len":91,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"DHCPV6","breed":"Acceptable","category":"Network"}}
-00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":293,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90746,"flow_last_seen":90799,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1111,"flow_avg_l4_payload_len":111,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":50317,"dst_port":21995,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00662{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":15469,"flow_last_seen":22405,"flow_idle_time":200000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":4368,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63964,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
-00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":292,"flow_state":"finished","flow_packets_processed":24,"flow_first_seen":90746,"flow_last_seen":91392,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":3761,"flow_avg_l4_payload_len":156,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":50316,"dst_port":30566,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":289,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90746,"flow_last_seen":91151,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":620,"flow_tot_l4_payload_len":1717,"flow_avg_l4_payload_len":143,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":50313,"dst_port":35481,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":223,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":84592,"flow_last_seen":85126,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1138,"flow_avg_l4_payload_len":113,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":50269,"dst_port":3186,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00793{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":148,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":74328,"flow_last_seen":88171,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":597,"flow_tot_l4_payload_len":850,"flow_avg_l4_payload_len":85,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"156.57.42.2","src_port":50261,"dst_port":33476,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":280,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90744,"flow_last_seen":90842,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":853,"flow_avg_l4_payload_len":85,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.168.34.105","src_port":50304,"dst_port":39908,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":285,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90745,"flow_last_seen":91380,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1100,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":50309,"dst_port":21301,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":283,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90745,"flow_last_seen":90863,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1090,"flow_avg_l4_payload_len":109,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":50307,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":295,"flow_state":"finished","flow_packets_processed":25,"flow_first_seen":90747,"flow_last_seen":91396,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":3774,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":50319,"dst_port":53489,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":298,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90747,"flow_last_seen":90902,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":670,"flow_tot_l4_payload_len":1773,"flow_avg_l4_payload_len":147,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":50322,"dst_port":55302,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00663{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"finished","flow_packets_processed":13,"flow_first_seen":15284,"flow_last_seen":23969,"flow_idle_time":200000,"flow_min_l4_payload_len":101,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":1601,"flow_avg_l4_payload_len":123,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00794{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":63001,"flow_last_seen":78562,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1097,"flow_avg_l4_payload_len":91,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":50198,"dst_port":9915,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":146,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":74327,"flow_last_seen":74692,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":1108,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.90.112","src_port":50259,"dst_port":9852,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":122,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":72266,"flow_last_seen":72907,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1105,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":50253,"dst_port":43508,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00655{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":63717,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
+00669{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":200000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":63717,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
+00664{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":15469,"flow_last_seen":22405,"flow_idle_time":200000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":4368,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63964,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
+00656{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"finished","flow_packets_processed":15,"flow_first_seen":12827,"flow_last_seen":41755,"flow_idle_time":200000,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":966,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"NetBIOS","breed":"Acceptable","category":"System"}}
+00783{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":16487,"flow_last_seen":192636,"flow_idle_time":200000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":603,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
+00665{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"finished","flow_packets_processed":13,"flow_first_seen":15284,"flow_last_seen":23969,"flow_idle_time":200000,"flow_min_l4_payload_len":101,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":1601,"flow_avg_l4_payload_len":123,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00672{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":15469,"flow_last_seen":21843,"flow_idle_time":200000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":4368,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63965,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
+00655{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":12529,"flow_last_seen":43193,"flow_idle_time":200000,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":348,"flow_avg_l4_payload_len":38,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"}}
+00669{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":12529,"flow_last_seen":43193,"flow_idle_time":200000,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":348,"flow_avg_l4_payload_len":38,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"}}
+00669{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":12461,"flow_last_seen":75501,"flow_idle_time":200000,"flow_min_l4_payload_len":91,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":637,"flow_avg_l4_payload_len":91,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"DHCPV6","breed":"Acceptable","category":"Network"}}
+00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":293,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90746,"flow_last_seen":90799,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1111,"flow_avg_l4_payload_len":111,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":50317,"dst_port":21995,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00662{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":15469,"flow_last_seen":22405,"flow_idle_time":200000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":4368,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63964,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
+00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":292,"flow_state":"finished","flow_packets_processed":24,"flow_first_seen":90746,"flow_last_seen":91392,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":3761,"flow_avg_l4_payload_len":156,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":50316,"dst_port":30566,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":289,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90746,"flow_last_seen":91151,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":620,"flow_tot_l4_payload_len":1717,"flow_avg_l4_payload_len":143,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":50313,"dst_port":35481,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":223,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":84592,"flow_last_seen":85126,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1138,"flow_avg_l4_payload_len":113,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":50269,"dst_port":3186,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00793{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":148,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":74328,"flow_last_seen":88171,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":597,"flow_tot_l4_payload_len":850,"flow_avg_l4_payload_len":85,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"156.57.42.2","src_port":50261,"dst_port":33476,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":280,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90744,"flow_last_seen":90842,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":853,"flow_avg_l4_payload_len":85,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.168.34.105","src_port":50304,"dst_port":39908,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":285,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90745,"flow_last_seen":91380,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1100,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":50309,"dst_port":21301,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":283,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90745,"flow_last_seen":90863,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1090,"flow_avg_l4_payload_len":109,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":50307,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":295,"flow_state":"finished","flow_packets_processed":25,"flow_first_seen":90747,"flow_last_seen":91396,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":3774,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":50319,"dst_port":53489,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":298,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90747,"flow_last_seen":90902,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":670,"flow_tot_l4_payload_len":1773,"flow_avg_l4_payload_len":147,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":50322,"dst_port":55302,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00663{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"finished","flow_packets_processed":13,"flow_first_seen":15284,"flow_last_seen":23969,"flow_idle_time":200000,"flow_min_l4_payload_len":101,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":1601,"flow_avg_l4_payload_len":123,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":237,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":87671,"flow_last_seen":88801,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":50283,"dst_port":35004,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00557{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":237,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":87671,"flow_last_seen":88801,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":50283,"dst_port":35004,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00670{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":15469,"flow_last_seen":21843,"flow_idle_time":200000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":4368,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63965,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
-00793{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":269,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":90739,"flow_last_seen":91076,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":99,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":50293,"dst_port":8890,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":296,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90747,"flow_last_seen":90793,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1119,"flow_avg_l4_payload_len":111,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":50320,"dst_port":10825,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":284,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90745,"flow_last_seen":91127,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":663,"flow_tot_l4_payload_len":1764,"flow_avg_l4_payload_len":147,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":50308,"dst_port":61616,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":291,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90746,"flow_last_seen":91171,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":690,"flow_tot_l4_payload_len":1789,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":50315,"dst_port":26851,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":279,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90744,"flow_last_seen":90809,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1114,"flow_avg_l4_payload_len":111,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":50303,"dst_port":24562,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":271,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90740,"flow_last_seen":91277,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":663,"flow_tot_l4_payload_len":1764,"flow_avg_l4_payload_len":147,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":50295,"dst_port":49732,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":221,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":83805,"flow_last_seen":84251,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":1139,"flow_avg_l4_payload_len":113,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":50267,"dst_port":9239,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":270,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":90740,"flow_last_seen":91408,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":100,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":50294,"dst_port":37058,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00793{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":272,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90741,"flow_last_seen":90825,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":853,"flow_avg_l4_payload_len":85,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.58.211.52","src_port":50296,"dst_port":3806,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":275,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90742,"flow_last_seen":91375,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":877,"flow_avg_l4_payload_len":87,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":50299,"dst_port":1194,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":294,"flow_state":"finished","flow_packets_processed":25,"flow_first_seen":90746,"flow_last_seen":91439,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":3759,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.32.126.214","src_port":50318,"dst_port":59596,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":274,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90741,"flow_last_seen":90864,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":865,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":50298,"dst_port":6578,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-01223{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_state":"finished","flow_packets_processed":21,"flow_first_seen":90746,"flow_last_seen":90948,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":3245,"flow_avg_l4_payload_len":154,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":50314,"dst_port":6888,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Proto on Non Std Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"6": {"risk":"Self-signed Cert","severity":"High","risk_score": {"total":500,"client":450,"server":50}},"9": {"risk":"TLS Cert Expired","severity":"High","risk_score": {"total":260,"client":230,"server":30}},"15": {"risk":"TLS (probably) Not Carrying HTTPS","severity":"Low","risk_score": {"total":760,"client":680,"server":80}},"24": {"risk":"Missing SNI TLS Extn","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"4":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"}}
-00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":222,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":84592,"flow_last_seen":85055,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":1144,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"210.209.249.84","src_port":50268,"dst_port":24751,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":273,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90741,"flow_last_seen":91415,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":903,"flow_avg_l4_payload_len":90,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":50297,"dst_port":45710,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":299,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90747,"flow_last_seen":90850,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1111,"flow_avg_l4_payload_len":111,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":50323,"dst_port":26253,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00670{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":15469,"flow_last_seen":21843,"flow_idle_time":200000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":4368,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63965,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
+00793{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":269,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":90739,"flow_last_seen":91076,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":99,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":50293,"dst_port":8890,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":296,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90747,"flow_last_seen":90793,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1119,"flow_avg_l4_payload_len":111,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":50320,"dst_port":10825,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":284,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90745,"flow_last_seen":91127,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":663,"flow_tot_l4_payload_len":1764,"flow_avg_l4_payload_len":147,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":50308,"dst_port":61616,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":291,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90746,"flow_last_seen":91171,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":690,"flow_tot_l4_payload_len":1789,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":50315,"dst_port":26851,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":279,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90744,"flow_last_seen":90809,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1114,"flow_avg_l4_payload_len":111,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":50303,"dst_port":24562,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":271,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90740,"flow_last_seen":91277,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":663,"flow_tot_l4_payload_len":1764,"flow_avg_l4_payload_len":147,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":50295,"dst_port":49732,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":221,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":83805,"flow_last_seen":84251,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":1139,"flow_avg_l4_payload_len":113,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":50267,"dst_port":9239,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":270,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":90740,"flow_last_seen":91408,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":100,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":50294,"dst_port":37058,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00793{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":272,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90741,"flow_last_seen":90825,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":853,"flow_avg_l4_payload_len":85,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.58.211.52","src_port":50296,"dst_port":3806,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":275,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90742,"flow_last_seen":91375,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":877,"flow_avg_l4_payload_len":87,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":50299,"dst_port":1194,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":294,"flow_state":"finished","flow_packets_processed":25,"flow_first_seen":90746,"flow_last_seen":91439,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":3759,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.32.126.214","src_port":50318,"dst_port":59596,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":274,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90741,"flow_last_seen":90864,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":865,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":50298,"dst_port":6578,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+01223{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_state":"finished","flow_packets_processed":21,"flow_first_seen":90746,"flow_last_seen":90948,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":3245,"flow_avg_l4_payload_len":154,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":50314,"dst_port":6888,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Proto on Non Std Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"6": {"risk":"Self-signed Cert","severity":"High","risk_score": {"total":500,"client":450,"server":50}},"9": {"risk":"TLS Cert Expired","severity":"High","risk_score": {"total":260,"client":230,"server":30}},"15": {"risk":"TLS (probably) Not Carrying HTTPS","severity":"Low","risk_score": {"total":760,"client":680,"server":80}},"24": {"risk":"Missing SNI TLS Extn","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"6":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"}}
+00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":222,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":84592,"flow_last_seen":85055,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":1144,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"210.209.249.84","src_port":50268,"dst_port":24751,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":273,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90741,"flow_last_seen":91415,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":903,"flow_avg_l4_payload_len":90,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":50297,"dst_port":45710,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":299,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90747,"flow_last_seen":90850,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1111,"flow_avg_l4_payload_len":111,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":50323,"dst_port":26253,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3367,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":369,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":219447,"flow_last_seen":219447,"flow_idle_time":200000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":219447,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.187.171.240","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00476{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3367,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":369,"flow_packet_id":1,"flow_last_seen":219447,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"thread_ts_msec":219447,"pkt":"UlQAEjUCCAAn5uVZCABFAABD+bUAAIARLzoKAAIPWbur8HAJGMoAL2mkIFAxArFAxy3\/Egk2kZ9VAwABABAAAADDA1NDUEECglZDRUdUS0di"}
-00620{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":71216,"flow_last_seen":95489,"flow_idle_time":140000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}}
-00654{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"finished","flow_packets_processed":15,"flow_first_seen":12827,"flow_last_seen":41755,"flow_idle_time":200000,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":966,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"NetBIOS","breed":"Acceptable","category":"System"}}
-00655{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":40232,"flow_last_seen":40630,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":62539,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
-00655{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":40232,"flow_last_seen":40630,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":50435,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
-00669{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":40232,"flow_last_seen":40630,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":62539,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
-00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":277,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90743,"flow_last_seen":96110,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1100,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":50301,"dst_port":54130,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00669{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":40232,"flow_last_seen":40630,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":50435,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
-00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":287,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90745,"flow_last_seen":91669,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":628,"flow_tot_l4_payload_len":1729,"flow_avg_l4_payload_len":144,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":50311,"dst_port":49956,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":282,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":90744,"flow_last_seen":98168,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":100,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.238.145.82","src_port":50306,"dst_port":33527,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00792{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":278,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":90743,"flow_last_seen":101917,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":597,"flow_tot_l4_payload_len":597,"flow_avg_l4_payload_len":99,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.64.6.175","src_port":50302,"dst_port":4743,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00663{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":40005,"flow_last_seen":43055,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":55708,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00620{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":71216,"flow_last_seen":95489,"flow_idle_time":140000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}}
+00654{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"finished","flow_packets_processed":15,"flow_first_seen":12827,"flow_last_seen":41755,"flow_idle_time":200000,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":966,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"NetBIOS","breed":"Acceptable","category":"System"}}
+00655{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":40232,"flow_last_seen":40630,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":62539,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
+00655{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":40232,"flow_last_seen":40630,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":50435,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
+00669{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":40232,"flow_last_seen":40630,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":62539,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
+00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":277,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90743,"flow_last_seen":96110,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1100,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":50301,"dst_port":54130,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00669{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":40232,"flow_last_seen":40630,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":50435,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
+00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":287,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90745,"flow_last_seen":91669,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":628,"flow_tot_l4_payload_len":1729,"flow_avg_l4_payload_len":144,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":50311,"dst_port":49956,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":282,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":90744,"flow_last_seen":98168,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":100,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.238.145.82","src_port":50306,"dst_port":33527,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00792{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":278,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":90743,"flow_last_seen":101917,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":597,"flow_tot_l4_payload_len":597,"flow_avg_l4_payload_len":99,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.64.6.175","src_port":50302,"dst_port":4743,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00663{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":40005,"flow_last_seen":43055,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":55708,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":370,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229238,"flow_last_seen":229238,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":229238,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.172.56.198","src_port":28681,"dst_port":11984,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":370,"flow_packet_id":1,"flow_last_seen":229238,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":229238,"pkt":"UlQAEjUCCAAn5uVZCABFAABpeXIAAIARIJEKAAIPW6w4xnAJLtAAVXM5R05EED9JAQFMQVEyUApVRFBdL+I1CXBBRaArSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="}
 00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3452,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":371,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229238,"flow_last_seen":229238,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":229238,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.131.202.24","src_port":28681,"dst_port":44748,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
@@ -1489,10 +1489,10 @@
 00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3454,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":373,"flow_packet_id":1,"flow_last_seen":229239,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":229239,"pkt":"UlQAEjUCCAAn5uVZCABFAABpd+QAAIARdQcKAAIPWHrpD3AJLOAAVT9CR05EED9MAQFMQVEyUApVRFBdL+I1CXDHjOZsSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3455,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":374,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229240,"flow_last_seen":229240,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":229240,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"62.35.190.5","src_port":28681,"dst_port":18604,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3455,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":374,"flow_packet_id":1,"flow_last_seen":229240,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":229240,"pkt":"UlQAEjUCCAAn5uVZCABFAABpQyQAAIAR7ygKAAIPPiO+BXAJSKwAVQDtR05EED9NAQFMQVEyUApVRFBdL+I1CXAx8WVwSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="}
-00661{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3481,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":40005,"flow_last_seen":43055,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":232090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":55708,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
-00653{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3481,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":12529,"flow_last_seen":43193,"flow_idle_time":200000,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":348,"flow_avg_l4_payload_len":38,"midstream":0,"thread_ts_msec":232090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"}}
-00667{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3481,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":12529,"flow_last_seen":43193,"flow_idle_time":200000,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":348,"flow_avg_l4_payload_len":38,"midstream":0,"thread_ts_msec":232090,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"}}
-00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":267,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":90738,"flow_last_seen":115276,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":74,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.7.155.210","src_port":50291,"dst_port":28365,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00661{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3481,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":40005,"flow_last_seen":43055,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":232090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":55708,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00653{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3481,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":12529,"flow_last_seen":43193,"flow_idle_time":200000,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":348,"flow_avg_l4_payload_len":38,"midstream":0,"thread_ts_msec":232090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"}}
+00667{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3481,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":12529,"flow_last_seen":43193,"flow_idle_time":200000,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":348,"flow_avg_l4_payload_len":38,"midstream":0,"thread_ts_msec":232090,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"}}
+00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":267,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":90738,"flow_last_seen":115276,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":74,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.7.155.210","src_port":50291,"dst_port":28365,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00565{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":26,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61191,"flow_last_seen":61191,"flow_idle_time":200000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57619,"dst_port":5351,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00550{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":26,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61191,"flow_last_seen":61191,"flow_idle_time":200000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57619,"dst_port":5351,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00565{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":27,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61470,"flow_last_seen":61470,"flow_idle_time":200000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57620,"dst_port":5351,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -1754,7 +1754,7 @@
 00846{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3835,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":414,"flow_packet_id":2,"flow_last_seen":252054,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":351,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":351,"pkt_l4_len":317,"thread_ts_msec":252054,"pkt":"CAAn5uVZUlQAEjUCCABFAAFRCikAAEARFruvtZz0CgACDyA\/cAkBPRaQR05EASwmAQF4nOspZwx09GAJCV7IpZrkwOGyfuucL\/YKSgxA5ul7fKtUoo+BmEVqnEHz4w6DmFpJxQ2LoneAmCrvr076FrIPxLztrlNpZ7EdxKw+W5fmKQLWdjuUO\/SR5kEQ89YS9ZflgSfAzLXPkmy89kNMWCRtJA824U5n1tpM3b1g2yS2Nd0Ig5jgZiDeJq8GYpZ\/Z3v0URXC\/DbZ444gmHmnX+lhup8KiGl7R\/PjVDEmsCOZ7GQ+SyiA1fL1v10UzQBW4LDRdFE0H9gK9VmuD4QYQcxT0+2tT8gKgpiMCwOCLijKg5gF5Z\/yPsmBDVN5yXzfwIgRwtS61CEK9AVbMCQcgAyId4AMiFNAjNaqm2ApiPc8WIIcdRgZGBhi9R+ZGjIxpEgd+fTSj7OAHwDkZn\/e"}
 00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3837,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":463,"flow_packet_id":2,"flow_last_seen":252237,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":252237,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCisAAEARAJDIB5vSCgACD27NcAkANlqcvVsxAoZuEFj\/eIRjgIUUAwEBABcAAADNbsgHm9IAAAAACAAAAMOCUUtEApadXA=="}
 00841{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3838,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":434,"flow_packet_id":2,"flow_last_seen":252481,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":346,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":346,"pkt_l4_len":312,"thread_ts_msec":252481,"pkt":"CAAn5uVZUlQAEjUCCABFAAFMCiwAAEAROsxyGLaCCgACD1bYcAkBOFVRR05EAXxtAQF4nOvJYQx09GAJCV7MpZrkwOFSJLGt6UbYMQYgUyupuGFR9A4Q89baZ0k2XvtBzNP3+FapRIMV3Fqi\/rI88ASIWaTGGTQ\/7jCIqfL+6qRvIftAzDutVTcXRR8HMavP1qV5ioC13XbXqbSz2A5W0Jm1NlN3L0TbImkjeYi2tuVBe8QOgZjrt6lzbzQ6AGZunfPFXkEZxCz\/zvboo6oamPltsscdQTDT9o7mx6liTGCnM9nJfJZQABvWr\/Qw3U8FxNy+OaqgRk0brI2v\/+2iaAawNoeNpoui+UDMU9PtrU\/ICoKYjAsDgi4oyoFd9pL5voERI4MDWzDENiDjtpuBeJs8kAHxLZAB8SCc4cES5KjDyMDAEKv\/yNSQiSFF6sinl36cBfwAxlh+fA=="}
-00662{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":54,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":65065,"flow_last_seen":65065,"flow_idle_time":200000,"flow_min_l4_payload_len":146,"flow_max_l4_payload_len":182,"flow_tot_l4_payload_len":1042,"flow_avg_l4_payload_len":173,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57623,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00662{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":54,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":65065,"flow_last_seen":65065,"flow_idle_time":200000,"flow_min_l4_payload_len":146,"flow_max_l4_payload_len":182,"flow_tot_l4_payload_len":1042,"flow_avg_l4_payload_len":173,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57623,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":96,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71535,"flow_last_seen":71535,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.160.214.137","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":96,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71535,"flow_last_seen":71535,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.160.214.137","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":100,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71536,"flow_last_seen":71536,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.133.122.217","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -1763,7 +1763,7 @@
 00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":115,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71540,"flow_last_seen":71540,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"154.3.42.104","src_port":28681,"dst_port":11804,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":101,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71537,"flow_last_seen":71537,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.126.102","src_port":28681,"dst_port":5193,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":101,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71537,"flow_last_seen":71537,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.126.102","src_port":28681,"dst_port":5193,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00913{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":345,"flow_state":"finished","flow_packets_processed":21,"flow_first_seen":126831,"flow_last_seen":130215,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":10878,"flow_avg_l4_payload_len":518,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50330,"dst_port":46906,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00913{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":345,"flow_state":"finished","flow_packets_processed":21,"flow_first_seen":126831,"flow_last_seen":130215,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":10878,"flow_avg_l4_payload_len":518,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50330,"dst_port":46906,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":106,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.39.154.69","src_port":28681,"dst_port":4832,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":106,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.39.154.69","src_port":28681,"dst_port":4832,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":86,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":70230,"flow_last_seen":70230,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.210.244.72","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -1772,7 +1772,7 @@
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":112,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71540,"flow_last_seen":71540,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.239.213.146","src_port":28681,"dst_port":21750,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":99,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71536,"flow_last_seen":71536,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.38.9.82","src_port":28681,"dst_port":24223,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":99,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71536,"flow_last_seen":71536,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.38.9.82","src_port":28681,"dst_port":24223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00630{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":349,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":129210,"flow_last_seen":129210,"flow_idle_time":140000,"flow_min_l4_payload_len":117,"flow_max_l4_payload_len":117,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":117,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"84.197.97.94","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}}
+00630{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":349,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":129210,"flow_last_seen":129210,"flow_idle_time":140000,"flow_min_l4_payload_len":117,"flow_max_l4_payload_len":117,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":117,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"84.197.97.94","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}}
 00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":107,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"202.151.63.59","src_port":28681,"dst_port":7624,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":107,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"202.151.63.59","src_port":28681,"dst_port":7624,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":103,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71537,"flow_last_seen":71537,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.134.167.82","src_port":28681,"dst_port":5820,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -1825,7 +1825,7 @@
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":131,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72851,"flow_last_seen":72851,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.225.140.186","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":127,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72850,"flow_last_seen":72850,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.191.49.159","src_port":28681,"dst_port":1024,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":127,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72850,"flow_last_seen":72850,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.191.49.159","src_port":28681,"dst_port":1024,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00667{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":12461,"flow_last_seen":75501,"flow_idle_time":200000,"flow_min_l4_payload_len":91,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":637,"flow_avg_l4_payload_len":91,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"DHCPV6","breed":"Acceptable","category":"Network"}}
+00667{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":12461,"flow_last_seen":75501,"flow_idle_time":200000,"flow_min_l4_payload_len":91,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":637,"flow_avg_l4_payload_len":91,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"DHCPV6","breed":"Acceptable","category":"Network"}}
 00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":132,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72851,"flow_last_seen":72851,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"79.86.173.45","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":132,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72851,"flow_last_seen":72851,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"79.86.173.45","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":134,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":72852,"flow_last_seen":131670,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.231.73.14","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
@@ -1937,49 +1937,49 @@
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":204,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.126.240.32","src_port":28681,"dst_port":45313,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":202,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.134.139.39","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":202,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.134.139.39","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":89829,"flow_last_seen":174528,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3570,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.84.178.16","src_port":28681,"dst_port":60262,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":89829,"flow_last_seen":174528,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3570,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.84.178.16","src_port":28681,"dst_port":60262,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":166,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82059,"flow_last_seen":251735,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.59.253.186","src_port":28681,"dst_port":15555,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":183,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82062,"flow_last_seen":251737,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.172.15.182","src_port":28681,"dst_port":37829,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":184,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":191703,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.239.62.213","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90005,"flow_last_seen":243646,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4494,"flow_avg_l4_payload_len":321,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":28681,"dst_port":24562,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":90072,"flow_last_seen":163183,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.26.216.95","src_port":28681,"dst_port":13889,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90005,"flow_last_seen":243646,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4494,"flow_avg_l4_payload_len":321,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":28681,"dst_port":24562,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":90072,"flow_last_seen":163183,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.26.216.95","src_port":28681,"dst_port":13889,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":195,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82063,"flow_last_seen":253025,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"177.231.151.16","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":219,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":83520,"flow_last_seen":253025,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.30.86.144","src_port":28681,"dst_port":53821,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90184,"flow_last_seen":180130,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3575,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":1194,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90184,"flow_last_seen":180130,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3575,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":1194,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":304,"flow_state":"info","flow_packets_processed":18,"flow_first_seen":90880,"flow_last_seen":251799,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5105,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.32.126.214","src_port":28681,"dst_port":59596,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":191,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82063,"flow_last_seen":251735,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.153.143.54","src_port":28681,"dst_port":65535,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":172,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82060,"flow_last_seen":253024,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.69.142.133","src_port":28681,"dst_port":15471,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":242,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":88941,"flow_last_seen":179376,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":511,"flow_avg_l4_payload_len":63,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":28681,"dst_port":52367,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90073,"flow_last_seen":174761,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3575,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":89967,"flow_last_seen":152618,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.203.218.92","src_port":28681,"dst_port":56962,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00803{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90072,"flow_last_seen":180633,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5191,"flow_avg_l4_payload_len":370,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":28681,"dst_port":43508,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90073,"flow_last_seen":174761,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3575,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":89967,"flow_last_seen":152618,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.203.218.92","src_port":28681,"dst_port":56962,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00803{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90072,"flow_last_seen":180633,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5191,"flow_avg_l4_payload_len":370,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":28681,"dst_port":43508,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":300,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":90809,"flow_last_seen":139723,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1817,"flow_avg_l4_payload_len":227,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":187,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":191700,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.88.92.56","src_port":28681,"dst_port":21009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":190,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82063,"flow_last_seen":251737,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.195.227","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":89966,"flow_last_seen":180691,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":26253,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":90039,"flow_last_seen":163151,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":50297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":89966,"flow_last_seen":152619,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.218","src_port":28681,"dst_port":6909,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":89966,"flow_last_seen":180691,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":26253,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":90039,"flow_last_seen":163151,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":50297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":89966,"flow_last_seen":152619,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.218","src_port":28681,"dst_port":6909,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":173,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82060,"flow_last_seen":192907,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"121.99.222.36","src_port":28681,"dst_port":44988,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":180,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82061,"flow_last_seen":132833,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.131.24.72","src_port":28681,"dst_port":30711,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":90039,"flow_last_seen":163151,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":28681,"dst_port":36368,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":90039,"flow_last_seen":163151,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":28681,"dst_port":36368,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":156,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82057,"flow_last_seen":253025,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.244.228.86","src_port":28681,"dst_port":10131,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00561{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":176,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82061,"flow_last_seen":253025,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.99.164.4","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":303,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90871,"flow_last_seen":251762,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1247,"flow_avg_l4_payload_len":207,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":28681,"dst_port":30566,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00800{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":89829,"flow_last_seen":174144,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3570,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":28681,"dst_port":35481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":89829,"flow_last_seen":174144,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3570,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":28681,"dst_port":35481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":164,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131671,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.197.219.85","src_port":28681,"dst_port":26234,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00568{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":301,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90845,"flow_last_seen":174321,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1001,"flow_avg_l4_payload_len":166,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":28681,"dst_port":11852,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":157,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82058,"flow_last_seen":251736,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.227.162.150","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":209,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82066,"flow_last_seen":253024,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.179.98.234","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90138,"flow_last_seen":252085,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3710,"flow_avg_l4_payload_len":309,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":28681,"dst_port":21301,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90138,"flow_last_seen":252085,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3710,"flow_avg_l4_payload_len":309,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":28681,"dst_port":21301,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":243,"flow_state":"info","flow_packets_processed":19,"flow_first_seen":89016,"flow_last_seen":176659,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4777,"flow_avg_l4_payload_len":251,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":159,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82058,"flow_last_seen":191704,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.163.231.160","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00568{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90864,"flow_last_seen":124089,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":943,"flow_avg_l4_payload_len":235,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":53489,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90039,"flow_last_seen":180164,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5191,"flow_avg_l4_payload_len":370,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":30577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90039,"flow_last_seen":180164,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5191,"flow_avg_l4_payload_len":370,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":30577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00561{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":213,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":83518,"flow_last_seen":253026,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"5.180.62.37","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":167,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":132832,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.29.107.176","src_port":28681,"dst_port":20363,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":171,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82060,"flow_last_seen":253025,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"196.217.132.111","src_port":28681,"dst_port":25394,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":160,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82058,"flow_last_seen":191703,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.150.49.35","src_port":28681,"dst_port":32448,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":89829,"flow_last_seen":152619,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":12012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":89829,"flow_last_seen":152619,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":12012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":185,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":251737,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.196.58","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":165,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131670,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.75.43.182","src_port":28681,"dst_port":43502,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":161,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82058,"flow_last_seen":191703,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.120.26.86","src_port":28681,"dst_port":29946,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
@@ -1987,48 +1987,48 @@
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":177,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82061,"flow_last_seen":132833,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.157.183.106","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":175,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82060,"flow_last_seen":253024,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"115.69.62.99","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":182,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":131672,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.3.103.37","src_port":28681,"dst_port":35589,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00796{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":90138,"flow_last_seen":174723,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.217.176.52","src_port":28681,"dst_port":7446,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90005,"flow_last_seen":180322,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5191,"flow_avg_l4_payload_len":370,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":28681,"dst_port":61616,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":90138,"flow_last_seen":174723,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.217.176.52","src_port":28681,"dst_port":7446,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90005,"flow_last_seen":180322,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5191,"flow_avg_l4_payload_len":370,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":28681,"dst_port":61616,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":200,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82064,"flow_last_seen":253025,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"138.199.16.123","src_port":28681,"dst_port":52993,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":90004,"flow_last_seen":163118,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.140.120.41","src_port":28681,"dst_port":47739,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90138,"flow_last_seen":174930,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3575,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":28681,"dst_port":46010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":90004,"flow_last_seen":163118,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.140.120.41","src_port":28681,"dst_port":47739,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90138,"flow_last_seen":174930,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3575,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":28681,"dst_port":46010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":163,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131673,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.126.160.158","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":158,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82058,"flow_last_seen":251738,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.166.226.70","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00796{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":90183,"flow_last_seen":174679,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":28681,"dst_port":11603,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":90183,"flow_last_seen":174679,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":28681,"dst_port":11603,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4128,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":493,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":280014,"flow_last_seen":280014,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":280014,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57552,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4128,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":493,"flow_packet_id":1,"flow_last_seen":280014,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":280014,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LMAAAER3GYKAAIP7\/\/\/+uDQB2wAtgxeTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"}
-00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4128,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":493,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":280014,"flow_last_seen":280014,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":280014,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57552,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4128,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":493,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":280014,"flow_last_seen":280014,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":280014,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57552,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4138,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":493,"flow_packet_id":2,"flow_last_seen":281023,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":281023,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LQAAAER3GUKAAIP7\/\/\/+uDQB2wAtgxeTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"}
 00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4148,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":493,"flow_packet_id":3,"flow_last_seen":282039,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":282039,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LUAAAER3GQKAAIP7\/\/\/+uDQB2wAtgxeTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":320,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.236.200.137","src_port":28681,"dst_port":48142,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00793{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":325,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.160.143.48","src_port":28681,"dst_port":37036,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":320,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.236.200.137","src_port":28681,"dst_port":48142,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00793{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":325,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.160.143.48","src_port":28681,"dst_port":37036,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":305,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":93713,"flow_last_seen":93713,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.168.175.31","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":305,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":93713,"flow_last_seen":93713,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.168.175.31","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":323,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":56070,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00792{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":322,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.219","src_port":28681,"dst_port":6909,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00793{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":314,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":95754,"flow_last_seen":95754,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.237.202.91","src_port":28681,"dst_port":16117,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":329,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":101122,"flow_last_seen":134428,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.117.249.98","src_port":28681,"dst_port":6815,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":328,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":101122,"flow_last_seen":134428,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.105.27","src_port":28681,"dst_port":19260,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":101162,"flow_last_seen":177309,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3570,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":26851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":95216,"flow_last_seen":162802,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.201.208.57","src_port":28681,"dst_port":38617,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":95264,"flow_last_seen":176255,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.220.186.140","src_port":28681,"dst_port":27641,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95754,"flow_last_seen":139756,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.217.84.16","src_port":28681,"dst_port":20223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":101837,"flow_last_seen":251767,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":190,"flow_avg_l4_payload_len":63,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":95443,"flow_last_seen":176562,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.240.69.199","src_port":28681,"dst_port":6348,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":323,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":56070,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00792{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":322,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.219","src_port":28681,"dst_port":6909,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00793{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":314,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":95754,"flow_last_seen":95754,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.237.202.91","src_port":28681,"dst_port":16117,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":329,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":101122,"flow_last_seen":134428,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.117.249.98","src_port":28681,"dst_port":6815,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":328,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":101122,"flow_last_seen":134428,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.105.27","src_port":28681,"dst_port":19260,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":101162,"flow_last_seen":177309,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3570,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":26851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":95216,"flow_last_seen":162802,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.201.208.57","src_port":28681,"dst_port":38617,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":95264,"flow_last_seen":176255,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.220.186.140","src_port":28681,"dst_port":27641,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95754,"flow_last_seen":139756,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.217.84.16","src_port":28681,"dst_port":20223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":101837,"flow_last_seen":251767,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":190,"flow_avg_l4_payload_len":63,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":95443,"flow_last_seen":176562,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.240.69.199","src_port":28681,"dst_port":6348,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":306,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":93714,"flow_last_seen":253026,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.249.63.200","src_port":28681,"dst_port":22582,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95784,"flow_last_seen":139896,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.183.183.110","src_port":28681,"dst_port":59920,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":95715,"flow_last_seen":139730,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2424,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.188.98","src_port":28681,"dst_port":62851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95264,"flow_last_seen":179735,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":40137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":96049,"flow_last_seen":129345,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.28.53.225","src_port":28681,"dst_port":44859,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":95893,"flow_last_seen":251793,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1751,"flow_avg_l4_payload_len":291,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":21995,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95923,"flow_last_seen":139892,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.250.179.237","src_port":28681,"dst_port":20848,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":95784,"flow_last_seen":139889,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2424,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.236.205.7","src_port":28681,"dst_port":34794,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95716,"flow_last_seen":139781,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00800{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95893,"flow_last_seen":123936,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":55302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":101122,"flow_last_seen":168840,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2737,"flow_avg_l4_payload_len":342,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.64.44.11","src_port":28681,"dst_port":1352,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":96049,"flow_last_seen":129345,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.1.231.138","src_port":28681,"dst_port":56558,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":95784,"flow_last_seen":146329,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2424,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":63637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":95716,"flow_last_seen":243760,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":155,"flow_avg_l4_payload_len":51,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.167.201.53","src_port":28681,"dst_port":47282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95784,"flow_last_seen":139896,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.183.183.110","src_port":28681,"dst_port":59920,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":95715,"flow_last_seen":139730,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2424,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.188.98","src_port":28681,"dst_port":62851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95264,"flow_last_seen":179735,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":40137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":96049,"flow_last_seen":129345,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.28.53.225","src_port":28681,"dst_port":44859,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":95893,"flow_last_seen":251793,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1751,"flow_avg_l4_payload_len":291,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":21995,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95923,"flow_last_seen":139892,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.250.179.237","src_port":28681,"dst_port":20848,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":95784,"flow_last_seen":139889,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2424,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.236.205.7","src_port":28681,"dst_port":34794,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95716,"flow_last_seen":139781,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95893,"flow_last_seen":123936,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":55302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":101122,"flow_last_seen":168840,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2737,"flow_avg_l4_payload_len":342,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.64.44.11","src_port":28681,"dst_port":1352,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":96049,"flow_last_seen":129345,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.1.231.138","src_port":28681,"dst_port":56558,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":95784,"flow_last_seen":146329,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2424,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":63637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":95716,"flow_last_seen":243760,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":155,"flow_avg_l4_payload_len":51,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.167.201.53","src_port":28681,"dst_port":47282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4200,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":494,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287308,"flow_last_seen":287308,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287308,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.210.81.59","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4200,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":494,"flow_packet_id":1,"flow_last_seen":287308,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287308,"pkt":"UlQAEjUCCAAn5uVZCABFAABpuTwAAIARzSsKAAIPVtJRO3AJGMoAVf5iR05EED+uAQFMQVEyUApVRFBdL+I1CXBbSWKeSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="}
 00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4201,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":495,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287308,"flow_last_seen":287308,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287308,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.247.89.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
@@ -2638,7 +2638,7 @@
 00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4664,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":745,"flow_packet_id":1,"flow_last_seen":288355,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":288355,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ptwAAIAR2SwKAAIPpIQKGXAJvHoAJCauo68xAuqK3ib\/VZWObCGFAwABAAUAAADDglFLQA=="}
 00529{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4666,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":746,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":288409,"flow_last_seen":288409,"flow_idle_time":140000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":288409,"l3_proto":"ip4","src_ip":"164.132.10.25","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3}
 00501{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4666,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":746,"flow_packet_id":1,"flow_last_seen":288409,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":288409,"pkt":"CAAn5uVZUlQAEjUCCABFwABUC3cAAH8BdMakhAoZCgACDwMDt94AAAAARQAAOKbcAAB\/EdosCgACD6SEChlwCbx6ACQmrqOvMQLqit4m\/1WVjmwhhQMAAQAFAAAAw4JRS0A="}
-00607{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4666,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":746,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":288409,"flow_last_seen":288409,"flow_idle_time":140000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":288409,"l3_proto":"ip4","src_ip":"164.132.10.25","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":5.020679}
+00607{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4666,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":746,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":288409,"flow_last_seen":288409,"flow_idle_time":140000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":288409,"l3_proto":"ip4","src_ip":"164.132.10.25","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"6":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":5.020679}
 00852{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4671,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":517,"flow_packet_id":2,"flow_last_seen":288490,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":356,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":356,"pkt_l4_len":322,"thread_ts_msec":288490,"pkt":"CAAn5uVZUlQAEjUCCABFAAFWC3sAAEARmwMk76IbCgACDx8ycAkBQkS1R05EAVjxAQF4nOspZwx09GAJCT7CpZrkwOGi8n6RtJH8bgYgs0hiW9ONsGMg5p3WqpuLoo8zgBVcnfQtZB+Iedtdp9LOYjtYQWfW2kzdvWBtapxB8+MOg5haScUNi6J3gJi3lqi\/LA88AdYWyh36SPMAiLl+mzr3RiMwU+Wl1qUOUbCCO23Lg\/aI7Qcxq8\/WpXmKHAWr3Trni72CMtgENwPxNnk1ELP8O9ujj6rqYCZf\/9tF0Qxg5rfJHncEwQps72h+nCrGBHYOk53MZwkFEHP75qiCGjVtsAKHjaaLovnBTlef5fpAiBHEPDXd3vqErCCIybgwIOiCojzEkcz3DYyACtiCIaJABiSYgIw7\/UoP0\/2ADIhDgAyI9zxYghx1GBkYGGL1H5kaMjGkSB359NKPs4AfAD6Dfz4="}
 00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4683,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":747,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":289961,"flow_last_seen":289961,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":289961,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.126.102","src_port":28681,"dst_port":5193,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4683,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":747,"flow_packet_id":1,"flow_last_seen":289961,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":289961,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4bogAAIARxeoKAAIPe81+ZnAJFEkAJPn9btcxAoLvbJD\/ZQI2cb+qAwABAAUAAADDglFLQA=="}
@@ -2648,7 +2648,7 @@
 00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4701,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":569,"flow_packet_id":2,"flow_last_seen":291154,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":291154,"pkt":"CAAn5uVZUlQAEjUCCABFAABKC5AAAEARIKNJWfkICgACD8XZcAkANp0565kxAgUhZoj\/+H2oSNwcAwEBABcAAADZxUlZ+Qi8AAAAAAAgAMOCUUtE05ynKA=="}
 00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4702,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":569,"flow_packet_id":3,"flow_last_seen":291154,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":291154,"pkt":"UlQAEjUCCAAn5uVZCABFAABUghEAAIARahcKAAIPSVn5CHAJxdkAQIPAXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRNOcpygDU0NQQAFaQIJQUkA="}
 00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":335,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":115369,"flow_last_seen":287650,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":407,"flow_avg_l4_payload_len":50,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":28681,"dst_port":37058,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00800{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_state":"finished","flow_packets_processed":11,"flow_first_seen":116628,"flow_last_seen":287381,"flow_idle_time":200000,"flow_min_l4_payload_len":56,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3123,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":6888,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_state":"finished","flow_packets_processed":11,"flow_first_seen":116628,"flow_last_seen":287381,"flow_idle_time":200000,"flow_min_l4_payload_len":56,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3123,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":6888,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4904,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":161,"flow_packet_id":3,"flow_last_seen":311749,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":311749,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0tpYAAIARiEUKAAIP1XgaVnAJdPoAIL2TR05EED\/KAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4909,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":3,"flow_last_seen":311750,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":311750,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0dUEAAIARISUKAAIPsKPnoHAJGMoAIHFJR05EED\/PAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4911,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":3,"flow_last_seen":311750,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":311750,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0SbsAAIARjAIKAAIPdqbiRnAJGMoAILCeR05EED\/RAQFUC1FLUlAGUk5BXS\/iNQlw"}
@@ -2674,20 +2674,20 @@
 00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":3,"flow_last_seen":312957,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312957,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05pQAAIARsCAKAAIPTudJDnAJGMoAIHF1R05EED\/yAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4960,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":753,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":312961,"flow_last_seen":312961,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":312961,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.84.140.96","src_port":28681,"dst_port":14400,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4960,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":753,"flow_packet_id":1,"flow_last_seen":312961,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312961,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0s80AAIARSSgKAAIPpVSMYHAJOEAAILg+R05EED\/zAQFUC1FLUlAGUk5BXS\/iNQlw"}
-00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":338,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":123912,"flow_last_seen":124065,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":808,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.198.205.196","src_port":28681,"dst_port":20778,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":338,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":123912,"flow_last_seen":124065,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":808,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.198.205.196","src_port":28681,"dst_port":20778,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":354,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":132833,"flow_last_seen":132833,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.236.247.120","src_port":28681,"dst_port":1032,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":354,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":132833,"flow_last_seen":132833,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.236.247.120","src_port":28681,"dst_port":1032,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":353,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":132831,"flow_last_seen":132831,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.181.151.217","src_port":28681,"dst_port":25282,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":353,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":132831,"flow_last_seen":132831,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.181.151.217","src_port":28681,"dst_port":25282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":350,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":129345,"flow_last_seen":129345,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.250.253.99","src_port":28681,"dst_port":11819,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":343,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.212.91.155","src_port":28681,"dst_port":5195,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00793{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":348,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.197.97.94","src_port":28681,"dst_port":1360,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":346,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":129174,"flow_last_seen":129344,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":808,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.226.85.105","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":96049,"flow_last_seen":129345,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.28.53.225","src_port":28681,"dst_port":44859,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":350,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":129345,"flow_last_seen":129345,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.250.253.99","src_port":28681,"dst_port":11819,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":343,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.212.91.155","src_port":28681,"dst_port":5195,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00793{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":348,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.197.97.94","src_port":28681,"dst_port":1360,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":346,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":129174,"flow_last_seen":129344,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":808,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.226.85.105","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":96049,"flow_last_seen":129345,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.28.53.225","src_port":28681,"dst_port":44859,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":164,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131671,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.197.219.85","src_port":28681,"dst_port":26234,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":164,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131671,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.197.219.85","src_port":28681,"dst_port":26234,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":337,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.116.64.132","src_port":28681,"dst_port":51227,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":347,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.10.169.10","src_port":28681,"dst_port":12799,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":337,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.116.64.132","src_port":28681,"dst_port":51227,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":347,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.10.169.10","src_port":28681,"dst_port":12799,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":165,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131670,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.75.43.182","src_port":28681,"dst_port":43502,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":165,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131670,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.75.43.182","src_port":28681,"dst_port":43502,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":188,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":131669,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.134.107.32","src_port":28681,"dst_port":38836,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -2696,17 +2696,17 @@
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":177,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82061,"flow_last_seen":132833,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.157.183.106","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":182,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":131672,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.3.103.37","src_port":28681,"dst_port":35589,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":182,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":131672,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.3.103.37","src_port":28681,"dst_port":35589,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":96049,"flow_last_seen":129345,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.1.231.138","src_port":28681,"dst_port":56558,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":96049,"flow_last_seen":129345,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.1.231.138","src_port":28681,"dst_port":56558,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":351,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":131668,"flow_last_seen":131668,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"187.37.87.189","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":351,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":131668,"flow_last_seen":131668,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"187.37.87.189","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":163,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131673,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.126.160.158","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":163,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131673,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.126.160.158","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":341,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":124066,"flow_last_seen":124066,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.129.233.60","src_port":28681,"dst_port":19990,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":124066,"flow_last_seen":287321,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":836,"flow_avg_l4_payload_len":278,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49732,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":341,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":124066,"flow_last_seen":124066,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.129.233.60","src_port":28681,"dst_port":19990,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":124066,"flow_last_seen":287321,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":836,"flow_avg_l4_payload_len":278,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49732,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":352,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":131671,"flow_last_seen":251736,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.191.49.159","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":124090,"flow_last_seen":287421,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":269,"flow_avg_l4_payload_len":53,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"207.38.163.228","src_port":28681,"dst_port":6778,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":124090,"flow_last_seen":287890,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":269,"flow_avg_l4_payload_len":53,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.208.26.154","src_port":28681,"dst_port":4994,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":339,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":123912,"flow_last_seen":287321,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":109,"flow_avg_l4_payload_len":54,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":54130,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":124090,"flow_last_seen":287421,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":269,"flow_avg_l4_payload_len":53,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"207.38.163.228","src_port":28681,"dst_port":6778,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":124090,"flow_last_seen":287890,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":269,"flow_avg_l4_payload_len":53,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.208.26.154","src_port":28681,"dst_port":4994,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":339,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":123912,"flow_last_seen":287321,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":109,"flow_avg_l4_payload_len":54,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":54130,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5033,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":528,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4TFkAAIARXF4KAAIPdqgPR3AJ5EoAJEU1rxgxAkijNFD\/98wlZJR4AwABAAUAAADDglFLQA=="}
 00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5034,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":529,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4bmsAAIARqKcKAAIPdPGionAJ4kkAJCDgNOsxArkJ75n\/2X37nQtxAwABAAUAAADDglFLQA=="}
 00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5035,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":530,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4R1AAAIARd9IKAAIPdqf43HAJ56gAJBG+sRMxAjM8jgr\/OCOtVAIyAwABAAUAAADDglFLQA=="}
@@ -2741,59 +2741,59 @@
 00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":562,"flow_packet_id":2,"flow_last_seen":320292,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320292,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4CAEAAIARw78KAAIPcHfybnAJ6ecAJJt6ZMkxArsJiWn\/2NtEIIr3AwABAAUAAADDglFLQA=="}
 00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5065,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":664,"flow_packet_id":2,"flow_last_seen":320293,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320293,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4sK0AAIARXRsKAAIPMjruo3AJGcIAJO3IbAsxAnYtXYL\/8bz\/pBe7AwABAAUAAADDglFLQA=="}
 00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5066,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":696,"flow_packet_id":2,"flow_last_seen":320293,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320293,"pkt":"UlQAEjUCCAAn5uVZCABFAAA419wAAIARwSYKAAIPTL1I5nAJH+EAJBtk6eoxAtFG13r\/NLEu9DR8AwABAAUAAADDglFLQA=="}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":329,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":101122,"flow_last_seen":134428,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.117.249.98","src_port":28681,"dst_port":6815,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":328,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":101122,"flow_last_seen":134428,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.105.27","src_port":28681,"dst_port":19260,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95754,"flow_last_seen":139756,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.217.84.16","src_port":28681,"dst_port":20223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":358,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":139669,"flow_last_seen":139669,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.224.174.174","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":357,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.35.85.238","src_port":28681,"dst_port":32173,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":329,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":101122,"flow_last_seen":134428,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.117.249.98","src_port":28681,"dst_port":6815,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":328,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":101122,"flow_last_seen":134428,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.105.27","src_port":28681,"dst_port":19260,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95754,"flow_last_seen":139756,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.217.84.16","src_port":28681,"dst_port":20223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":358,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":139669,"flow_last_seen":139669,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.224.174.174","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":357,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.35.85.238","src_port":28681,"dst_port":32173,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":90,"flow_state":"info","flow_packets_processed":11,"flow_first_seen":71204,"flow_last_seen":193763,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.62.225.181","src_port":50245,"dst_port":46843,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00558{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":90,"flow_state":"info","flow_packets_processed":11,"flow_first_seen":71204,"flow_last_seen":193763,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.62.225.181","src_port":50245,"dst_port":46843,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95784,"flow_last_seen":139896,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.183.183.110","src_port":28681,"dst_port":59920,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":95715,"flow_last_seen":139730,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2424,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.188.98","src_port":28681,"dst_port":62851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95784,"flow_last_seen":139896,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.183.183.110","src_port":28681,"dst_port":59920,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":95715,"flow_last_seen":139730,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2424,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.188.98","src_port":28681,"dst_port":62851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00583{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":300,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":90809,"flow_last_seen":139723,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1817,"flow_avg_l4_payload_len":227,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00568{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":300,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":90809,"flow_last_seen":139723,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1817,"flow_avg_l4_payload_len":227,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95923,"flow_last_seen":139892,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.250.179.237","src_port":28681,"dst_port":20848,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":139506,"flow_last_seen":177166,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1954,"flow_avg_l4_payload_len":325,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"63.228.175.169","src_port":28681,"dst_port":1936,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":139506,"flow_last_seen":168554,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.118.53.212","src_port":28681,"dst_port":29998,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":89967,"flow_last_seen":152618,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":333448,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.203.218.92","src_port":28681,"dst_port":56962,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":89966,"flow_last_seen":152619,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":333448,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.218","src_port":28681,"dst_port":6909,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":95216,"flow_last_seen":162802,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.201.208.57","src_port":28681,"dst_port":38617,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":90072,"flow_last_seen":163183,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.26.216.95","src_port":28681,"dst_port":13889,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":359,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":160009,"flow_last_seen":163034,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":51685,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
-00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":90039,"flow_last_seen":163151,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":50297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":90004,"flow_last_seen":163118,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.140.120.41","src_port":28681,"dst_port":47739,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95923,"flow_last_seen":139892,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.250.179.237","src_port":28681,"dst_port":20848,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":139506,"flow_last_seen":177166,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1954,"flow_avg_l4_payload_len":325,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"63.228.175.169","src_port":28681,"dst_port":1936,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":139506,"flow_last_seen":168554,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":323187,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.118.53.212","src_port":28681,"dst_port":29998,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":89967,"flow_last_seen":152618,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":333448,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.203.218.92","src_port":28681,"dst_port":56962,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":89966,"flow_last_seen":152619,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":333448,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.218","src_port":28681,"dst_port":6909,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":95216,"flow_last_seen":162802,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.201.208.57","src_port":28681,"dst_port":38617,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":90072,"flow_last_seen":163183,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.26.216.95","src_port":28681,"dst_port":13889,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":359,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":160009,"flow_last_seen":163034,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":51685,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":90039,"flow_last_seen":163151,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":50297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":90004,"flow_last_seen":163118,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.140.120.41","src_port":28681,"dst_port":47739,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5372,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":383,"flow_packet_id":3,"flow_last_seen":350801,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":350801,"pkt":"UlQAEjUCCAAn5uVZCABFAABUUWcAAIARlZ8KAAIPVEfzPHAJhsIAQN+fXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRO45aqEDU0NQQAFaQIJQUkA="}
 00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5381,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":573,"flow_packet_id":2,"flow_last_seen":350982,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":350982,"pkt":"UlQAEjUCCAAn5uVZCABFAAA49UMAAIARRGEKAAIPR++tEnAJWx8AJJ\/UjSsxAo9FSZH\/5RaddLKjAwABAAUAAADDglFLQA=="}
 00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5386,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":573,"flow_packet_id":3,"flow_last_seen":351110,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":351110,"pkt":"CAAn5uVZUlQAEjUCCABFAABKDVAAAEARbENH760SCgACD1sfcAkANlLBjSsxAo9FSZH\/5RaddLKjAwEBABcAAAAfW0fvrRIAAAAACAAAAMOCUUtEmW5VTg=="}
-00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":139506,"flow_last_seen":168554,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.118.53.212","src_port":28681,"dst_port":29998,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":101122,"flow_last_seen":168840,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2737,"flow_avg_l4_payload_len":342,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.64.44.11","src_port":28681,"dst_port":1352,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":168555,"flow_last_seen":287464,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2374,"flow_avg_l4_payload_len":237,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":28681,"dst_port":9915,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":363,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":168840,"flow_last_seen":174342,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":83,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":38297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":168594,"flow_last_seen":176963,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1959,"flow_avg_l4_payload_len":326,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.192.210.182","src_port":28681,"dst_port":6754,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":360,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":168428,"flow_last_seen":174303,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":83,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"198.58.218.12","src_port":28681,"dst_port":47912,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":139506,"flow_last_seen":168554,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.118.53.212","src_port":28681,"dst_port":29998,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":101122,"flow_last_seen":168840,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2737,"flow_avg_l4_payload_len":342,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.64.44.11","src_port":28681,"dst_port":1352,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":168555,"flow_last_seen":287464,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2374,"flow_avg_l4_payload_len":237,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":28681,"dst_port":9915,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":363,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":168840,"flow_last_seen":174342,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":83,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":38297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":168594,"flow_last_seen":176963,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1959,"flow_avg_l4_payload_len":326,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.192.210.182","src_port":28681,"dst_port":6754,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":360,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":168428,"flow_last_seen":174303,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":83,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"198.58.218.12","src_port":28681,"dst_port":47912,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5426,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":754,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":355387,"flow_last_seen":355387,"flow_idle_time":200000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":355387,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.125.218.84","src_port":28681,"dst_port":17561,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00476{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5426,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":754,"flow_packet_id":1,"flow_last_seen":355387,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"thread_ts_msec":355387,"pkt":"UlQAEjUCCAAn5uVZCABFAABDeM0AAIARhvwKAAIPVH3aVHAJRJkAL52kWv4xAksIMkL\/WuRk66hXAwABABAAAADDA1NDUEECglZDRUdUS0di"}
-00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":89829,"flow_last_seen":174528,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3570,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.84.178.16","src_port":28681,"dst_port":60262,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00793{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":366,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.8.55.158","src_port":28681,"dst_port":51140,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":95264,"flow_last_seen":176255,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.220.186.140","src_port":28681,"dst_port":27641,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":365,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.23.24.213","src_port":28681,"dst_port":18561,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":95443,"flow_last_seen":176562,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.240.69.199","src_port":28681,"dst_port":6348,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":89829,"flow_last_seen":174528,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3570,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.84.178.16","src_port":28681,"dst_port":60262,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00793{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":366,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.8.55.158","src_port":28681,"dst_port":51140,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":95264,"flow_last_seen":176255,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.220.186.140","src_port":28681,"dst_port":27641,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":365,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.23.24.213","src_port":28681,"dst_port":18561,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":95443,"flow_last_seen":176562,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.240.69.199","src_port":28681,"dst_port":6348,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":242,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":88941,"flow_last_seen":179376,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":511,"flow_avg_l4_payload_len":63,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":28681,"dst_port":52367,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":242,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":88941,"flow_last_seen":179376,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":511,"flow_avg_l4_payload_len":63,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":28681,"dst_port":52367,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95264,"flow_last_seen":179735,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":40137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":368,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":174343,"flow_last_seen":174343,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":28681,"dst_port":36728,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":363,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":168840,"flow_last_seen":174342,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":83,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":38297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":168594,"flow_last_seen":176963,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1959,"flow_avg_l4_payload_len":326,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.192.210.182","src_port":28681,"dst_port":6754,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":139506,"flow_last_seen":177166,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1954,"flow_avg_l4_payload_len":325,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"63.228.175.169","src_port":28681,"dst_port":1936,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":95264,"flow_last_seen":179735,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":40137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":368,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":174343,"flow_last_seen":174343,"flow_idle_time":200000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":28681,"dst_port":36728,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":363,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":168840,"flow_last_seen":174342,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":83,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":38297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":168594,"flow_last_seen":176963,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1959,"flow_avg_l4_payload_len":326,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.192.210.182","src_port":28681,"dst_port":6754,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":139506,"flow_last_seen":177166,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1954,"flow_avg_l4_payload_len":325,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"63.228.175.169","src_port":28681,"dst_port":1936,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00581{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":301,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90845,"flow_last_seen":174321,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1001,"flow_avg_l4_payload_len":166,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":28681,"dst_port":11852,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00566{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":301,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90845,"flow_last_seen":174321,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1001,"flow_avg_l4_payload_len":166,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":28681,"dst_port":11852,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00583{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":243,"flow_state":"info","flow_packets_processed":19,"flow_first_seen":89016,"flow_last_seen":176659,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4777,"flow_avg_l4_payload_len":251,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00568{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":243,"flow_state":"info","flow_packets_processed":19,"flow_first_seen":89016,"flow_last_seen":176659,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4777,"flow_avg_l4_payload_len":251,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":360,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":168428,"flow_last_seen":174303,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":83,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"198.58.218.12","src_port":28681,"dst_port":47912,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":90138,"flow_last_seen":174723,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.217.176.52","src_port":28681,"dst_port":7446,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":90183,"flow_last_seen":174679,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":28681,"dst_port":11603,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00803{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":174303,"flow_last_seen":287509,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1210,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":28681,"dst_port":10825,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":174342,"flow_last_seen":287510,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":841,"flow_avg_l4_payload_len":280,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":28681,"dst_port":49956,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":360,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":168428,"flow_last_seen":174303,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":83,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"198.58.218.12","src_port":28681,"dst_port":47912,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":90138,"flow_last_seen":174723,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.217.176.52","src_port":28681,"dst_port":7446,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":90183,"flow_last_seen":174679,"flow_idle_time":200000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":28681,"dst_port":11603,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00803{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":174303,"flow_last_seen":287509,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1210,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":28681,"dst_port":10825,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":174342,"flow_last_seen":287510,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":841,"flow_avg_l4_payload_len":280,"midstream":0,"thread_ts_msec":363239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":28681,"dst_port":49956,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5591,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":185,"flow_packet_id":3,"flow_last_seen":371838,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":371838,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0taEAAIARR0oKAAIPbYTEOnAJGMoAINecR05EEEABAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5594,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":755,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":371838,"flow_last_seen":371838,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":371838,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.134.107.32","src_port":28681,"dst_port":38836,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5594,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":755,"flow_packet_id":1,"flow_last_seen":371838,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":371838,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05JUAAIARi24KAAIPU4ZrIHAJl7QAIMvHR05EEEAEAQFUC1FLUlAGUk5BXS\/iNQlw"}
@@ -2806,7 +2806,7 @@
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5636,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":751,"flow_packet_id":2,"flow_last_seen":373497,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":373497,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0mm0AAIARSEgKAAIPQ8EINHAJlrgAID9hR05EEEAYAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5639,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":752,"flow_packet_id":2,"flow_last_seen":373498,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":373498,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0D1EAAIARtk0KAAIPjnPamHAJFwwAIKHzR05EEEAbAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5640,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":485,"flow_packet_id":3,"flow_last_seen":373498,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":373498,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0fvoAAIAR6tsKAAIPmgMq0XAJGMoAIERsR05EEEAcAQFUC1FLUlAGUk5BXS\/iNQlw"}
-00781{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5643,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":16487,"flow_last_seen":192636,"flow_idle_time":200000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":603,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":373498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
+00781{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5643,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":16487,"flow_last_seen":192636,"flow_idle_time":200000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":603,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":373498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5643,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":136,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":72852,"flow_last_seen":192908,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":373498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.236.247.120","src_port":28681,"dst_port":16047,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5643,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":136,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":72852,"flow_last_seen":192908,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":373498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.236.247.120","src_port":28681,"dst_port":16047,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5643,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":173,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82060,"flow_last_seen":192907,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":373498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"121.99.222.36","src_port":28681,"dst_port":44988,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -2814,14 +2814,14 @@
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5717,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":400,"flow_packet_id":2,"flow_last_seen":381404,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":381404,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0860AAIARiigKAAIPgS0vp3AJGMoAIFhpR05EEEAfAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5882,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":757,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":399168,"flow_last_seen":399168,"flow_idle_time":200000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":399168,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00468{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5882,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":757,"flow_packet_id":1,"flow_last_seen":399168,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":399168,"pkt":"UlQAEjUCCAAn5uVZCABFAAA854sAAIAR\/DEKAAIPaJziSHAJ0AoAKHNuYiULNAANuxoAAAAAAAAAADEBAAkAAABHVEtHCQABAAA="}
-00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":5882,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":757,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":399168,"flow_last_seen":399168,"flow_idle_time":200000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":399168,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":5882,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":757,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":399168,"flow_last_seen":399168,"flow_idle_time":200000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":399168,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00479{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5889,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":757,"flow_packet_id":2,"flow_last_seen":399265,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"thread_ts_msec":399265,"pkt":"CAAn5uVZUlQAEjUCCABFAABEDoMAAEARFTNonOJICgACD9AKcAkAMN2JYiULNAANuxpiJQs1AA5dgzEBABEAAABHVEtHCgABAABiJQs1AA5ddw=="}
 00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5901,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":400018,"flow_last_seen":400018,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":400018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50213,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5901,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_packet_id":1,"flow_last_seen":400018,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":400018,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LcAAAER3GIKAAIP7\/\/\/+sQlB2wAtikJTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"}
-00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":5901,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":400018,"flow_last_seen":400018,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":400018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50213,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":5901,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":400018,"flow_last_seen":400018,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":400018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50213,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5915,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":759,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":400872,"flow_last_seen":400872,"flow_idle_time":200000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":400872,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00468{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5915,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":759,"flow_packet_id":1,"flow_last_seen":400872,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":400872,"pkt":"UlQAEjUCCAAn5uVZCABFAAA8Bs8AAIAREesKAAIPaO6s+nAJW\/wAKKTOYiULNgAJMscAAAAAAAAAADEBAAkAAABHVEtHCQABAAA="}
-00758{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":5915,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":759,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":400872,"flow_last_seen":400872,"flow_idle_time":200000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":400872,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00758{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":5915,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":759,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":400872,"flow_last_seen":400872,"flow_idle_time":200000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":400872,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00479{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5917,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":759,"flow_packet_id":2,"flow_last_seen":400901,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"thread_ts_msec":400901,"pkt":"CAAn5uVZUlQAEjUCCABFAABEDpQAAEARSh5o7qz6CgACD1v8cAkAMAJCYiULNgAJMsdiJQs2AAlj5TEBABEAAABHVEtHCgABAABiJQs2AAljxQ=="}
 00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5919,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_packet_id":2,"flow_last_seen":401028,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":401028,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LgAAAER3GEKAAIP7\/\/\/+sQlB2wAtikJTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"}
 00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5928,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_packet_id":3,"flow_last_seen":402032,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":402032,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LkAAAER3GAKAAIP7\/\/\/+sQlB2wAtikJTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"}
@@ -2835,7 +2835,7 @@
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6044,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":374,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229240,"flow_last_seen":229240,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":414496,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"62.35.190.5","src_port":28681,"dst_port":18604,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6044,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":372,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229239,"flow_last_seen":229239,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":414496,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.179.185.126","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6044,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":372,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229239,"flow_last_seen":229239,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":414496,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.179.185.126","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00627{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6044,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":746,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":288409,"flow_last_seen":288409,"flow_idle_time":140000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":414496,"l3_proto":"ip4","src_ip":"164.132.10.25","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}}
+00627{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6044,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":746,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":288409,"flow_last_seen":288409,"flow_idle_time":140000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":414496,"l3_proto":"ip4","src_ip":"164.132.10.25","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6044,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":373,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229239,"flow_last_seen":229239,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":414496,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.122.233.15","src_port":28681,"dst_port":11488,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6044,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":373,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229239,"flow_last_seen":229239,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":414496,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.122.233.15","src_port":28681,"dst_port":11488,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":398,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243620,"flow_last_seen":243620,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"62.102.148.166","src_port":28681,"dst_port":31332,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -2876,7 +2876,7 @@
 00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":379,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":288106,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.140.63.147","src_port":28681,"dst_port":29545,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6215,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":760,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":431178,"flow_last_seen":431178,"flow_idle_time":200000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":431178,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00704{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6215,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":760,"flow_packet_id":1,"flow_last_seen":431178,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":243,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":243,"pkt_l4_len":209,"thread_ts_msec":431178,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAADlHP4AAIARA\/0KAAIPCgAC\/wCKAIoA0frqEQKcMAoAAg8AigC7AAAgRU5GREVGRUVFSEVGRkhFSkVPREJEQUNBQ0FDQUNBQ0EAIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUJOAP9TTUIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQAAIQAAAAAAAAAAAOgDAAAAAAAAAAAhAFYAAwABAAAAAgAyAFxNQUlMU0xPVFxCUk9XU0UAAQAAUwcATVNFREdFV0lOMTAAAAAAAAoAAxAAAA8BVaoA"}
-00744{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6215,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":760,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":431178,"flow_last_seen":431178,"flow_idle_time":200000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":431178,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
+00744{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6215,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":760,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":431178,"flow_last_seen":431178,"flow_idle_time":200000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":431178,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
 00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6223,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":761,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":431829,"flow_last_seen":431829,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":431829,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.132.75.56","src_port":28681,"dst_port":56009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6223,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":761,"flow_packet_id":1,"flow_last_seen":431829,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":431829,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0QZQAAIAR3lkKAAIPw4RLOHAJ2skAIDh8R05EEEAkAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6230,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":751,"flow_packet_id":3,"flow_last_seen":431830,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":431830,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0mm4AAIARSEcKAAIPQ8EINHAJlrgAID9OR05EEEArAQFUC1FLUlAGUk5BXS\/iNQlw"}
@@ -3076,48 +3076,48 @@
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":166,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82059,"flow_last_seen":433137,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.59.253.186","src_port":28681,"dst_port":15555,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":183,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82062,"flow_last_seen":431831,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.172.15.182","src_port":28681,"dst_port":37829,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":184,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82062,"flow_last_seen":431829,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.239.62.213","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_state":"finished","flow_packets_processed":16,"flow_first_seen":90005,"flow_last_seen":287355,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4793,"flow_avg_l4_payload_len":299,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":28681,"dst_port":24562,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_state":"finished","flow_packets_processed":16,"flow_first_seen":90005,"flow_last_seen":287355,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4793,"flow_avg_l4_payload_len":299,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":28681,"dst_port":24562,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":195,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82063,"flow_last_seen":373495,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"177.231.151.16","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":219,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":83520,"flow_last_seen":431830,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.30.86.144","src_port":28681,"dst_port":53821,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90184,"flow_last_seen":288014,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3860,"flow_avg_l4_payload_len":275,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":1194,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90184,"flow_last_seen":288014,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3860,"flow_avg_l4_payload_len":275,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":1194,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":191,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82063,"flow_last_seen":371839,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.153.143.54","src_port":28681,"dst_port":65535,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":172,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82060,"flow_last_seen":373496,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.69.142.133","src_port":28681,"dst_port":15471,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90073,"flow_last_seen":287523,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3852,"flow_avg_l4_payload_len":275,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00803{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_state":"finished","flow_packets_processed":17,"flow_first_seen":90072,"flow_last_seen":320293,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5333,"flow_avg_l4_payload_len":313,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":28681,"dst_port":43508,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90073,"flow_last_seen":287523,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3852,"flow_avg_l4_payload_len":275,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00803{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_state":"finished","flow_packets_processed":17,"flow_first_seen":90072,"flow_last_seen":320293,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5333,"flow_avg_l4_payload_len":313,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":28681,"dst_port":43508,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":187,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82062,"flow_last_seen":433134,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.88.92.56","src_port":28681,"dst_port":21009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":190,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82063,"flow_last_seen":431830,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.195.227","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_state":"finished","flow_packets_processed":16,"flow_first_seen":89966,"flow_last_seen":287418,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4798,"flow_avg_l4_payload_len":299,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":26253,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_state":"finished","flow_packets_processed":16,"flow_first_seen":89966,"flow_last_seen":287418,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4798,"flow_avg_l4_payload_len":299,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":26253,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":180,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82061,"flow_last_seen":433137,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.131.24.72","src_port":28681,"dst_port":30711,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":90039,"flow_last_seen":287497,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":28681,"dst_port":36368,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":90039,"flow_last_seen":287497,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":28681,"dst_port":36368,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":156,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82057,"flow_last_seen":433136,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.244.228.86","src_port":28681,"dst_port":10131,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00561{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":176,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82061,"flow_last_seen":373494,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.99.164.4","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00800{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_state":"finished","flow_packets_processed":11,"flow_first_seen":89829,"flow_last_seen":287443,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3598,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":28681,"dst_port":35481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_state":"finished","flow_packets_processed":11,"flow_first_seen":89829,"flow_last_seen":287443,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3598,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":28681,"dst_port":35481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":157,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82058,"flow_last_seen":371836,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.227.162.150","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":209,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82066,"flow_last_seen":431830,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.179.98.234","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90138,"flow_last_seen":287634,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4009,"flow_avg_l4_payload_len":286,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":28681,"dst_port":21301,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90138,"flow_last_seen":287634,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4009,"flow_avg_l4_payload_len":286,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":28681,"dst_port":21301,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":159,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82058,"flow_last_seen":311750,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.163.231.160","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90864,"flow_last_seen":287337,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1242,"flow_avg_l4_payload_len":207,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":53489,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_state":"finished","flow_packets_processed":18,"flow_first_seen":90039,"flow_last_seen":287415,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5624,"flow_avg_l4_payload_len":312,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":30577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_state":"finished","flow_packets_processed":18,"flow_first_seen":90039,"flow_last_seen":287415,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5624,"flow_avg_l4_payload_len":312,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":30577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":167,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82059,"flow_last_seen":373496,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.29.107.176","src_port":28681,"dst_port":20363,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":171,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82060,"flow_last_seen":373497,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"196.217.132.111","src_port":28681,"dst_port":25394,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":160,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82058,"flow_last_seen":431829,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.150.49.35","src_port":28681,"dst_port":32448,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":89829,"flow_last_seen":287526,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":12012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":89829,"flow_last_seen":287526,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":12012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":185,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82062,"flow_last_seen":371838,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.196.58","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":161,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82058,"flow_last_seen":311749,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.120.26.86","src_port":28681,"dst_port":29946,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":175,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82060,"flow_last_seen":433136,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"115.69.62.99","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_state":"finished","flow_packets_processed":18,"flow_first_seen":90005,"flow_last_seen":287678,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5605,"flow_avg_l4_payload_len":311,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":28681,"dst_port":61616,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_state":"finished","flow_packets_processed":18,"flow_first_seen":90005,"flow_last_seen":287678,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5605,"flow_avg_l4_payload_len":311,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":28681,"dst_port":61616,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":200,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82064,"flow_last_seen":373495,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"138.199.16.123","src_port":28681,"dst_port":52993,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90138,"flow_last_seen":287483,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3990,"flow_avg_l4_payload_len":285,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":28681,"dst_port":46010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90138,"flow_last_seen":287483,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3990,"flow_avg_l4_payload_len":285,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":28681,"dst_port":46010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":158,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82058,"flow_last_seen":431830,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.166.226.70","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":493,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":280014,"flow_last_seen":283055,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57552,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
-00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_state":"finished","flow_packets_processed":11,"flow_first_seen":101162,"flow_last_seen":287624,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3598,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":26851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00800{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":101837,"flow_last_seen":289958,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":120,"flow_tot_l4_payload_len":482,"flow_avg_l4_payload_len":68,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":95893,"flow_last_seen":287340,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1914,"flow_avg_l4_payload_len":239,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":21995,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00800{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":95784,"flow_last_seen":287572,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2838,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.236.205.7","src_port":28681,"dst_port":34794,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":95716,"flow_last_seen":287440,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2001,"flow_avg_l4_payload_len":250,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00800{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":95893,"flow_last_seen":287579,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2031,"flow_avg_l4_payload_len":253,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":55302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":95784,"flow_last_seen":287857,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2839,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":63637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":95716,"flow_last_seen":426518,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":359,"flow_avg_l4_payload_len":51,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.167.201.53","src_port":28681,"dst_port":47282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":493,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":280014,"flow_last_seen":283055,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57552,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_state":"finished","flow_packets_processed":11,"flow_first_seen":101162,"flow_last_seen":287624,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3598,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":26851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":101837,"flow_last_seen":289958,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":120,"flow_tot_l4_payload_len":482,"flow_avg_l4_payload_len":68,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00802{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":95893,"flow_last_seen":287340,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1914,"flow_avg_l4_payload_len":239,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":21995,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":95784,"flow_last_seen":287572,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2838,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.236.205.7","src_port":28681,"dst_port":34794,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":95716,"flow_last_seen":287440,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2001,"flow_avg_l4_payload_len":250,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":95893,"flow_last_seen":287579,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2031,"flow_avg_l4_payload_len":253,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":55302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":95784,"flow_last_seen":287857,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2839,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":63637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":95716,"flow_last_seen":426518,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":359,"flow_avg_l4_payload_len":51,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.167.201.53","src_port":28681,"dst_port":47282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":577,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287425,"flow_last_seen":287425,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.148.100.237","src_port":28681,"dst_port":23459,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":577,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287425,"flow_last_seen":287425,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.148.100.237","src_port":28681,"dst_port":23459,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":586,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287428,"flow_last_seen":287428,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.124.66.33","src_port":28681,"dst_port":13060,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3142,8 +3142,8 @@
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":701,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287650,"flow_last_seen":287650,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.206.27.26","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":511,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.47.223.27","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":511,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.47.223.27","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_state":"finished","flow_packets_processed":11,"flow_first_seen":101162,"flow_last_seen":287624,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3598,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":26851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":168555,"flow_last_seen":287464,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2374,"flow_avg_l4_payload_len":237,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":28681,"dst_port":9915,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_state":"finished","flow_packets_processed":11,"flow_first_seen":101162,"flow_last_seen":287624,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3598,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":26851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":168555,"flow_last_seen":287464,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2374,"flow_avg_l4_payload_len":237,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":28681,"dst_port":9915,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00581{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":450,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251765,"flow_last_seen":287535,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.206.254","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00566{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":450,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251765,"flow_last_seen":287535,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.206.254","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":496,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287309,"flow_last_seen":287309,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.173.230.98","src_port":28681,"dst_port":19004,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3160,7 +3160,7 @@
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":603,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.36.249.91","src_port":28681,"dst_port":64577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":394,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243619,"flow_last_seen":287621,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.84.134.136","src_port":28681,"dst_port":21407,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":394,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243619,"flow_last_seen":287621,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.84.134.136","src_port":28681,"dst_port":21407,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_state":"finished","flow_packets_processed":16,"flow_first_seen":90005,"flow_last_seen":287355,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4793,"flow_avg_l4_payload_len":299,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":28681,"dst_port":24562,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_state":"finished","flow_packets_processed":16,"flow_first_seen":90005,"flow_last_seen":287355,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4793,"flow_avg_l4_payload_len":299,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":28681,"dst_port":24562,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":741,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.25.47","src_port":28681,"dst_port":21293,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":741,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.25.47","src_port":28681,"dst_port":21293,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":647,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287511,"flow_last_seen":287511,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.10.152","src_port":28681,"dst_port":21293,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3175,7 +3175,7 @@
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":597,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287441,"flow_last_seen":287441,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":28681,"dst_port":52274,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":676,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287600,"flow_last_seen":287600,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.118.77","src_port":28681,"dst_port":62191,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":676,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287600,"flow_last_seen":287600,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.118.77","src_port":28681,"dst_port":62191,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":124066,"flow_last_seen":287321,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":836,"flow_avg_l4_payload_len":278,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49732,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":124066,"flow_last_seen":287321,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":836,"flow_avg_l4_payload_len":278,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49732,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":739,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3256,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":739,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3256,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":629,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287496,"flow_last_seen":287579,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.65.87.24","src_port":28681,"dst_port":16201,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3216,7 +3216,7 @@
 00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":335,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":115369,"flow_last_seen":287650,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":407,"flow_avg_l4_payload_len":50,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":28681,"dst_port":37058,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":636,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.48.23","src_port":28681,"dst_port":2556,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":636,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.48.23","src_port":28681,"dst_port":2556,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00798{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":101837,"flow_last_seen":289958,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":120,"flow_tot_l4_payload_len":482,"flow_avg_l4_payload_len":68,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":101837,"flow_last_seen":289958,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":120,"flow_tot_l4_payload_len":482,"flow_avg_l4_payload_len":68,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":637,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.193.171.146","src_port":28681,"dst_port":53143,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":637,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.193.171.146","src_port":28681,"dst_port":53143,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":638,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.194.73","src_port":28681,"dst_port":1995,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3249,7 +3249,7 @@
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":684,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287621,"flow_last_seen":287621,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":54459,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":386,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243618,"flow_last_seen":287682,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.172.10.90","src_port":28681,"dst_port":40162,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":386,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243618,"flow_last_seen":287682,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.172.10.90","src_port":28681,"dst_port":40162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":124090,"flow_last_seen":287421,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":269,"flow_avg_l4_payload_len":53,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"207.38.163.228","src_port":28681,"dst_port":6778,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":124090,"flow_last_seen":287421,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":269,"flow_avg_l4_payload_len":53,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"207.38.163.228","src_port":28681,"dst_port":6778,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":506,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287312,"flow_last_seen":287312,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"136.32.84.139","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":506,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287312,"flow_last_seen":287312,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"136.32.84.139","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":620,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287485,"flow_last_seen":287485,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.163.14.246","src_port":28681,"dst_port":1630,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3258,7 +3258,7 @@
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":606,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287443,"flow_last_seen":287443,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":56070,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":692,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287624,"flow_last_seen":287624,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.93.150.146","src_port":28681,"dst_port":62507,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":692,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287624,"flow_last_seen":287624,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.93.150.146","src_port":28681,"dst_port":62507,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90184,"flow_last_seen":288014,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3860,"flow_avg_l4_payload_len":275,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":1194,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90184,"flow_last_seen":288014,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3860,"flow_avg_l4_payload_len":275,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":1194,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":621,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287485,"flow_last_seen":287485,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":53516,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":621,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287485,"flow_last_seen":287485,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":53516,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":668,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287588,"flow_last_seen":287588,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.18.211.177","src_port":28681,"dst_port":18085,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3287,7 +3287,7 @@
 00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":550,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287342,"flow_last_seen":288307,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.238.145.82","src_port":28681,"dst_port":33527,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":689,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.36.234.196","src_port":28681,"dst_port":11629,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":689,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.36.234.196","src_port":28681,"dst_port":11629,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90073,"flow_last_seen":287523,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3852,"flow_avg_l4_payload_len":275,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90073,"flow_last_seen":287523,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3852,"flow_avg_l4_payload_len":275,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":671,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287599,"flow_last_seen":287599,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":28681,"dst_port":52669,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":671,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287599,"flow_last_seen":287599,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":28681,"dst_port":52669,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":598,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.172.184.48","src_port":28681,"dst_port":1512,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3296,7 +3296,7 @@
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":686,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287622,"flow_last_seen":287622,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.241.31.96","src_port":28681,"dst_port":8349,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":722,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287683,"flow_last_seen":287869,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.203.72.224","src_port":28681,"dst_port":9897,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":722,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287683,"flow_last_seen":287869,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.203.72.224","src_port":28681,"dst_port":9897,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00798{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_state":"finished","flow_packets_processed":11,"flow_first_seen":116628,"flow_last_seen":287381,"flow_idle_time":200000,"flow_min_l4_payload_len":56,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3123,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":6888,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_state":"finished","flow_packets_processed":11,"flow_first_seen":116628,"flow_last_seen":287381,"flow_idle_time":200000,"flow_min_l4_payload_len":56,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3123,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":6888,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":632,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.231.59.187","src_port":28681,"dst_port":62234,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":632,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.231.59.187","src_port":28681,"dst_port":62234,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":591,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":53707,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3335,7 +3335,7 @@
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":451,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251765,"flow_last_seen":287317,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.35.66.21","src_port":28681,"dst_port":22234,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":600,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.64.156.63","src_port":28681,"dst_port":60092,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":600,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.64.156.63","src_port":28681,"dst_port":60092,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_state":"finished","flow_packets_processed":16,"flow_first_seen":89966,"flow_last_seen":287418,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4798,"flow_avg_l4_payload_len":299,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":26253,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_state":"finished","flow_packets_processed":16,"flow_first_seen":89966,"flow_last_seen":287418,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4798,"flow_avg_l4_payload_len":299,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":26253,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":646,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287511,"flow_last_seen":287511,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":28681,"dst_port":49803,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":646,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287511,"flow_last_seen":287511,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":28681,"dst_port":49803,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":662,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287526,"flow_last_seen":287526,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.127.1.235","src_port":28681,"dst_port":37814,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3370,7 +3370,7 @@
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":453,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.127.26.138","src_port":28681,"dst_port":3083,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":498,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287310,"flow_last_seen":287310,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"8.44.149.207","src_port":28681,"dst_port":30551,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":498,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287310,"flow_last_seen":287310,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"8.44.149.207","src_port":28681,"dst_port":30551,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":90039,"flow_last_seen":287497,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":28681,"dst_port":36368,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":90039,"flow_last_seen":287497,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":28681,"dst_port":36368,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":705,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287652,"flow_last_seen":287652,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.192.83.59","src_port":28681,"dst_port":33513,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":705,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287652,"flow_last_seen":287652,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.192.83.59","src_port":28681,"dst_port":33513,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":642,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287499,"flow_last_seen":287499,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.199.103","src_port":28681,"dst_port":2625,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3399,7 +3399,7 @@
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":695,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287625,"flow_last_seen":287625,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":6514,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":469,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251799,"flow_last_seen":287319,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":47184,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":469,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251799,"flow_last_seen":287319,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":47184,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":95893,"flow_last_seen":287340,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1914,"flow_avg_l4_payload_len":239,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":21995,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":95893,"flow_last_seen":287340,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1914,"flow_avg_l4_payload_len":239,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":21995,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":666,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287588,"flow_last_seen":287588,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.36.106.134","src_port":28681,"dst_port":3927,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":666,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287588,"flow_last_seen":287588,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.36.106.134","src_port":28681,"dst_port":3927,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":661,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287526,"flow_last_seen":287526,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":6527,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3410,7 +3410,7 @@
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":717,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287682,"flow_last_seen":287682,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.249.190.8","src_port":28681,"dst_port":25198,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":732,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287699,"flow_last_seen":287699,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.163","src_port":28681,"dst_port":6564,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":732,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287699,"flow_last_seen":287699,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.163","src_port":28681,"dst_port":6564,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":124090,"flow_last_seen":287890,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":269,"flow_avg_l4_payload_len":53,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.208.26.154","src_port":28681,"dst_port":4994,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":124090,"flow_last_seen":287890,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":269,"flow_avg_l4_payload_len":53,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.208.26.154","src_port":28681,"dst_port":4994,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":388,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243618,"flow_last_seen":287524,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"121.7.145.36","src_port":28681,"dst_port":33905,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":388,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243618,"flow_last_seen":287524,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"121.7.145.36","src_port":28681,"dst_port":33905,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":736,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":52420,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3419,7 +3419,7 @@
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":748,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":289962,"flow_last_seen":289962,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.163","src_port":28681,"dst_port":6599,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":635,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.179.18.242","src_port":28681,"dst_port":47329,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":635,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.179.18.242","src_port":28681,"dst_port":47329,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00798{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_state":"finished","flow_packets_processed":11,"flow_first_seen":89829,"flow_last_seen":287443,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3598,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":28681,"dst_port":35481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_state":"finished","flow_packets_processed":11,"flow_first_seen":89829,"flow_last_seen":287443,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3598,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":28681,"dst_port":35481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":527,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287321,"flow_last_seen":287321,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.72.149.140","src_port":28681,"dst_port":37848,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":527,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287321,"flow_last_seen":287321,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.72.149.140","src_port":28681,"dst_port":37848,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":644,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287510,"flow_last_seen":287583,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"31.20.248.147","src_port":28681,"dst_port":30706,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3440,7 +3440,7 @@
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":634,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.174.18.115","src_port":28681,"dst_port":50679,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":608,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287444,"flow_last_seen":287781,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.241.31.96","src_port":28681,"dst_port":4814,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":608,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287444,"flow_last_seen":287781,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.241.31.96","src_port":28681,"dst_port":4814,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00798{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":95784,"flow_last_seen":287572,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2838,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.236.205.7","src_port":28681,"dst_port":34794,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":95784,"flow_last_seen":287572,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2838,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.236.205.7","src_port":28681,"dst_port":34794,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":706,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287652,"flow_last_seen":287652,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":28681,"dst_port":8658,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":706,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287652,"flow_last_seen":287652,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":28681,"dst_port":8658,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":699,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287649,"flow_last_seen":287958,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"70.81.219.111","src_port":28681,"dst_port":19210,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3457,14 +3457,14 @@
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":612,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287466,"flow_last_seen":287466,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":59384,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":725,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287697,"flow_last_seen":287697,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.65.217.224","src_port":28681,"dst_port":9070,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":725,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287697,"flow_last_seen":287697,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.65.217.224","src_port":28681,"dst_port":9070,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90138,"flow_last_seen":287634,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4009,"flow_avg_l4_payload_len":286,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":28681,"dst_port":21301,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90138,"flow_last_seen":287634,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4009,"flow_avg_l4_payload_len":286,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":28681,"dst_port":21301,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":667,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287588,"flow_last_seen":287588,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"159.196.95.223","src_port":28681,"dst_port":2003,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":667,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287588,"flow_last_seen":287588,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"159.196.95.223","src_port":28681,"dst_port":2003,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":645,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287510,"flow_last_seen":287510,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.22.22.94","src_port":28681,"dst_port":34245,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":645,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287510,"flow_last_seen":287510,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.22.22.94","src_port":28681,"dst_port":34245,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":649,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287511,"flow_last_seen":287824,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.218.135.222","src_port":28681,"dst_port":4548,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":649,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287511,"flow_last_seen":287824,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.218.135.222","src_port":28681,"dst_port":4548,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":95716,"flow_last_seen":287440,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2001,"flow_avg_l4_payload_len":250,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":95716,"flow_last_seen":287440,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2001,"flow_avg_l4_payload_len":250,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":579,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287426,"flow_last_seen":287647,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.170.108","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":579,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287426,"flow_last_seen":287647,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.170.108","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":678,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287619,"flow_last_seen":287619,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.83.5","src_port":28681,"dst_port":9128,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3475,12 +3475,12 @@
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":655,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287524,"flow_last_seen":287524,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.118.116.198","src_port":28681,"dst_port":44616,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":726,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.91.30.216","src_port":28681,"dst_port":61635,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":726,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.91.30.216","src_port":28681,"dst_port":61635,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00798{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":95893,"flow_last_seen":287579,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2031,"flow_avg_l4_payload_len":253,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":55302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":95893,"flow_last_seen":287579,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2031,"flow_avg_l4_payload_len":253,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":55302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90864,"flow_last_seen":287337,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1242,"flow_avg_l4_payload_len":207,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":53489,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90864,"flow_last_seen":287337,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1242,"flow_avg_l4_payload_len":207,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":53489,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":669,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287589,"flow_last_seen":287589,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":64731,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":669,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287589,"flow_last_seen":287589,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":64731,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_state":"finished","flow_packets_processed":18,"flow_first_seen":90039,"flow_last_seen":287415,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5624,"flow_avg_l4_payload_len":312,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":30577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_state":"finished","flow_packets_processed":18,"flow_first_seen":90039,"flow_last_seen":287415,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5624,"flow_avg_l4_payload_len":312,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":30577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":742,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":4364,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":742,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":4364,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":697,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287648,"flow_last_seen":287648,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":55050,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3507,7 +3507,7 @@
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":525,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.250.32","src_port":28681,"dst_port":52660,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":611,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287466,"flow_last_seen":287466,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.10.174.159","src_port":28681,"dst_port":4841,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":611,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287466,"flow_last_seen":287466,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.10.174.159","src_port":28681,"dst_port":4841,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":89829,"flow_last_seen":287526,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":12012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":89829,"flow_last_seen":287526,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":12012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":512,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"209.204.207.5","src_port":28681,"dst_port":49256,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":512,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"209.204.207.5","src_port":28681,"dst_port":49256,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":735,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287858,"flow_last_seen":287858,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.91.201","src_port":28681,"dst_port":4297,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3554,7 +3554,7 @@
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":713,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287681,"flow_last_seen":287681,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":59978,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":658,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287525,"flow_last_seen":287525,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":28681,"dst_port":53195,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":658,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287525,"flow_last_seen":287525,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":28681,"dst_port":53195,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00801{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":174303,"flow_last_seen":287509,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1210,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":28681,"dst_port":10825,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":174303,"flow_last_seen":287509,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1210,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":28681,"dst_port":10825,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":576,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287424,"flow_last_seen":287424,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":42925,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":576,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287424,"flow_last_seen":287424,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":42925,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":570,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287387,"flow_last_seen":287752,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":28681,"dst_port":8890,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3575,7 +3575,7 @@
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":519,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287316,"flow_last_seen":287316,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.48.23","src_port":28681,"dst_port":8070,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":601,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.200.161","src_port":28681,"dst_port":65274,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":601,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.200.161","src_port":28681,"dst_port":65274,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_state":"finished","flow_packets_processed":18,"flow_first_seen":90005,"flow_last_seen":287678,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5605,"flow_avg_l4_payload_len":311,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":28681,"dst_port":61616,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_state":"finished","flow_packets_processed":18,"flow_first_seen":90005,"flow_last_seen":287678,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5605,"flow_avg_l4_payload_len":311,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":28681,"dst_port":61616,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":639,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287498,"flow_last_seen":287719,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.242.225","src_port":28681,"dst_port":15068,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":639,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287498,"flow_last_seen":287719,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.242.225","src_port":28681,"dst_port":15068,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":463,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251768,"flow_last_seen":287699,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.7.155.210","src_port":28681,"dst_port":28365,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3598,7 +3598,7 @@
 00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":626,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287487,"flow_last_seen":287487,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.206.254","src_port":28681,"dst_port":49737,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":580,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287426,"flow_last_seen":287426,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.119.55.28","src_port":28681,"dst_port":20347,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":580,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287426,"flow_last_seen":287426,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.119.55.28","src_port":28681,"dst_port":20347,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":339,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":123912,"flow_last_seen":287321,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":109,"flow_avg_l4_payload_len":54,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":54130,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":339,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":123912,"flow_last_seen":287321,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":109,"flow_avg_l4_payload_len":54,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":54130,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":625,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287486,"flow_last_seen":287486,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":28681,"dst_port":57492,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":625,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287486,"flow_last_seen":287486,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":28681,"dst_port":57492,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":567,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287385,"flow_last_seen":287385,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.176.62.40","src_port":28681,"dst_port":52889,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3607,7 +3607,7 @@
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":685,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287621,"flow_last_seen":287621,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":54436,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":744,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287977,"flow_last_seen":288382,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"27.94.154.53","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":744,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287977,"flow_last_seen":288382,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"27.94.154.53","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":95784,"flow_last_seen":287857,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2839,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":63637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":95784,"flow_last_seen":287857,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2839,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":63637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":731,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287699,"flow_last_seen":287699,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.217.188.105","src_port":28681,"dst_port":62849,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":731,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287699,"flow_last_seen":287699,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.217.188.105","src_port":28681,"dst_port":62849,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":711,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287654,"flow_last_seen":287654,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.254.140.225","src_port":28681,"dst_port":63637,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3618,7 +3618,7 @@
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":688,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":53454,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":445,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251764,"flow_last_seen":287316,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.165.153.100","src_port":28681,"dst_port":4509,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":445,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251764,"flow_last_seen":287316,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.165.153.100","src_port":28681,"dst_port":4509,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90138,"flow_last_seen":287483,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3990,"flow_avg_l4_payload_len":285,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":28681,"dst_port":46010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":90138,"flow_last_seen":287483,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3990,"flow_avg_l4_payload_len":285,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":28681,"dst_port":46010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":510,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"79.94.85.113","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":510,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":200000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"79.94.85.113","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":653,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287523,"flow_last_seen":287523,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.139.21.182","src_port":28681,"dst_port":50110,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3669,7 +3669,7 @@
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":588,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.175.103","src_port":28681,"dst_port":4315,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":379,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":288106,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.140.63.147","src_port":28681,"dst_port":29545,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":379,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":288106,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.140.63.147","src_port":28681,"dst_port":29545,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":174342,"flow_last_seen":287510,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":841,"flow_avg_l4_payload_len":280,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":28681,"dst_port":49956,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":174342,"flow_last_seen":287510,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":841,"flow_avg_l4_payload_len":280,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":28681,"dst_port":49956,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":720,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287683,"flow_last_seen":287944,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.11.85","src_port":28681,"dst_port":10722,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":720,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287683,"flow_last_seen":287944,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.11.85","src_port":28681,"dst_port":10722,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":442,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251763,"flow_last_seen":287316,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.204.130.55","src_port":28681,"dst_port":29545,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3762,7 +3762,7 @@
 00485{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6791,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":781,"flow_packet_id":2,"flow_last_seen":490873,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":490873,"pkt":"CAAn5uVZUlQAEjUCCABFAABJEL8AAEARuWtwaTQCCgACD1uicAkANU8DODExAiD\/PoD\/dZiXmj2bAwEBABYAAACiW3BpNAIfAAAAAACAAMOCVVBDAQEB"}
 00530{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":783,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490916,"flow_last_seen":490916,"flow_idle_time":140000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":490916,"l3_proto":"ip4","src_ip":"65.182.231.232","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3}
 00501{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":783,"flow_packet_id":1,"flow_last_seen":490916,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":490916,"pkt":"CAAn5uVZUlQAEjUCCABFwABUEMAAAH8B9HtBtufoCgACDwMDMuAAAAAARQAAOFJyAAB\/EbOVCgACD0G25+hwCR7SACTlBTqzMQL2cg0m\/8bpadQ5WwMAAQAFAAAAw4JRS0A="}
-00608{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":783,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490916,"flow_last_seen":490916,"flow_idle_time":140000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":490916,"l3_proto":"ip4","src_ip":"65.182.231.232","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":4.984965}
+00608{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":783,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490916,"flow_last_seen":490916,"flow_idle_time":140000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":490916,"l3_proto":"ip4","src_ip":"65.182.231.232","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"6":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":4.984965}
 00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6793,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":775,"flow_packet_id":2,"flow_last_seen":490939,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":490939,"pkt":"CAAn5uVZUlQAEjUCCABFAABJEMEAAEAR+rDfEYQSCgACD1uicAkANcVlg9sxAjy4c4P\/utzozFbSAwEBABYAAACiW98RhBJuAAAA+KYpBMOCVVBDACAf"}
 00490{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6794,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":768,"flow_packet_id":2,"flow_last_seen":490991,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":490991,"pkt":"CAAn5uVZUlQAEjUCCABFAABKEMIAAEARTyUOyP\/lCgACD5DCcAkANpg9XGQxAgSi0ID\/hbiT8iWZAwEBABcAAADCkA7I\/+WyNgAAAAAgAMOCUUtEGERIlw=="}
 00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6810,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":784,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":491496,"flow_last_seen":491496,"flow_idle_time":200000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":491496,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"23.19.141.110","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
@@ -3825,7 +3825,7 @@
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":551,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287355,"flow_last_seen":320291,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.24.129.230","src_port":28681,"dst_port":14766,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":555,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320291,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":28681,"dst_port":20387,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":555,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320291,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":28681,"dst_port":20387,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00801{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_state":"finished","flow_packets_processed":17,"flow_first_seen":90072,"flow_last_seen":320293,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5333,"flow_avg_l4_payload_len":313,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":28681,"dst_port":43508,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_state":"finished","flow_packets_processed":17,"flow_first_seen":90072,"flow_last_seen":320293,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5333,"flow_avg_l4_payload_len":313,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":28681,"dst_port":43508,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":538,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.41.253","src_port":28681,"dst_port":14339,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":538,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.41.253","src_port":28681,"dst_port":14339,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":536,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.167.222.160","src_port":28681,"dst_port":56121,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3876,7 +3876,7 @@
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":540,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":28681,"dst_port":52131,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7120,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":794,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":520019,"flow_last_seen":520019,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":520019,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50214,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7120,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":794,"flow_packet_id":1,"flow_last_seen":520019,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":520019,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LsAAAER3F4KAAIP7\/\/\/+sQmB2wAtikITS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"}
-00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7120,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":794,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":520019,"flow_last_seen":520019,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":520019,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50214,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7120,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":794,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":520019,"flow_last_seen":520019,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":520019,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50214,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7131,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":794,"flow_packet_id":2,"flow_last_seen":521048,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":521048,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LwAAAER3F0KAAIP7\/\/\/+sQmB2wAtikITS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"}
 00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7141,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":794,"flow_packet_id":3,"flow_last_seen":522076,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":522076,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4L0AAAER3FwKAAIP7\/\/\/+sQmB2wAtikITS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7268,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":754,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":355387,"flow_last_seen":355387,"flow_idle_time":200000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":536329,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.125.218.84","src_port":28681,"dst_port":17561,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3904,7 +3904,7 @@
 00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7398,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":796,"flow_packet_id":1,"flow_last_seen":551892,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":551892,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0J3oAAIARnW8KAAIPKfk\/yHAJWDYAIF+oR05EEECHAQFUC1FLUlAGUk5BXS\/iNQlw"}
 00528{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7403,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":797,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":552011,"flow_last_seen":552011,"flow_idle_time":140000,"flow_min_l4_payload_len":60,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":60,"flow_avg_l4_payload_len":60,"midstream":0,"thread_ts_msec":552011,"l3_proto":"ip4","src_ip":"154.3.42.209","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3}
 00497{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7403,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":797,"flow_packet_id":1,"flow_last_seen":552011,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":94,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":94,"pkt_l4_len":60,"thread_ts_msec":552011,"pkt":"CAAn5uVZUlQAEjUCCABFwABQEicAAH8BV+OaAyrRCgACDwMDzhEAAAAARQAANH78AAB\/EevZCgACD5oDKtFwCRjKACBD\/UdORBBAiwEBVAtRS1JQBlJOQV0v4jUJcA=="}
-00606{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7403,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":797,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":552011,"flow_last_seen":552011,"flow_idle_time":140000,"flow_min_l4_payload_len":60,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":60,"flow_avg_l4_payload_len":60,"midstream":0,"thread_ts_msec":552011,"l3_proto":"ip4","src_ip":"154.3.42.209","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":5.209868}
+00606{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7403,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":797,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":552011,"flow_last_seen":552011,"flow_idle_time":140000,"flow_min_l4_payload_len":60,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":60,"flow_avg_l4_payload_len":60,"midstream":0,"thread_ts_msec":552011,"l3_proto":"ip4","src_ip":"154.3.42.209","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"6":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":5.209868}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":195,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82063,"flow_last_seen":373495,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":554967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"177.231.151.16","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":195,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82063,"flow_last_seen":373495,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":554967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"177.231.151.16","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":191,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82063,"flow_last_seen":371839,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":554967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.153.143.54","src_port":28681,"dst_port":65535,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3915,24 +3915,24 @@
 00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":7421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":756,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":373494,"flow_last_seen":551890,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":554967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.100.68.255","src_port":28681,"dst_port":12838,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7429,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":400,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251734,"flow_last_seen":381404,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":568531,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"129.45.47.167","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7429,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":400,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251734,"flow_last_seen":381404,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":568531,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"129.45.47.167","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7439,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":759,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":400872,"flow_last_seen":400901,"flow_idle_time":200000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":581778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7439,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":757,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":399168,"flow_last_seen":399265,"flow_idle_time":200000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":581778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00666{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":7439,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":400018,"flow_last_seen":403044,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":581778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50213,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
-00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7447,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":400018,"flow_last_seen":403044,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":591044,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50213,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7439,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":759,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":400872,"flow_last_seen":400901,"flow_idle_time":200000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":581778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7439,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":757,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":399168,"flow_last_seen":399265,"flow_idle_time":200000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":581778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00666{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":7439,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":400018,"flow_last_seen":403044,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":581778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50213,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7447,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":400018,"flow_last_seen":403044,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":591044,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50213,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7482,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":798,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":595449,"flow_last_seen":595449,"flow_idle_time":200000,"flow_min_l4_payload_len":137,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":137,"flow_avg_l4_payload_len":137,"midstream":0,"thread_ts_msec":595449,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00615{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7482,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":798,"flow_packet_id":1,"flow_last_seen":595449,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":179,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":179,"pkt_l4_len":145,"thread_ts_msec":595449,"pkt":"AQBef\/\/6CAAn5uVZCABFAACl4L8AAAQR2X8KAAIP7\/\/\/+vnaB2wAkQ9eTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClNUOiB1cm46c2NoZW1hcy11cG5wLW9yZzpkZXZpY2U6SW50ZXJuZXRHYXRld2F5RGV2aWNlOjENCk1hbjogInNzZHA6ZGlzY292ZXIiDQpNWDogMw0KDQo="}
-00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7482,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":798,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":595449,"flow_last_seen":595449,"flow_idle_time":200000,"flow_min_l4_payload_len":137,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":137,"flow_avg_l4_payload_len":137,"midstream":0,"thread_ts_msec":595449,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7482,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":798,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":595449,"flow_last_seen":595449,"flow_idle_time":200000,"flow_min_l4_payload_len":137,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":137,"flow_avg_l4_payload_len":137,"midstream":0,"thread_ts_msec":595449,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00615{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7483,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":798,"flow_packet_id":2,"flow_last_seen":598465,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":179,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":179,"pkt_l4_len":145,"thread_ts_msec":598465,"pkt":"AQBef\/\/6CAAn5uVZCABFAACl4MAAAAQR2X4KAAIP7\/\/\/+vnaB2wAkQ9eTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClNUOiB1cm46c2NoZW1hcy11cG5wLW9yZzpkZXZpY2U6SW50ZXJuZXRHYXRld2F5RGV2aWNlOjENCk1hbjogInNzZHA6ZGlzY292ZXIiDQpNWDogMw0KDQo="}
 00705{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7484,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":760,"flow_packet_id":2,"flow_last_seen":599325,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":243,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":243,"pkt_l4_len":209,"thread_ts_msec":599325,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAADlHP8AAIARA\/wKAAIPCgAC\/wCKAIoA0XlAEQKcMQoAAg8AigC7AAAgRU5GREVGRUVFSEVGRkhFSkVPREJEQUNBQ0FDQUNBQ0EAIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUJOAP9TTUIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQAAIQAAAAAAAAAAAOgDAAAAAAAAAAAhAFYAAwABAAAAAgAyAFxNQUlMU0xPVFxCUk9XU0UAAQCA\/AoATVNFREdFV0lOMTAAAAAAAAoAARAAAA8BVaoA"}
 00575{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7485,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":799,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599415,"flow_last_seen":599415,"flow_idle_time":200000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":772,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599415,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 01485{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7485,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":799,"flow_packet_id":1,"flow_last_seen":599415,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":834,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":834,"pkt_l4_len":780,"thread_ts_msec":599415,"pkt":"MzMAAAAMCAAn5uVZht1gB0PFAwwRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dYOdgMMdjk8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvQnllPC93c2E6QWN0aW9uPjx3c2E6TWVzc2FnZUlEPnVybjp1dWlkOjk4Zjc0ZjcxLTZkZmMtNDYxMi05YzNjLTVjNTgwZWI4MzU5Njwvd3NhOk1lc3NhZ2VJRD48d3NkOkFwcFNlcXVlbmNlIEluc3RhbmNlSWQ9IjQ2IiBTZXF1ZW5jZUlkPSJ1cm46dXVpZDo3NjczODllMC1lZTlhLTRjMWMtYjkwMi0yMGNiODFkMjAzZTAiIE1lc3NhZ2VOdW1iZXI9IjUiPjwvd3NkOkFwcFNlcXVlbmNlPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOkJ5ZT48d3NhOkVuZHBvaW50UmVmZXJlbmNlPjx3c2E6QWRkcmVzcz51cm46dXVpZDo3NDdmM2Q5Ni02OGE3LTQzZjEtOGNiZS1lOGQ2ZGFkZDAzNTg8L3dzYTpBZGRyZXNzPjwvd3NhOkVuZHBvaW50UmVmZXJlbmNlPjwvd3NkOkJ5ZT48L3NvYXA6Qm9keT48L3NvYXA6RW52ZWxvcGU+"}
-00633{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7485,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":799,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599415,"flow_last_seen":599415,"flow_idle_time":200000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":772,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599415,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
+00633{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7485,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":799,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599415,"flow_last_seen":599415,"flow_idle_time":200000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":772,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599415,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
 00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7486,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":800,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599415,"flow_last_seen":599415,"flow_idle_time":200000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":772,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599415,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 01463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7486,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":800,"flow_packet_id":1,"flow_last_seen":599415,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":814,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":814,"pkt_l4_len":780,"thread_ts_msec":599415,"pkt":"AQBef\/\/6CAAn5uVZCABFAAMg4MEAAAER2gIKAAIP7\/\/\/+vnVDnYDDAYbPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5Ij48c29hcDpIZWFkZXI+PHdzYTpUbz51cm46c2NoZW1hcy14bWxzb2FwLW9yZzp3czoyMDA1OjA0OmRpc2NvdmVyeTwvd3NhOlRvPjx3c2E6QWN0aW9uPmh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5L0J5ZTwvd3NhOkFjdGlvbj48d3NhOk1lc3NhZ2VJRD51cm46dXVpZDo5OGY3NGY3MS02ZGZjLTQ2MTItOWMzYy01YzU4MGViODM1OTY8L3dzYTpNZXNzYWdlSUQ+PHdzZDpBcHBTZXF1ZW5jZSBJbnN0YW5jZUlkPSI0NiIgU2VxdWVuY2VJZD0idXJuOnV1aWQ6NzY3Mzg5ZTAtZWU5YS00YzFjLWI5MDItMjBjYjgxZDIwM2UwIiBNZXNzYWdlTnVtYmVyPSI1Ij48L3dzZDpBcHBTZXF1ZW5jZT48L3NvYXA6SGVhZGVyPjxzb2FwOkJvZHk+PHdzZDpCeWU+PHdzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NhOkFkZHJlc3M+dXJuOnV1aWQ6NzQ3ZjNkOTYtNjhhNy00M2YxLThjYmUtZThkNmRhZGQwMzU4PC93c2E6QWRkcmVzcz48L3dzYTpFbmRwb2ludFJlZmVyZW5jZT48L3dzZDpCeWU+PC9zb2FwOkJvZHk+PC9zb2FwOkVudmVsb3BlPg=="}
-00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7486,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":800,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599415,"flow_last_seen":599415,"flow_idle_time":200000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":772,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599415,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
+00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7486,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":800,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599415,"flow_last_seen":599415,"flow_idle_time":200000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":772,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599415,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
 00541{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7487,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":801,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599426,"flow_last_seen":599426,"flow_idle_time":140000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599426,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3}
 00490{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7487,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":801,"flow_packet_id":1,"flow_last_seen":599426,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":62,"pkt_len":90,"pkt_l4_len":28,"thread_ts_msec":599426,"pkt":"MzMAAAAWCAAn5uVZht1gAAAAACQAAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAWOgAFAgAAAQCPAOKkAAAAAQMAAAD\/AgAAAAAAAAAAAAAAAAAM"}
-00602{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7487,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":801,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599426,"flow_last_seen":599426,"flow_idle_time":140000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599426,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
+00602{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7487,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":801,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599426,"flow_last_seen":599426,"flow_idle_time":140000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599426,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","ndpi": {"confidence": {"6":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
 01485{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7488,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":799,"flow_packet_id":2,"flow_last_seen":599529,"flow_idle_time":200000,"pkt_oversize":false,"pkt_caplen":834,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":834,"pkt_l4_len":780,"thread_ts_msec":599529,"pkt":"MzMAAAAMCAAn5uVZht1gB0PFAwwRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dYOdgMMdjk8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvQnllPC93c2E6QWN0aW9uPjx3c2E6TWVzc2FnZUlEPnVybjp1dWlkOjk4Zjc0ZjcxLTZkZmMtNDYxMi05YzNjLTVjNTgwZWI4MzU5Njwvd3NhOk1lc3NhZ2VJRD48d3NkOkFwcFNlcXVlbmNlIEluc3RhbmNlSWQ9IjQ2IiBTZXF1ZW5jZUlkPSJ1cm46dXVpZDo3NjczODllMC1lZTlhLTRjMWMtYjkwMi0yMGNiODFkMjAzZTAiIE1lc3NhZ2VOdW1iZXI9IjUiPjwvd3NkOkFwcFNlcXVlbmNlPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOkJ5ZT48d3NhOkVuZHBvaW50UmVmZXJlbmNlPjx3c2E6QWRkcmVzcz51cm46dXVpZDo3NDdmM2Q5Ni02OGE3LTQzZjEtOGNiZS1lOGQ2ZGFkZDAzNTg8L3dzYTpBZGRyZXNzPjwvd3NhOkVuZHBvaW50UmVmZXJlbmNlPjwvd3NkOkJ5ZT48L3NvYXA6Qm9keT48L3NvYXA6RW52ZWxvcGU+"}
 00490{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7489,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":801,"flow_packet_id":2,"flow_last_seen":599747,"flow_idle_time":140000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":62,"pkt_len":90,"pkt_l4_len":28,"thread_ts_msec":599747,"pkt":"MzMAAAAWCAAn5uVZht1gAAAAACQAAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAWOgAFAgAAAQCPAOKkAAAAAQMAAAD\/AgAAAAAAAAAAAAAAAAAM"}
 00571{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":7490,"source":"gnutella.pcap","alias":"nDPId-test","packets-captured":7490,"packets-processed":7468,"total-skipped-flows":0,"total-l4-payload-len":3617715,"total-not-detected-flows":478,"total-guessed-flows":2,"total-detected-flows":170,"total-detection-updates":3,"total-updates":298,"current-active-flows":169,"total-active-flows":801,"total-idle-flows":632,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":3938,"global_ts_msec":600247}
@@ -3956,12 +3956,12 @@
 00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":114,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":71540,"flow_last_seen":551891,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.23.75.69","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":245,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":89733,"flow_last_seen":98763,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.195.236.249","src_port":50289,"dst_port":18557,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":245,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":89733,"flow_last_seen":98763,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.195.236.249","src_port":50289,"dst_port":18557,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":800,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":599415,"flow_last_seen":599415,"flow_idle_time":200000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":772,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
+00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":800,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":599415,"flow_last_seen":599415,"flow_idle_time":200000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":772,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
 00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":776,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490660,"flow_last_seen":551702,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.10.83","src_port":28681,"dst_port":8797,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":776,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490660,"flow_last_seen":551702,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.10.83","src_port":28681,"dst_port":8797,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":227,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":85607,"flow_last_seen":94638,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.179.18.242","src_port":50273,"dst_port":47329,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":227,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":85607,"flow_last_seen":94638,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.179.18.242","src_port":50273,"dst_port":47329,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":276,"flow_state":"finished","flow_packets_processed":135,"flow_first_seen":90742,"flow_last_seen":593652,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":9771,"flow_avg_l4_payload_len":72,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":50300,"dst_port":11852,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":276,"flow_state":"finished","flow_packets_processed":135,"flow_first_seen":90742,"flow_last_seen":593652,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":9771,"flow_avg_l4_payload_len":72,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":50300,"dst_port":11852,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":767,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490658,"flow_last_seen":490773,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":74,"flow_avg_l4_payload_len":37,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.65.87.24","src_port":28681,"dst_port":16201,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":767,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490658,"flow_last_seen":490773,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":74,"flow_avg_l4_payload_len":37,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.65.87.24","src_port":28681,"dst_port":16201,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":352,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":131671,"flow_last_seen":551891,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.191.49.159","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3976,8 +3976,8 @@
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":778,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490660,"flow_last_seen":490660,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.117.100.78","src_port":28681,"dst_port":9010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":773,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":490696,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":74,"flow_avg_l4_payload_len":37,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.153.21.93","src_port":28681,"dst_port":36696,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":773,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":490696,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":74,"flow_avg_l4_payload_len":37,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.153.21.93","src_port":28681,"dst_port":36696,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00617{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":12513,"flow_last_seen":14765,"flow_idle_time":620000,"flow_min_l4_payload_len":16,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":200,"flow_avg_l4_payload_len":16,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"IGMP","breed":"Acceptable","category":"Network"}}
-00802{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":238,"flow_state":"finished","flow_packets_processed":365,"flow_first_seen":88704,"flow_last_seen":593692,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":43484,"flow_avg_l4_payload_len":119,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":50284,"dst_port":53258,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00617{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":12513,"flow_last_seen":14765,"flow_idle_time":620000,"flow_min_l4_payload_len":16,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":200,"flow_avg_l4_payload_len":16,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"IGMP","breed":"Acceptable","category":"Network"}}
+00802{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":238,"flow_state":"finished","flow_packets_processed":365,"flow_first_seen":88704,"flow_last_seen":593692,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":43484,"flow_avg_l4_payload_len":119,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":50284,"dst_port":53258,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":779,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490660,"flow_last_seen":551702,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.65.217.224","src_port":28681,"dst_port":18381,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":779,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490660,"flow_last_seen":551702,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.65.217.224","src_port":28681,"dst_port":18381,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":768,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":490658,"flow_last_seen":548572,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":181,"flow_avg_l4_payload_len":45,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":28681,"dst_port":37058,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -3988,8 +3988,8 @@
 00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":75,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":69142,"flow_last_seen":78169,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.189.28.17","src_port":50234,"dst_port":16269,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
 00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":240,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":88705,"flow_last_seen":97732,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.118.116.198","src_port":50286,"dst_port":44616,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":240,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":88705,"flow_last_seen":97732,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.118.116.198","src_port":50286,"dst_port":44616,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00783{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":760,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":431178,"flow_last_seen":599325,"flow_idle_time":200000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":402,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
-00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":798,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":595449,"flow_last_seen":598465,"flow_idle_time":200000,"flow_min_l4_payload_len":137,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":274,"flow_avg_l4_payload_len":137,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00783{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":760,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":431178,"flow_last_seen":599325,"flow_idle_time":200000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":402,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
+00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":798,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":595449,"flow_last_seen":598465,"flow_idle_time":200000,"flow_min_l4_payload_len":137,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":274,"flow_avg_l4_payload_len":137,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":118,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":71541,"flow_last_seen":553212,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"5.180.62.100","src_port":28681,"dst_port":46385,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":118,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":71541,"flow_last_seen":553212,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"5.180.62.100","src_port":28681,"dst_port":46385,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":74,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":69141,"flow_last_seen":78169,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.163.14.246","src_port":50233,"dst_port":12854,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -4010,11 +4010,11 @@
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":172,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82060,"flow_last_seen":493285,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.69.142.133","src_port":28681,"dst_port":15471,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":749,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":312956,"flow_last_seen":493285,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.8.59.80","src_port":28681,"dst_port":35192,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":749,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":312956,"flow_last_seen":493285,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.8.59.80","src_port":28681,"dst_port":35192,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00641{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":801,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":599426,"flow_last_seen":599747,"flow_idle_time":140000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
+00641{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":801,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":599426,"flow_last_seen":599747,"flow_idle_time":140000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
 00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":123,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":72267,"flow_last_seen":81278,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.78.134.188","src_port":50254,"dst_port":49046,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":123,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":72267,"flow_last_seen":81278,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.78.134.188","src_port":50254,"dst_port":49046,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00673{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":799,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":599415,"flow_last_seen":599529,"flow_idle_time":200000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":1544,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
-00917{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":333,"flow_state":"finished","flow_packets_processed":2356,"flow_first_seen":114930,"flow_last_seen":546895,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":2191780,"flow_avg_l4_payload_len":930,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50327,"dst_port":46906,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00673{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":799,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":599415,"flow_last_seen":599529,"flow_idle_time":200000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":1544,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}}
+00917{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":333,"flow_state":"finished","flow_packets_processed":2356,"flow_first_seen":114930,"flow_last_seen":546895,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":2191780,"flow_avg_l4_payload_len":930,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50327,"dst_port":46906,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":64,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":67094,"flow_last_seen":76122,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.167.248.220","src_port":50223,"dst_port":63108,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":64,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":67094,"flow_last_seen":76122,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.167.248.220","src_port":50223,"dst_port":63108,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
 00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":59,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66078,"flow_last_seen":75077,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.103.247.94","src_port":50218,"dst_port":59045,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -4055,13 +4055,13 @@
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":180,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82061,"flow_last_seen":493284,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.131.24.72","src_port":28681,"dst_port":30711,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":281,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90744,"flow_last_seen":99778,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":50305,"dst_port":63637,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":281,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90744,"flow_last_seen":99778,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":50305,"dst_port":63637,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":93,"flow_state":"finished","flow_packets_processed":99,"flow_first_seen":71205,"flow_last_seen":593737,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":6090,"flow_avg_l4_payload_len":61,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.214.154.216","src_port":50248,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":93,"flow_state":"finished","flow_packets_processed":99,"flow_first_seen":71205,"flow_last_seen":593737,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":6090,"flow_avg_l4_payload_len":61,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.214.154.216","src_port":50248,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":48,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":65061,"flow_last_seen":74092,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":50208,"dst_port":8683,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":48,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":65061,"flow_last_seen":74092,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":50208,"dst_port":8683,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":794,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":520019,"flow_last_seen":523077,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50214,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":794,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":520019,"flow_last_seen":523077,"flow_idle_time":200000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50214,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":266,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90737,"flow_last_seen":99778,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.89.249.8","src_port":50290,"dst_port":50649,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":266,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90737,"flow_last_seen":99778,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.89.249.8","src_port":50290,"dst_port":50649,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00626{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":797,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":552011,"flow_last_seen":552011,"flow_idle_time":140000,"flow_min_l4_payload_len":60,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":60,"flow_avg_l4_payload_len":60,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"154.3.42.209","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}}
+00626{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":797,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":552011,"flow_last_seen":552011,"flow_idle_time":140000,"flow_min_l4_payload_len":60,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":60,"flow_avg_l4_payload_len":60,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"154.3.42.209","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":135,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":72852,"flow_last_seen":491978,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.250.99.158","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":135,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":72852,"flow_last_seen":491978,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.250.99.158","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":78,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":69142,"flow_last_seen":78169,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.123.202.175","src_port":50237,"dst_port":37910,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -4196,11 +4196,11 @@
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":770,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":490846,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":74,"flow_avg_l4_payload_len":37,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":28681,"dst_port":8890,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":235,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":87670,"flow_last_seen":96685,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.134.154.158","src_port":50281,"dst_port":54130,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":235,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":87670,"flow_last_seen":96685,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.134.154.158","src_port":50281,"dst_port":54130,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00628{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":783,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":490916,"flow_last_seen":490916,"flow_idle_time":140000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"65.182.231.232","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}}
+00628{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":783,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":490916,"flow_last_seen":490916,"flow_idle_time":140000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"65.182.231.232","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}}
 00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":60,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66079,"flow_last_seen":75108,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.121.165.12","src_port":50219,"dst_port":55376,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":60,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66079,"flow_last_seen":75108,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.121.165.12","src_port":50219,"dst_port":55376,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
-00800{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":239,"flow_state":"finished","flow_packets_processed":312,"flow_first_seen":88704,"flow_last_seen":593713,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":19428,"flow_avg_l4_payload_len":62,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":50285,"dst_port":52367,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00916{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":334,"flow_state":"finished","flow_packets_processed":1251,"flow_first_seen":114930,"flow_last_seen":537520,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":1051202,"flow_avg_l4_payload_len":840,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"189.147.72.83","src_port":50328,"dst_port":26108,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00800{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":239,"flow_state":"finished","flow_packets_processed":312,"flow_first_seen":88704,"flow_last_seen":593713,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":19428,"flow_avg_l4_payload_len":62,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":50285,"dst_port":52367,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00916{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":334,"flow_state":"finished","flow_packets_processed":1251,"flow_first_seen":114930,"flow_last_seen":537520,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":1051202,"flow_avg_l4_payload_len":840,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"189.147.72.83","src_port":50328,"dst_port":26108,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":175,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82060,"flow_last_seen":493283,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"115.69.62.99","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":175,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82060,"flow_last_seen":493283,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"115.69.62.99","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":756,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":373494,"flow_last_seen":551890,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.100.68.255","src_port":28681,"dst_port":12838,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -4215,7 +4215,7 @@
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":766,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490658,"flow_last_seen":490658,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.119.55.28","src_port":28681,"dst_port":20347,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":763,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":433135,"flow_last_seen":433135,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.170.209.214","src_port":28681,"dst_port":46210,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":763,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":433135,"flow_last_seen":433135,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.170.209.214","src_port":28681,"dst_port":46210,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00801{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":288,"flow_state":"finished","flow_packets_processed":295,"flow_first_seen":90745,"flow_last_seen":593624,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":9996,"flow_avg_l4_payload_len":33,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":50312,"dst_port":23548,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00801{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":288,"flow_state":"finished","flow_packets_processed":295,"flow_first_seen":90745,"flow_last_seen":593624,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":9996,"flow_avg_l4_payload_len":33,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":50312,"dst_port":23548,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":120,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":72265,"flow_last_seen":81294,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.127.1.235","src_port":50251,"dst_port":37814,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":120,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":72265,"flow_last_seen":81294,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.127.1.235","src_port":50251,"dst_port":37814,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
 00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":144,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":73300,"flow_last_seen":82326,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.48.23","src_port":50257,"dst_port":3054,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -4252,8 +4252,8 @@
 00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":231,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":86639,"flow_last_seen":95653,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":50277,"dst_port":36368,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3}
 00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":791,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493288,"flow_last_seen":493288,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.11.85","src_port":28681,"dst_port":10722,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":791,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493288,"flow_last_seen":493288,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.11.85","src_port":28681,"dst_port":10722,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
-00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":94,"flow_state":"finished","flow_packets_processed":90,"flow_first_seen":71205,"flow_last_seen":593376,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1065,"flow_tot_l4_payload_len":5915,"flow_avg_l4_payload_len":65,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.208.180.181","src_port":50249,"dst_port":45883,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
-00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":95716,"flow_last_seen":426518,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":359,"flow_avg_l4_payload_len":51,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.167.201.53","src_port":28681,"dst_port":47282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":94,"flow_state":"finished","flow_packets_processed":90,"flow_first_seen":71205,"flow_last_seen":593376,"flow_idle_time":7580000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1065,"flow_tot_l4_payload_len":5915,"flow_avg_l4_payload_len":65,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.208.180.181","src_port":50249,"dst_port":45883,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
+00795{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":95716,"flow_last_seen":426518,"flow_idle_time":200000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":359,"flow_avg_l4_payload_len":51,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.167.201.53","src_port":28681,"dst_port":47282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"6":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}}
 00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":138,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":72853,"flow_last_seen":553212,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"167.114.170.156","src_port":28681,"dst_port":23844,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
 00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":138,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":72853,"flow_last_seen":553212,"flow_idle_time":200000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"167.114.170.156","src_port":28681,"dst_port":23844,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00571{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","packets-captured":7491,"packets-processed":7468,"total-skipped-flows":0,"total-l4-payload-len":3617715,"total-not-detected-flows":629,"total-guessed-flows":2,"total-detected-flows":170,"total-detection-updates":3,"total-updates":298,"current-active-flows":0,"total-active-flows":801,"total-idle-flows":801,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":4259,"global_ts_msec":600247}
@@ -4265,9 +4265,9 @@
 ~~ total active/idle flows...: 801/801
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7049358 bytes
-~~ total memory freed........: 7049358 bytes
-~~ total allocations/frees...: 129026/129026
+~~ total memory allocated....: 7182992 bytes
+~~ total memory freed........: 7182992 bytes
+~~ total allocations/frees...: 131788/131788
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 179 chars
 ~~ json string max len.......: 1916 chars