Added layer4 payload length bins.

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 9 insertions, 9 deletions

diff --git a/test/results/ipsec_isakmp_esp.pcap.out b/test/results/ipsec_isakmp_esp.pcap.out
index 59bd3c094..ef2216ca8 100644
--- a/test/results/ipsec_isakmp_esp.pcap.out
+++ b/test/results/ipsec_isakmp_esp.pcap.out
@@ -13,7 +13,7 @@
 00566{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":24,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","packets-captured":24,"packets-processed":23,"total-skipped-flows":0,"total-l4-payload-len":11884,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":2,"total-active-flows":2,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":13,"global_ts_usec":946745300340000}
 00914{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":42,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_src_packets_processed":15,"flow_dst_packets_processed":14,"flow_first_seen":946744635161000,"flow_src_last_pkt_time":946745301909000,"flow_dst_last_pkt_time":946745301906000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1028,"flow_src_tot_l4_payload_len":11540,"flow_dst_tot_l4_payload_len":3360,"midstream":0,"thread_ts_usec":946745301909000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.193","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
 00909{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":42,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_src_packets_processed":6,"flow_dst_packets_processed":6,"flow_first_seen":946744638499000,"flow_src_last_pkt_time":946745300381000,"flow_dst_last_pkt_time":946745300411000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":776,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":800,"flow_dst_max_l4_payload_len":288,"flow_src_tot_l4_payload_len":4728,"flow_dst_tot_l4_payload_len":1020,"midstream":0,"thread_ts_usec":946745301909000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.193","src_port":10500,"dst_port":500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
-01378{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":48,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":946744635161000,"flow_src_last_pkt_time":946745723299000,"flow_dst_last_pkt_time":946745723443000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1028,"flow_src_tot_l4_payload_len":12356,"flow_dst_tot_l4_payload_len":3648,"midstream":0,"thread_ts_usec":946745723443000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.193","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":1000,"flow_avg":87056800.0,"flow_max":662067000,"flow_stddev":203163760.0,"c_to_s_min":1000,"c_to_s_avg":90678168.0,"c_to_s_max":661960000,"c_to_s_stddev":207584736.0,"s_to_c_min":4000,"s_to_c_avg":83714000.0,"s_to_c_max":662067000,"s_to_c_stddev":198937184.0},"pktlen": {"c_to_s_min":138,"c_to_s_avg":814.2,"c_to_s_max":1374,"c_to_s_stddev":488.5,"s_to_c_min":122,"s_to_c_avg":270.0,"s_to_c_max":1070,"s_to_c_stddev":229.4}},"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
+01604{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":48,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":946744635161000,"flow_src_last_pkt_time":946745723299000,"flow_dst_last_pkt_time":946745723443000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1028,"flow_src_tot_l4_payload_len":12356,"flow_dst_tot_l4_payload_len":3648,"midstream":0,"thread_ts_usec":946745723443000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.193","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":1000,"flow_avg":87056800.0,"flow_max":662067000,"flow_stddev":203163760.0,"c_to_s_min":1000,"c_to_s_avg":90678168.0,"c_to_s_max":661960000,"c_to_s_stddev":207584736.0,"s_to_c_min":4000,"s_to_c_avg":83714000.0,"s_to_c_max":662067000,"s_to_c_stddev":198937184.0},"pktlen": {"c_to_s_min":138,"c_to_s_avg":814.2,"c_to_s_max":1374,"c_to_s_stddev":488.5,"s_to_c_min":122,"s_to_c_avg":270.0,"s_to_c_max":1070,"s_to_c_stddev":229.4},"bins": {"c_to_s": [0,0,0,4,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0],"s_to_c": [0,0,3,0,7,0,3,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]}},"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
 00914{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":61,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_src_packets_processed":22,"flow_dst_packets_processed":22,"flow_first_seen":946744635161000,"flow_src_last_pkt_time":946745725650000,"flow_dst_last_pkt_time":946745725647000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1028,"flow_src_tot_l4_payload_len":16260,"flow_dst_tot_l4_payload_len":5568,"midstream":0,"thread_ts_usec":946745725650000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.193","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
 00909{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":61,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":8,"flow_first_seen":946744638499000,"flow_src_last_pkt_time":946745723231000,"flow_dst_last_pkt_time":946745723263000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":776,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":800,"flow_dst_max_l4_payload_len":288,"flow_src_tot_l4_payload_len":6304,"flow_dst_tot_l4_payload_len":1360,"midstream":0,"thread_ts_usec":946745725650000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.193","src_port":10500,"dst_port":500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
 00566{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":62,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","packets-captured":62,"packets-processed":61,"total-skipped-flows":0,"total-l4-payload-len":29572,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":0,"total-updates":4,"current-active-flows":2,"total-active-flows":2,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":19,"global_ts_usec":946747247312000}
@@ -157,8 +157,8 @@
 00865{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":348,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":816,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":816,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":816,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.227","src_port":14500,"dst_port":4500,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
 00784{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":349,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":250,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":250,"pkt_l4_len":216,"thread_ts_usec":946763527783000,"pkt":"YDjgxTWgeJS0JASgCABFAADsy5UAAPcRCo5t7bvjwKgCZBGUOKQA2N2eAAAAAMT3roGUU5AxVDreTwHgKMguICMgAAAAAQAAAMwkAACw3+hDUjEFQ6MgpqAEcApKvn9uh3qVHzhAobzzdsLHNL0cE0MCy6hqRcHq2zyFYxqKUvV9qpSoUCOXzZX8acXWksJkwcZvlj3pHUnomqGBUy7YKx8\/BoUpsdZ+YJ66Urw6XFHoKHyVFJYrxhfDTA96A3GMtNoZk+CLmvMZh9uGXGXGb9zoZqBq9vHjZRx\/MplOtNEvpcXqGaCwVYcGtrGfedPqueJGKjXMXpyHhw=="}
 00655{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":350,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":3,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"thread_ts_usec":946763527783000,"pkt":"eJS0JASgYDjgxTWgCABFAACMqXpAAD8RpQnAqAJkbe274zikEZQAeOw1AAAAAMT3roGUU5AxVDreTwHgKMguICMIAAAAAgAAAGwwAABQp3zPqAaPZdCtSbotjrN0irXGcY7JpOGxC6pjgSY\/TZB8lMPX2DP1QKzYFMuSni2xVCT2eLDFep09w0XbtiWVOI2z82MP7LPt5iJg1A=="}
-01302{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":383,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"finished","flow_src_packets_processed":15,"flow_dst_packets_processed":17,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1028,"flow_src_tot_l4_payload_len":10256,"flow_dst_tot_l4_payload_len":4624,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.227","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":0,"flow_avg":0.0,"flow_max":0,"flow_stddev":0.0,"c_to_s_min":0,"c_to_s_avg":0.0,"c_to_s_max":0,"c_to_s_stddev":0.0,"s_to_c_min":0,"s_to_c_avg":0.0,"s_to_c_max":0,"s_to_c_stddev":0.0},"pktlen": {"c_to_s_min":138,"c_to_s_avg":725.7,"c_to_s_max":1374,"c_to_s_stddev":502.0,"s_to_c_min":122,"s_to_c_avg":314.0,"s_to_c_max":1070,"s_to_c_stddev":293.2}},"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
-01296{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":465,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":776,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":800,"flow_dst_max_l4_payload_len":288,"flow_src_tot_l4_payload_len":12608,"flow_dst_tot_l4_payload_len":2720,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.227","src_port":10500,"dst_port":500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":0,"flow_avg":0.0,"flow_max":0,"flow_stddev":0.0,"c_to_s_min":0,"c_to_s_avg":0.0,"c_to_s_max":0,"c_to_s_stddev":0.0,"s_to_c_min":0,"s_to_c_avg":0.0,"s_to_c_max":0,"s_to_c_stddev":0.0},"pktlen": {"c_to_s_min":818,"c_to_s_avg":830.0,"c_to_s_max":842,"c_to_s_stddev":12.0,"s_to_c_min":94,"s_to_c_avg":212.0,"s_to_c_max":330,"s_to_c_stddev":118.0}},"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
+01528{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":383,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"finished","flow_src_packets_processed":15,"flow_dst_packets_processed":17,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1028,"flow_src_tot_l4_payload_len":10256,"flow_dst_tot_l4_payload_len":4624,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.227","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":0,"flow_avg":0.0,"flow_max":0,"flow_stddev":0.0,"c_to_s_min":0,"c_to_s_avg":0.0,"c_to_s_max":0,"c_to_s_stddev":0.0,"s_to_c_min":0,"s_to_c_avg":0.0,"s_to_c_max":0,"s_to_c_stddev":0.0},"pktlen": {"c_to_s_min":138,"c_to_s_avg":725.7,"c_to_s_max":1374,"c_to_s_stddev":502.0,"s_to_c_min":122,"s_to_c_avg":314.0,"s_to_c_max":1070,"s_to_c_stddev":293.2},"bins": {"c_to_s": [0,0,0,4,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0],"s_to_c": [0,0,4,0,6,0,3,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]}},"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
+01522{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":465,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":776,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":800,"flow_dst_max_l4_payload_len":288,"flow_src_tot_l4_payload_len":12608,"flow_dst_tot_l4_payload_len":2720,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.227","src_port":10500,"dst_port":500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":0,"flow_avg":0.0,"flow_max":0,"flow_stddev":0.0,"c_to_s_min":0,"c_to_s_avg":0.0,"c_to_s_max":0,"c_to_s_stddev":0.0,"s_to_c_min":0,"s_to_c_avg":0.0,"s_to_c_max":0,"s_to_c_stddev":0.0},"pktlen": {"c_to_s_min":818,"c_to_s_avg":830.0,"c_to_s_max":842,"c_to_s_stddev":12.0,"s_to_c_min":94,"s_to_c_avg":212.0,"s_to_c_max":330,"s_to_c_stddev":118.0},"bins": {"c_to_s": [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"s_to_c": [0,8,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]}},"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
 00768{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":466,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":776,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":776,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":776,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.226","src_port":10500,"dst_port":500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 01540{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":466,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":818,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":818,"pkt_l4_len":784,"thread_ts_usec":946763527783000,"pkt":"eJS0JASgYDjgxTWgCABFAAMkUT5AAD8R+q7AqAJkbe274ikEAfQDENNXqwswX1pdWlQAAAAAAAAAACEgIggAAAAAAAADCCIAAggCAABQAQEACAMAAAwBAAAMgA4AgAMAAAwBAAAMgA4BAAMAAAgDAAACAwAACAMAAAwDAAAIAgAAAgMAAAgCAAAFAwAACAQAAAIAAAAIBAAABQAAAbQCAQAuAwAACAEAAAMDAAAMAQAADIAOAIADAAAMAQAADIAOAMADAAAMAQAADIAOAQADAAAMAQAADYAOAIADAAAMAQAADYAOAMADAAAMAQAADYAOAQADAAAMAQAAEoAOAIADAAAMAQAAEoAOAMADAAAMAQAAEoAOAQADAAAMAQAAE4AOAIADAAAMAQAAE4AOAMADAAAMAQAAE4AOAQADAAAMAQAAFIAOAIADAAAMAQAAFIAOAMADAAAMAQAAFIAOAQADAAAIAwAAAQMAAAgDAAACAwAACAMAAAUDAAAIAwAADAMAAAgDAAANAwAACAMAAA4DAAAIAgAAAQMAAAgCAAACAwAACAIAAAQDAAAIAgAABQMAAAgCAAAGAwAACAIAAAcDAAAIBAAAAgMAAAgEAAAFAwAACAQAAA4DAAAIBAAADwMAAAgEAAAQAwAACAQAABIDAAAIBAAAEwMAAAgEAAAUAwAACAQAABUDAAAIBAAAFgMAAAgEAAAXAwAACAQAABgDAAAIBAAAGQMAAAgEAAAaAwAACAQAABsDAAAIBAAAHAMAAAgEAAAdAAAACAQAAB4oAACIAAIAANisWYZIjej7n3HtY6YrUGG6ju3JyAgfXaIbqQqsCk6WamsA3yJowbMrsQiavjlYliQ8\/bmnkd4oik6yfXzF2nnT5++MrBWp59hXjvpQG7CUKBYM2qK1rCYScGFGvoCH+VaOstA9qnbA93UZ+lGrf8oiyLKNCUx8EmTjNr1npSw0KQAAJEdv70J9iweqoyFFLnrl4Zzojnhs5HDATx3IKPlr2BaOKQAAHAAAQASxGcGDddgOxJ\/uFM4nQfEOTHdh1AAAABwAAEAFw3IlZSVVICry3JG3pa18XmliW9c="}
 00864{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":466,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":776,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":776,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":776,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.226","src_port":10500,"dst_port":500,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
@@ -179,7 +179,7 @@
 00865{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":658,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":816,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":816,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":816,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.130","src_port":14500,"dst_port":4500,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
 00789{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":659,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":250,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":250,"pkt_l4_len":216,"thread_ts_usec":946763527783000,"pkt":"YDjgxTWgeJS0JASgCABFAADsk6IAAPYRQ+Jt7buCwKgCZBGUOKQA2IekAAAAAM17ri1L\/ac+HEFGvwEgEbUuICMgAAAAAQAAAMwkAACwnjHnEXtSQ9YBTsYWhNWWL2lb3zCSVGmtTzEvh47BEs\/bjLyBXTJjuCqg7wWeV74OlRvZj2lbuv2HF8N25vmjxy2gOj3GTSIkrJ81O5xBYrk\/DO\/U3vnDhNrRnxnnbUAcri8CK4colHYFHy00rAAnAiq\/J3y\/4Psn7O2YNdeQxTN+FVKTTs+PkcU9iJQYjyeso5yATeFNdg3Yo2REPpR\/v53srr2DXIiU+rV2BA=="}
 00657{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":660,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":3,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"thread_ts_usec":946763527783000,"pkt":"eJS0JASgYDjgxTWgCABFAACMfEZAAD8R0p7AqAJkbe27gjikEZQAeEKcAAAAAM17ri1L\/ac+HEFGvwEgEbUuICMIAAAAAgAAAGwwAABQ4uWpvKvs0+Grd38C+Ik2kAU8jJda\/\/ZCHQQBPzJXFKXfyLyFjecJewBE8lyFFdf5WHr93Xl19FueaRtvNm5eWTihSgwraMBcuUWyzQ=="}
-01302{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":697,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"finished","flow_src_packets_processed":13,"flow_dst_packets_processed":19,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1332,"flow_src_tot_l4_payload_len":7848,"flow_dst_tot_l4_payload_len":12096,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.130","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":0,"flow_avg":0.0,"flow_max":0,"flow_stddev":0.0,"c_to_s_min":0,"c_to_s_avg":0.0,"c_to_s_max":0,"c_to_s_stddev":0.0,"s_to_c_min":0,"s_to_c_avg":0.0,"s_to_c_max":0,"s_to_c_stddev":0.0},"pktlen": {"c_to_s_min":138,"c_to_s_avg":645.7,"c_to_s_max":1374,"c_to_s_stddev":480.4,"s_to_c_min":122,"s_to_c_avg":678.6,"s_to_c_max":1374,"s_to_c_stddev":531.4}},"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
+01528{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":697,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"finished","flow_src_packets_processed":13,"flow_dst_packets_processed":19,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1332,"flow_src_tot_l4_payload_len":7848,"flow_dst_tot_l4_payload_len":12096,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.130","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":0,"flow_avg":0.0,"flow_max":0,"flow_stddev":0.0,"c_to_s_min":0,"c_to_s_avg":0.0,"c_to_s_max":0,"c_to_s_stddev":0.0,"s_to_c_min":0,"s_to_c_avg":0.0,"s_to_c_max":0,"s_to_c_stddev":0.0},"pktlen": {"c_to_s_min":138,"c_to_s_avg":645.7,"c_to_s_max":1374,"c_to_s_stddev":480.4,"s_to_c_min":122,"s_to_c_avg":678.6,"s_to_c_max":1374,"s_to_c_stddev":531.4},"bins": {"c_to_s": [0,0,0,4,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0],"s_to_c": [0,0,2,0,4,0,3,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,2,4,0,0,0,0,0,0]}},"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
 00769{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":768,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":29,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":416,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":416,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":416,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.193","src_port":42593,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 01065{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":768,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":458,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":458,"pkt_l4_len":424,"thread_ts_usec":946763527783000,"pkt":"eJS0JASgYDjgxTWgCABFAAG8AURAAP0RjjHAqAJkbe27waZhEZQBqLXBAAAAABcjot1R1L2v9VP\/ZQPMlAYuICMIAAAAAQAAAZwjAAGAFzlsP7YgimBjfIhMJEPhZdw0CnuZSvY37VZC7a055Lu7e+IEFmagHoqj\/3VU94cqC6SemXaaay0d\/2HUKJiZnpCAdCpw2HQ0KrTFW857JbKQ5j3IjKxRjcUYXqtMskX1DsgbCtObqa65cF5WltmtdmwVSANhLzG0LAR+CYEUUulm5YiOyMOFPbHpSrtDM2EEADmkbnPxO00Rexy0LvWXHDnINrIOiYbG6hzWEPIEI9Eq\/yH+hgIb4D\/vUKMOXGmPYj6eX3YPkbs08cGm1IBTDEzAwFQ6+Dut0IKwpkVjd+zPi5GajMElxeEZqtJlXKjo9Q5m9\/Z280gMX0Ev66KMtd6K6mBxkfkxU48zqh5WNlzUeROBsXFhnHi99g6+xt5SosQj2gpfId\/yriJfKS5T7sFkMpq5UCC9LwpNDHHYOliSKEorplbbZFT5pCqGgvpGJkdN1m+eylUPZy+lsCygyTo96r1KrC7wKmw+U5ttVkc6oJ49jPR1mswYgKs="}
 00865{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":768,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":29,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":416,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":416,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":416,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.193","src_port":42593,"dst_port":4500,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
@@ -220,8 +220,8 @@
 00864{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":955,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":36,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":776,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":776,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":776,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.195","src_port":10500,"dst_port":500,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
 00572{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":956,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":94,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":94,"pkt_l4_len":60,"thread_ts_usec":946763527783000,"pkt":"YDjgxTWgeJS0JASgCABFAABQw\/QAAPcREutt7bvDwKgCZAH0KQQAPDt0h60nd4XOo4EAAAAAAAAAACkgIiAAAAAAAAAANAAAABgAAEAGAAFWSjMix2hDw5Uoh9iWqg=="}
 01572{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":957,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":3,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":842,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":842,"pkt_l4_len":808,"thread_ts_usec":946763527783000,"pkt":"eJS0JASgYDjgxTWgCABFAAM8ygVAAD8Rge7AqAJkbe27wykEAfQDKIzIh60nd4XOo4EAAAAAAAAAACkgIggAAAAAAAADICEAABgAAEAGAAFWSjMix2hDw5Uoh9iWqiIAAggCAABQAQEACAMAAAwBAAAMgA4AgAMAAAwBAAAMgA4BAAMAAAgDAAACAwAACAMAAAwDAAAIAgAAAgMAAAgCAAAFAwAACAQAAAIAAAAIBAAABQAAAbQCAQAuAwAACAEAAAMDAAAMAQAADIAOAIADAAAMAQAADIAOAMADAAAMAQAADIAOAQADAAAMAQAADYAOAIADAAAMAQAADYAOAMADAAAMAQAADYAOAQADAAAMAQAAEoAOAIADAAAMAQAAEoAOAMADAAAMAQAAEoAOAQADAAAMAQAAE4AOAIADAAAMAQAAE4AOAMADAAAMAQAAE4AOAQADAAAMAQAAFIAOAIADAAAMAQAAFIAOAMADAAAMAQAAFIAOAQADAAAIAwAAAQMAAAgDAAACAwAACAMAAAUDAAAIAwAADAMAAAgDAAANAwAACAMAAA4DAAAIAgAAAQMAAAgCAAACAwAACAIAAAQDAAAIAgAABQMAAAgCAAAGAwAACAIAAAcDAAAIBAAAAgMAAAgEAAAFAwAACAQAAA4DAAAIBAAADwMAAAgEAAAQAwAACAQAABIDAAAIBAAAEwMAAAgEAAAUAwAACAQAABUDAAAIBAAAFgMAAAgEAAAXAwAACAQAABgDAAAIBAAAGQMAAAgEAAAaAwAACAQAABsDAAAIBAAAHAMAAAgEAAAdAAAACAQAAB4oAACIAAIAAEnKegIkLOmW4KZNcOCo7ZOC4licZ2A51HwGaEIiqoXRPN6FcRoNRdAJs+VA4OoEhdOX8Fx4+MU+pUH2RMi10WP9fW5dlYg6Cr9HTfi+4X5mNAA6iu7R0SUnBzU7WFhgJmUeZ23\/+YRhQU1yMpmQB5bWydw9ZfvTkPXAog0gKlZ1KQAAJIVS0Rg+btu6BkuEgsgaurW3aJ4eaYYGQ6VjkOvvz6QMKQAAHAAAQASo5HDOkRKoIfuPc\/+LezYZYFoAhAAAABwAAEAFi9H7SlG8iBMVMxjPqyusPgxIUYI="}
-01302{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":983,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":34,"flow_state":"finished","flow_src_packets_processed":15,"flow_dst_packets_processed":17,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1332,"flow_src_tot_l4_payload_len":10224,"flow_dst_tot_l4_payload_len":7128,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.195","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":0,"flow_avg":0.0,"flow_max":0,"flow_stddev":0.0,"c_to_s_min":0,"c_to_s_avg":0.0,"c_to_s_max":0,"c_to_s_stddev":0.0,"s_to_c_min":0,"s_to_c_avg":0.0,"s_to_c_max":0,"s_to_c_stddev":0.0},"pktlen": {"c_to_s_min":138,"c_to_s_avg":723.6,"c_to_s_max":1374,"c_to_s_stddev":501.1,"s_to_c_min":122,"s_to_c_avg":461.3,"s_to_c_max":1374,"s_to_c_stddev":438.3}},"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
-01303{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":1048,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"finished","flow_src_packets_processed":15,"flow_dst_packets_processed":17,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1332,"flow_src_tot_l4_payload_len":10240,"flow_dst_tot_l4_payload_len":5876,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.225","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":0,"flow_avg":0.0,"flow_max":0,"flow_stddev":0.0,"c_to_s_min":0,"c_to_s_avg":0.0,"c_to_s_max":0,"c_to_s_stddev":0.0,"s_to_c_min":0,"s_to_c_avg":0.0,"s_to_c_max":0,"s_to_c_stddev":0.0},"pktlen": {"c_to_s_min":138,"c_to_s_avg":724.7,"c_to_s_max":1374,"c_to_s_stddev":501.6,"s_to_c_min":122,"s_to_c_avg":387.6,"s_to_c_max":1374,"s_to_c_stddev":380.1}},"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
+01528{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":983,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":34,"flow_state":"finished","flow_src_packets_processed":15,"flow_dst_packets_processed":17,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1332,"flow_src_tot_l4_payload_len":10224,"flow_dst_tot_l4_payload_len":7128,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.195","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":0,"flow_avg":0.0,"flow_max":0,"flow_stddev":0.0,"c_to_s_min":0,"c_to_s_avg":0.0,"c_to_s_max":0,"c_to_s_stddev":0.0,"s_to_c_min":0,"s_to_c_avg":0.0,"s_to_c_max":0,"s_to_c_stddev":0.0},"pktlen": {"c_to_s_min":138,"c_to_s_avg":723.6,"c_to_s_max":1374,"c_to_s_stddev":501.1,"s_to_c_min":122,"s_to_c_avg":461.3,"s_to_c_max":1374,"s_to_c_stddev":438.3},"bins": {"c_to_s": [0,0,0,4,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0],"s_to_c": [0,0,2,0,6,0,3,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0]}},"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
+01529{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":1048,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"finished","flow_src_packets_processed":15,"flow_dst_packets_processed":17,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1332,"flow_src_tot_l4_payload_len":10240,"flow_dst_tot_l4_payload_len":5876,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.225","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":0,"flow_avg":0.0,"flow_max":0,"flow_stddev":0.0,"c_to_s_min":0,"c_to_s_avg":0.0,"c_to_s_max":0,"c_to_s_stddev":0.0,"s_to_c_min":0,"s_to_c_avg":0.0,"s_to_c_max":0,"s_to_c_stddev":0.0},"pktlen": {"c_to_s_min":138,"c_to_s_avg":724.7,"c_to_s_max":1374,"c_to_s_stddev":501.6,"s_to_c_min":122,"s_to_c_avg":387.6,"s_to_c_max":1374,"s_to_c_stddev":380.1},"bins": {"c_to_s": [0,0,0,4,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,1,1,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0],"s_to_c": [0,0,3,0,6,0,3,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0]}},"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
 00916{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1080,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"finished","flow_src_packets_processed":37,"flow_dst_packets_processed":53,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1332,"flow_src_tot_l4_payload_len":21676,"flow_dst_tot_l4_payload_len":34636,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.130","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
 00912{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1080,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"finished","flow_src_packets_processed":7,"flow_dst_packets_processed":8,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1028,"flow_src_tot_l4_payload_len":4720,"flow_dst_tot_l4_payload_len":2208,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.131","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
 00912{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1080,"source":"ipsec_isakmp_esp.pcap","alias":"nDPId-test","flow_id":26,"flow_state":"finished","flow_src_packets_processed":7,"flow_dst_packets_processed":8,"flow_first_seen":946763527783000,"flow_src_last_pkt_time":946763527783000,"flow_dst_last_pkt_time":946763527783000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":96,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1332,"flow_dst_max_l4_payload_len":1028,"flow_src_tot_l4_payload_len":4720,"flow_dst_tot_l4_payload_len":2208,"midstream":0,"thread_ts_usec":946763527783000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"109.237.187.226","src_port":14500,"dst_port":4500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"IPSec","proto_id":"79","encrypted":1,"breed":"Safe","category_id":2,"category":"VPN"}}
@@ -253,9 +253,9 @@
 ~~ total active/idle flows...: 36/36
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 6136097 bytes
-~~ total memory freed........: 6136097 bytes
-~~ total allocations/frees...: 122919/122919
+~~ total memory allocated....: 6140705 bytes
+~~ total memory freed........: 6140705 bytes
+~~ total allocations/frees...: 122991/122991
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 487 chars
 ~~ json string max len.......: 1619 chars