Added layer4 payload length bins.

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 6 insertions, 6 deletions

diff --git a/test/results/log4j-webapp-exploit.pcap.out b/test/results/log4j-webapp-exploit.pcap.out
index 9f018e9da..6f82c2194 100644
--- a/test/results/log4j-webapp-exploit.pcap.out
+++ b/test/results/log4j-webapp-exploit.pcap.out
@@ -28,7 +28,7 @@
 00345{"packet_event_id":1,"packet_event_name":"packet","packet_id":35,"source":"log4j-webapp-exploit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":44,"pkt_type":2054,"pkt_l3_offset":16,"pkt_l4_offset":0,"pkt_len":44,"pkt_l4_len":0,"thread_ts_usec":1639425815944860,"pkt":"AAAAAQAGAkJ2jzQWAAAIBgABCAAGBAABAkJ2jzQWrBDuAQAAAAAAAKwQ7go="}
 00200{"error_event_id":2,"error_event_name":"Unknown L3 protocol","datalink":113,"packet_id":36,"source":"log4j-webapp-exploit.pcap","alias":"nDPId-test","protocol":2054,"global_ts_usec":1639425820869752}
 00345{"packet_event_id":1,"packet_event_name":"packet","packet_id":36,"source":"log4j-webapp-exploit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":44,"pkt_type":2054,"pkt_l3_offset":16,"pkt_l4_offset":0,"pkt_len":44,"pkt_l4_len":0,"thread_ts_usec":1639425815944860,"pkt":"AAQAAQAGAkKsEO4KAAAIBgABCAAGBAACAkKsEO4KrBDuCgJCdo80FqwQ7gE="}
-01202{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":65,"source":"log4j-webapp-exploit.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_src_packets_processed":17,"flow_dst_packets_processed":15,"flow_first_seen":1639425815944677,"flow_src_last_pkt_time":1639425823295194,"flow_dst_last_pkt_time":1639425823295146,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":5,"flow_dst_max_l4_payload_len":3,"flow_src_tot_l4_payload_len":30,"flow_dst_tot_l4_payload_len":3,"midstream":0,"thread_ts_usec":1639425823295194,"l3_proto":"ip4","src_ip":"172.16.238.10","dst_ip":"10.10.10.31","src_port":55408,"dst_port":9001,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":46,"flow_avg":474225.3,"flow_max":7288582,"flow_stddev":1789599.0,"c_to_s_min":47,"c_to_s_avg":459407.3,"c_to_s_max":7288582,"c_to_s_stddev":1763345.8,"s_to_c_min":46,"s_to_c_avg":490031.3,"s_to_c_max":7288581,"s_to_c_stddev":1817051.4},"pktlen": {"c_to_s_min":68,"c_to_s_avg":70.2,"c_to_s_max":76,"c_to_s_stddev":2.0,"s_to_c_min":68,"s_to_c_avg":68.7,"s_to_c_max":76,"s_to_c_stddev":2.1}}}
+01430{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":65,"source":"log4j-webapp-exploit.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_src_packets_processed":17,"flow_dst_packets_processed":15,"flow_first_seen":1639425815944677,"flow_src_last_pkt_time":1639425823295194,"flow_dst_last_pkt_time":1639425823295146,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":5,"flow_dst_max_l4_payload_len":3,"flow_src_tot_l4_payload_len":30,"flow_dst_tot_l4_payload_len":3,"midstream":0,"thread_ts_usec":1639425823295194,"l3_proto":"ip4","src_ip":"172.16.238.10","dst_ip":"10.10.10.31","src_port":55408,"dst_port":9001,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":46,"flow_avg":474225.3,"flow_max":7288582,"flow_stddev":1789599.0,"c_to_s_min":47,"c_to_s_avg":459407.3,"c_to_s_max":7288582,"c_to_s_stddev":1763345.8,"s_to_c_min":46,"s_to_c_avg":490031.3,"s_to_c_max":7288581,"s_to_c_stddev":1817051.4},"pktlen": {"c_to_s_min":68,"c_to_s_avg":70.2,"c_to_s_max":76,"c_to_s_stddev":2.0,"s_to_c_min":68,"s_to_c_avg":68.7,"s_to_c_max":76,"s_to_c_stddev":2.1},"bins": {"c_to_s": [17,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"s_to_c": [15,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]}}}
 00814{"flow_event_id":9,"flow_event_name":"not-detected","thread_id":0,"packet_id":65,"source":"log4j-webapp-exploit.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_src_packets_processed":17,"flow_dst_packets_processed":15,"flow_first_seen":1639425815944677,"flow_src_last_pkt_time":1639425823295194,"flow_dst_last_pkt_time":1639425823295146,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":5,"flow_dst_max_l4_payload_len":3,"flow_src_tot_l4_payload_len":30,"flow_dst_tot_l4_payload_len":3,"midstream":0,"thread_ts_usec":1639425823295194,"l3_proto":"ip4","src_ip":"172.16.238.10","dst_ip":"10.10.10.31","src_port":55408,"dst_port":9001,"l4_proto":"tcp","ndpi": {"proto":"Unknown","proto_id":"0","encrypted":0,"breed":"Unrated"}}
 00771{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":395,"source":"log4j-webapp-exploit.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1639425834628601,"flow_src_last_pkt_time":1639425834628601,"flow_dst_last_pkt_time":1639425834628601,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1639425834628601,"l3_proto":"ip4","src_ip":"172.16.238.10","dst_ip":"172.16.238.11","src_port":57742,"dst_port":1389,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":3}
 00554{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":395,"source":"log4j-webapp-exploit.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_src_last_pkt_time":1639425834628601,"flow_dst_last_pkt_time":1639425834628601,"flow_idle_time":3285032704,"pkt_oversize":false,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"thread_ts_usec":1639425834628601,"pkt":"AAQAAQAGAkKsEO4KAAAIAEUAADxNdkAAQAa5DqwQ7gqsEO4L4Y4FbXfaWIQAAAAAoAJyEDRmAAACBAW0BAIICvIpXGkAAAAAAQMDBw=="}
@@ -61,10 +61,10 @@
 ~~ total active/idle flows...: 7/7
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 6066575 bytes
-~~ total memory freed........: 6066575 bytes
-~~ total allocations/frees...: 121991/121991
+~~ total memory allocated....: 6067471 bytes
+~~ total memory freed........: 6067471 bytes
+~~ total allocations/frees...: 122005/122005
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 204 chars
-~~ json string max len.......: 1337 chars
-~~ json string avg len.......: 770 chars
+~~ json string max len.......: 1435 chars
+~~ json string avg len.......: 818 chars