diff options
| author | Toni Uhlig <matzeton@googlemail.com> | 2021-05-13 15:37:33 +0200 |
|---|---|---|
| committer | Toni Uhlig <matzeton@googlemail.com> | 2021-05-13 15:41:24 +0200 |
| commit | da4942b41cf7c1346d55040f75df808a3fc528b8 (patch) | |
| tree | 861eb31d7a83fdfbabfc34e58d480a8667dceea5 /test/results/malware.pcap.out | |
| parent | 182867a07106b180e2b57f6aec6382a24bcdd531 (diff) | |
Use layer4 specific flow timeouts.
* default values "stolen" from nf_conntrack
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Diffstat (limited to 'test/results/malware.pcap.out')
| -rw-r--r-- | test/results/malware.pcap.out | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/test/results/malware.pcap.out b/test/results/malware.pcap.out index 7a43679f3..f3dea393c 100644 --- a/test/results/malware.pcap.out +++ b/test/results/malware.pcap.out @@ -1,4 +1,4 @@ -00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"malware.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} +00475{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"malware.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00464{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"malware.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1569571466977,"flow_last_seen":0,"flow_tot_l4_data_len":72,"flow_min_l4_data_len":72,"flow_max_l4_data_len":72,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.7.7","dst_ip":"1.1.1.1","src_port":42370,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00480{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"malware.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569571466,"pkt_ts_usec":977364,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"CGoKOl4eMFLLbJwbCABFAABcg9cAAEARLQnAqAcHAQEBAaWCADUASMoKC6QBIAABAAAAAAABA3d3dw9pbnRlcm5ldGJhZGd1eXMDY29tAAABAAEAACkQAAAAAAAADAAKAAjrBFAObfGpig=="} 00634{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"malware.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1569571466977,"flow_last_seen":0,"flow_tot_l4_data_len":72,"flow_min_l4_data_len":72,"flow_max_l4_data_len":72,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.7.7","dst_ip":"1.1.1.1","src_port":42370,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"www.internetbadguys.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} |