diff options
| author | Toni Uhlig <matzeton@googlemail.com> | 2021-05-20 14:55:05 +0200 |
|---|---|---|
| committer | Toni Uhlig <matzeton@googlemail.com> | 2021-05-20 14:55:05 +0200 |
| commit | 9a1c2d0ea731724edfaca97195c87569e4321681 (patch) | |
| tree | d1371082f38a429a2c491ef918ed2a963936bc9a /test/results/nest_log_sink.pcap.out | |
| parent | db39772aa7b10ee6fb9e21db8f44c0f5fca7a1d2 (diff) | |
Reworked layer 4 flow length naming/calculation.
* nDPIsrvd services usually do not care about layer4 data length,
payload length is quite more essential for further processing
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Diffstat (limited to 'test/results/nest_log_sink.pcap.out')
| -rw-r--r-- | test/results/nest_log_sink.pcap.out | 122 |
1 files changed, 61 insertions, 61 deletions
diff --git a/test/results/nest_log_sink.pcap.out b/test/results/nest_log_sink.pcap.out index 3b6efa1b7..3980c8d16 100644 --- a/test/results/nest_log_sink.pcap.out +++ b/test/results/nest_log_sink.pcap.out @@ -1,5 +1,5 @@ 00481{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"nest_log_sink.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} -00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1536712992228,"flow_last_seen":0,"flow_tot_l4_data_len":20,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63340,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1536712992228,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63340,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00421{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536712992,"pkt_ts_usec":228658,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoL2IAAP8GYxrAqPIPI65S7fdsK1cIqL8\/xIBhhVAQD+Vl6gAAAAAAAAAA"} 00414{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536712992,"pkt_ts_usec":289465,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAoNpRAAC0G7egjrlLtwKjyDytX92zEgGGFCKi\/QFAQgdDz\/QAA"} 00421{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536713052,"pkt_ts_usec":295189,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoL2MAAP8GYxnAqPIPI65S7fdsK1cIqL8\/xIBhhVAQD+Vl6gAAAAAAAAAA"} @@ -15,12 +15,12 @@ 00421{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536713233,"pkt_ts_usec":3980,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoL2gAAP8GYxTAqPIPI65S7fdsK1cIqL8\/xIBhhVAQD+Vl6gAAAAAAAAAA"} 00415{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536713233,"pkt_ts_usec":69799,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAoNppAAC0G7eIjrlLtwKjyDytX92zEgGGFCKi\/QFAQgdDz\/QAA"} 00422{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":25,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536713293,"pkt_ts_usec":69829,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoL2kAAP8GYxPAqPIPI65S7fdsK1cIqL8\/xIBhhVAQD+Vl6gAAAAAAAAAA"} -00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":133,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1536714602587,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":133,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1536714602587,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00454{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":133,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714602,"pkt_ts_usec":587299,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AJD7JidrGLQwJjRACABFAABEL4kAAP8RJr3AqPIPwKjyAc5xADUAMKk+CwgBAAABAAAAAAAADXdlYXZlLWxvZ3NpbmsEbmVzdANjb20AAAEAAQ=="} -00650{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":133,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1536714602587,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00662{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":133,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1536714602587,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00474{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":134,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714602,"pkt_ts_usec":587655,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"GLQwJjRAAJD7JidrCABFAABUsrpAAEARInzAqPIBwKjyDwA1znEAQGW0CwiBgAABAAEAAAAADXdlYXZlLWxvZ3NpbmsEbmVzdANjb20AAAEAAcAMAAEAAQAAAHgABCO8mro="} -00678{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":134,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1536714602587,"flow_last_seen":1536714602587,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.188.154.186"}} -00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":135,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1536714602612,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63342,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00689{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":134,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1536714602587,"flow_last_seen":1536714602587,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.188.154.186"}} +00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":135,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1536714602612,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63342,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00422{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":135,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714602,"pkt_ts_usec":612148,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"AJD7JidrGLQwJjRACABFAAAsL4oAAP8GGxPAqPIPI7yauvduK1cIvyQjAAAAAGACEgDGgwAAAgQEgAAA"} 00422{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":136,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714602,"pkt_ts_usec":681891,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"GLQwJjRAAJD7JidrCABFAAAsAABAADcG0p0jvJq6wKjyDytX927RT8zNCL8kJGASbvDKWAAAAgQFjA=="} 00423{"flow_id":3,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":137,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714602,"pkt_ts_usec":684345,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoL4sAAP8GGxbAqPIPI7yauvduK1cIvyQk0U\/MzlAQEgA+3gAAAAAAAAAA"} @@ -29,7 +29,7 @@ 01337{"flow_id":3,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":140,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714603,"pkt_ts_usec":395466,"pkt_caplen":733,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":733,"pkt_l4_len":699,"pkt":"GLQwJjRAAJD7JidrCABFAALPlUFAADcGOrkjvJq6wKjyDytX927RT8zOCL8mN1AYcRA2LQAApQIAE+inhmUEAAAAAjC0GDaeJwAAMLQYEAuJBgQAAACAOewBAAAE1eqO6tFgJ8AIXh5psw2DCMq76LkjRD2vYa6z1dUZEOqMUt\/ZJujFBDmnEEUyfvfyYh8z+bHwyirVAAAEAAcANQEwAQgMb9c+DCmBkiQCBDcDJxMDAAAA7jC0GBgmBACuiCMmBf8bcyU3BicSBAAAAAIwtBgYJAcCJgglAFojMAo5BOmClNa2L\/0sqyhn7IYa235P1xw1ad7owBLnP8rLfG3TPA0dBMXfrzKvqAFyJ47sRlQQr3qOkdAiNYMpARg1gikBJAIFGDWEKQE2AgQCBAEYGDWBMAIIT2JdLEIid9IYNYAwAghAMCqAESxXYxg1DDABHQD2qSsI\/n0hou9Llf5n3GEbVWuc4D0QHq+l2F+wMAIcbFFqzYrI2WIn6D35aDg1LAuu7NZYbZZk\/HdXyxgYNwPVAAAEAAEAMAEIdFPE8yV1wKQkAgQ3AycTAQAAAO4wtBgYJgSEShYaJgWECPtJNwYnEwMAAADuMLQYGCQHAiYIJQBaIzAKOQRhOKp73vZWzVBkzcIvC7VHSn7kjE4w+wzb4SgMSIJb6yR4pk2B0279JwA\/5iu\/0TQlBvq00DFAwzWDKQEpAhg1gikBJAJgGDWBMAIIQDAqgBEsV2MYNYAwAghDNPcS31+Rzxg1DDABHBLqxXlajT9KXWeBN+P8uG5pHU6a1vmo\/i33mMIwAh0AjB981V9gPTa1niPXvZ7CDdMfpHD9c+6sh9daGBgYGBjVAAAEAAgAMAEdAN5aALpwkycqH\/YdOvHUT\/yVpCuhOcfm\/\/PB0PwwAh0AyCvly7jcU\/KMtvN+jWSuMwUvJy7ARWKm5jcDDhhgGOFkeu8NGMrAorHGRgsA7uWf3A=="} 00423{"flow_id":3,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":141,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714603,"pkt_ts_usec":430818,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoL40AAP8GGxTAqPIPI7yauvduK1cIvyY30U\/PdVAQD1k8ywAAAAAAAAAA"} 00490{"flow_id":3,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":142,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714604,"pkt_ts_usec":778211,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"AJD7JidrGLQwJjRACABFAABcL44AAP8GGt\/AqPIPI7yauvduK1cIvyY30U\/PdVAYD1n0VgAAMgAAEwkDAAA2nicAADC0GAQAAAACMLQYEQyJBgQAAABSDhPagk9XmQBuC4ZSQzWHZRVqOg=="} -00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":142,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":8,"flow_first_seen":1536714602612,"flow_last_seen":1536714604778,"flow_tot_l4_data_len":1430,"flow_min_l4_data_len":20,"flow_max_l4_data_len":699,"flow_avg_l4_data_len":178,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63342,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink.Google","breed":"Tracker\/Ads","category":"Cloud"}} +00558{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":142,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":8,"flow_first_seen":1536714602612,"flow_last_seen":1536714604778,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":679,"flow_tot_l4_payload_len":1262,"flow_avg_l4_payload_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63342,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink.Google","breed":"Tracker\/Ads","category":"Cloud"}} 00414{"flow_id":3,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":143,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714604,"pkt_ts_usec":886052,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAolUJAADcGPV8jvJq6wKjyDytX927RT891CL8ma1AQcRDa3wAA"} 00515{"flow_id":3,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":144,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714604,"pkt_ts_usec":896253,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":124,"pkt_l4_len":90,"pkt":"AJD7JidrGLQwJjRACABFAABuL48AAP8GGszAqPIPI7yauvduK1cIvyZr0U\/PdVAYD1kVPAAARAAQEwAAAAA2nicAADC0GAQAAAACMLQY6iCycpbj9YM8qGb2p6tfYGLfO+vxpb53yieUogkX8401cGq\/HaLsjzCpjScgmg=="} 00415{"flow_id":3,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":145,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714604,"pkt_ts_usec":970342,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAolUNAADcGPV4jvJq6wKjyDytX927RT891CL8msVAQcRDamQAA"} @@ -38,10 +38,10 @@ 00493{"flow_id":3,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":148,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714605,"pkt_ts_usec":50668,"pkt_caplen":109,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":109,"pkt_l4_len":75,"pkt":"GLQwJjRAAJD7JidrCABFAABflUVAADcGPSUjvJq6wKjyDytX927RT8+uCL8oeFAYdUCNTwAANQAQEwEAAAAEAAAAAjC0GDaeJwAAMLQY6iB\/nMaYKMhAMXFY8tf+nXZnAd+GsL71CIlQg1iAyQ=="} 01033{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":149,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714605,"pkt_ts_usec":67899,"pkt_caplen":509,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":509,"pkt_l4_len":475,"pkt":"AJD7JidrGLQwJjRACABFAAHvL5EAAP8GGUnAqPIPI7yauvduK1cIvyh40U\/P5VAYDulidwAAxQEQEwIAAAA2nicAADC0GAQAAAACMLQY6iAA89deN58agw11Q9KAWO5TKWF97Op9jU7Fez\/h+kyit712ws7GLqSLnOdEAHl8PktY68PGo+6kAl+CRqHpxOV8\/YdJ5eW0k6bYIMA0gfnjGd7Xeknv2TToFGAzE8lK5Riib\/esK6ZHuPP9cO+6Czubos3cXJnhThAZY4wHUh6JqxqVKkkdemm9SY+xL0WeB9aLuANFzoxe9Tjgcjk\/DbaghMuhbX4jxe8zkKZgoU6mdgskbubNCtoITO4fS4KFPWq\/k7L5a5ifCMzHWEIgcDf2KVzacI4oMGPn6wwNTd5RvTB9uggviK7FpZw4nEgjWpCQHHMg2qJIRVx04YCkiY1mitkVqJnrEYnHYAfeVOJue5LiWSS7MKvyJqXcK0qlpusjl9UYgVZNKiSHL1HwM9nuyF1XsKHr41yfgiY7vTLUB3kbufA9XA6a3\/Lers1qdh6qBadlGYLi73JuUrYUzsC9xmMCsAYtzzQbVugSDihgOuL7j5DUu0lRViYc4WqCloHDEPr+CFuoy84gGJAiKmMc4OB7VrCRjKZI\/RxTGBy+eQCY7Mrb8TrxyNb350Y="} 00480{"flow_id":2,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":211,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714607,"pkt_ts_usec":328073,"pkt_caplen":101,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":101,"pkt_l4_len":67,"pkt":"AJD7JidrGLQwJjRACABFAABXL7IAAP8RJoHAqPIPwKjyAc5xADUAQyQGbMYBAAABAAAAAAAAB2N6ZmUxMDUHZnJvbnQwMQVpYWQwMQpwcm9kdWN0aW9uBG5lc3QDY29tAAABAAE="} -00697{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":211,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_first_seen":1536714602587,"flow_last_seen":1536714607328,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":48,"flow_max_l4_data_len":67,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"czfe105.front01.iad01.production.nest.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.188.154.186"}} +00709{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":211,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_first_seen":1536714602587,"flow_last_seen":1536714607328,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":155,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"czfe105.front01.iad01.production.nest.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.188.154.186"}} 00574{"flow_id":2,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":213,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714607,"pkt_ts_usec":527675,"pkt_caplen":169,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":169,"pkt_l4_len":135,"pkt":"GLQwJjRAAJD7JidrCABFAACbt7BAAEARHT\/AqPIBwKjyDwA1znEAh2X7bMaBgAABAAIAAAAAB2N6ZmUxMDUHZnJvbnQwMQVpYWQwMQpwcm9kdWN0aW9uBG5lc3QDY29tAAABAAHADAAFAAEAAAB4ACgRZWMyLTM1LTE3NC04Mi0yMzcJY29tcHV0ZS0xCWFtYXpvbmF3c8AywEcAAQABAAj0MQAEI65S7Q=="} -00697{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":213,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":1536714602587,"flow_last_seen":1536714607527,"flow_tot_l4_data_len":314,"flow_min_l4_data_len":48,"flow_max_l4_data_len":135,"flow_avg_l4_data_len":78,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"czfe105.front01.iad01.production.nest.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.174.82.237"}} -00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":214,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1536714607530,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63343,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00709{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":213,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":1536714602587,"flow_last_seen":1536714607527,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":127,"flow_tot_l4_payload_len":282,"flow_avg_l4_payload_len":70,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"czfe105.front01.iad01.production.nest.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.174.82.237"}} +00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":214,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1536714607530,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63343,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00422{"flow_id":4,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":214,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714607,"pkt_ts_usec":530778,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"AJD7JidrGLQwJjRACABFAAAsL7MAAP8GYsXAqPIPI65S7fdvK1cIymiPAAAAAGACEgDJ5gAAAgQEgAAA"} 00424{"flow_id":4,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":215,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714607,"pkt_ts_usec":594881,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"GLQwJjRAAJD7JidrCABFAAAsAABAAC0GJHkjrlLtwKjyDytX92+qr\/jxCMpokGASaQPN\/AAAAgQFtA=="} 00423{"flow_id":4,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":216,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714607,"pkt_ts_usec":597463,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoL7QAAP8GYsjAqPIPI65S7fdvK1cIymiQqq\/48lAQEgA8vQAAAAAAAAAA"} @@ -50,7 +50,7 @@ 01330{"flow_id":4,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":221,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714608,"pkt_ts_usec":322352,"pkt_caplen":731,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":731,"pkt_l4_len":697,"pkt":"GLQwJjRAAJD7JidrCABFAALNshxAAC0Gb7sjrlLtwKjyDytX92+qr\/jyCMpqo1AYbOAz4gAAowIAEwoDAAADAAAAAjC0GDaeJwAAMLQYEAuMBgQAAACAOesBAAAELxkCOpUk3uy8tjDNAAuhgChFUxfA2vMHDvxRK8RkG2ehEGOpWF1dXBUUn+wXNbBmIJ8tTSs8KarVAAAEAAcANQEwAQgRAGNdWXuZjyQCBDcDJxMDAAAA7jC0GBgmBACuiCMmBf8bcyU3BicSAwAAAAIwtBgYJAcCJgglAFojMAo5BAmqnD2bjDiK3yLVcr2LQ\/iPmlWn\/iDHinq\/pRMoxaNQgTnwimtBL+qTiTQqENL2xrPIWxZjJGeRNYMpARg1gikBJAIFGDWEKQE2AgQCBAEYGDWBMAIISKnh4YvR26oYNYAwAghAMCqAESxXYxg1DDABHG7LEaIGSLUc\/M2D6faSCjZ4yyUajbt6l0larAowAhxg27mtYz94ldNAgb53O7UEnNbhJ3tZG9saSNIDGBg3A9UAAAQAAQAwAQh0U8TzJXXApCQCBDcDJxMBAAAA7jC0GBgmBIRKFhomBYQI+0k3BicTAwAAAO4wtBgYJAcCJgglAFojMAo5BGE4qnve9lbNUGTNwi8LtUdKfuSMTjD7DNvhKAxIglvrJHimTYHTbv0nAD\/mK7\/RNCUG+rTQMUDDNYMpASkCGDWCKQEkAmAYNYEwAghAMCqAESxXYxg1gDACCEM09xLfX5HPGDUMMAEcEurFeVqNP0pdZ4E34\/y4bmkdTprW+aj+LfeYwjACHQCMH3zVX2A9NrWeI9e9nsIN0x+kcP1z7qyH11oYGBgYGNUAAAQACAAwARx5YESorapP08hibcedkN2eOjDgOBaISDVA9wstMAIdAOPH+3W2IELswI+d+cqdLaBkMHT8uk0uErxNjNcY8LTewGcJqRXUzAk4GDxDwRRx\/7Y="} 00423{"flow_id":4,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":222,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714608,"pkt_ts_usec":437591,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoL7YAAP8GYsbAqPIPI65S7fdvK1cIymqjqq\/7l1AQD1s6qgAAAAAAAAAA"} 00490{"flow_id":4,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":223,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714609,"pkt_ts_usec":684326,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"AJD7JidrGLQwJjRACABFAABcL7cAAP8GYpHAqPIPI65S7fdvK1cIymqjqq\/7l1AYD1vWbQAAMgAAEwsDAAA2nicAADC0GAMAAAACMLQYEQyMBgQAAACLjUe26FhRK2Su+3Sh50H2S\/Id7A=="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":223,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":8,"flow_first_seen":1536714607530,"flow_last_seen":1536714609684,"flow_tot_l4_data_len":1428,"flow_min_l4_data_len":20,"flow_max_l4_data_len":697,"flow_avg_l4_data_len":178,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63343,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink","breed":"Acceptable","category":"Cloud"}} +00548{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":223,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":8,"flow_first_seen":1536714607530,"flow_last_seen":1536714609684,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":677,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63343,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink","breed":"Acceptable","category":"Cloud"}} 00415{"flow_id":4,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":224,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714609,"pkt_ts_usec":785592,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAosh1AAC0Gcl8jrlLtwKjyDytX92+qr\/uXCMpq11AQbODc8AAA"} 00972{"flow_id":4,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":225,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714609,"pkt_ts_usec":789236,"pkt_caplen":458,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":458,"pkt_l4_len":424,"pkt":"AJD7JidrGLQwJjRACABFAAG8L7gAAP8GYTDAqPIPI65S7fdvK1cIymrXqq\/7l1AYD1toiwAAkgEQEwAAAAA2nicAADC0GAMAAAACMLQY+yFvRoNQ2dkGy6I8iUccaFHG\/UCpXikww7SDHb739iQFS9lPpNuK3rDH30szkJGD8W4c39P7LVpHPqLDJ0VO71my2SGrJ5d8z695S9ltRcFl98CKffif2N0gS8J\/JF13LEZtM22rvLbfEmxmrSTtoqwesj19aUYF5Pn+27b3zoZZv\/+QrUdRTipd3293LdeKCD5QTcvMzYtE9EwAcVdh\/SQCFrHQaL7LZtPBemiwC9zxKF2X2GTvac8YQTrFL2Ttd1vjlh+S\/6qn6i9jKPAgWws11mNqIedDdJCDYQD\/z+rOXIST5wPNGi+ONf\/XsB1KOmukrqjutcpnG6Ut6bemYi\/wTw\/vZyUEPVfrWBU2isBfQ+iOAvuHhO6UmLGaCerNE7GZuIVmASakuWScj8RRDxKDS8M1t4b8fmqcJUJRWk650H\/rop0hIUZrkX7758AcVyqKunr4Ad5GfWd5v\/aThq8TuWOZk\/ZThkIHPmzLuaqVQBDMUY\/fO7HGHQ4="} 00416{"flow_id":4,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":226,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714609,"pkt_ts_usec":855031,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAosh5AAC0Gcl4jrlLtwKjyDytX92+qr\/uXCMpsa1AQcRDXLAAA"} @@ -58,7 +58,7 @@ 00585{"flow_id":4,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":228,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714609,"pkt_ts_usec":883943,"pkt_caplen":176,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":176,"pkt_l4_len":142,"pkt":"AJD7JidrGLQwJjRACABFAACiL7kAAP8GYknAqPIPI65S7fdvK1cIymxrqq\/701AYDx9gXwAAeAAQEwEAAAA2nicAADC0GAMAAAACMLQY+yHq8Hj1RzfgRN3XTu0+CiEKTy6+IzsA+mU6qvgBBUGVq3W78i5YloI79fuBd0YFwMzvdhnYb7vbqINLTsbYAHyNdClS55D32zHd4eHou\/xLB34fZkfI+mh+OB7vzJ\/vTPU="} 01275{"flow_id":4,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":229,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714609,"pkt_ts_usec":948271,"pkt_caplen":683,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":683,"pkt_l4_len":649,"pkt":"GLQwJjRAAJD7JidrCABFAAKdsiBAAC0Gb+cjrlLtwKjyDytX92+qr\/vTCMps5VAYcRColAAAcwIQEwEAAAADAAAAAjC0GDaeJwAAMLQY+yF5gSMY5j0IRomX+JCupCk+ve5lJYBi5D7VXnN7yVh9WHY40fMHjsqX5vrgg7qCzOb3S7+s3MTpPrGcIcVehoh0hNE\/AUh\/l05LIJcfsYEUayujDOVQKSljRpx5pGdv3dngLjYDnAr+L4Ha13T3Du3LWCR0P670Xeu9JdPkJfYH+zEGsJQ+2VbZjZXJX5fdNzKoWqycH7dGyCw2ac1\/iOMgwCNM7ba8sSyJnWE4r1SzIBIR1InIILVl1F4DglLIcY9ku9DTMXpi\/hZ2YRM9SdkPLe2UuM1DK6JKV6VuRBixRswGUn+jIRDzdkahkt7pyJgLKPaJdZ+fjcxWD\/8NIzc08afSf18XAgPDcQkKOKfxxB0i6WLR0QUKBFugdRgIQiKn6rNIHdsMKAzlaqvmI0Ac8LbTXoe6+U56JKHvMdVKTlB\/G6lDcqoYVrw+6WzTUfhzse\/hxqHjCfVIv46PtZr5wJBElba\/NuPvH5MTYXLhPfopbHFO0E+984emZYu\/6gdyMYjERy7ehecQCvEa\/gPNJuvt4D+WU6vh+iboJi245pEDd4P8EcCv81b0FNLNGkdfqX0BDMnofBVXA6wcO85ZdCEuvj+BMPm9S7ttt5zK0K1BuVL8EYaYj9OIrlp8+yxkRFg9etPwjIpPjb4y\/CewBUWAbv9tBaY6xQge\/xgkq+RJG3WYbazKLOC3hmWFDk0b4GwzSW+A2t\/Ri+9DCUggDMHw\/FglQSdpXOk6X5GqSuq9\/1GuBHnpRmsBRnhFrYEq1k2eq6QvJ1VlEobomVL5KDvX\/cKzW1+i8k8="} 00424{"flow_id":4,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":230,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714609,"pkt_ts_usec":962073,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoL7oAAP8GYsLAqPIPI65S7fdvK1cIymzlqq\/+SFAQEgAzEgAAAAAAAAAA"} -00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":237,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1536714610253,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63344,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":237,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1536714610253,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63344,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00423{"flow_id":5,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":237,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714610,"pkt_ts_usec":253460,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"AJD7JidrGLQwJjRACABFAAAsL74AAP8GGt\/AqPIPI7yauvdwK1cI1a0HAAAAAGACEgA9hwAAAgQEgAAA"} 00422{"flow_id":5,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":238,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714610,"pkt_ts_usec":314466,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"GLQwJjRAAJD7JidrCABFAAAsAABAADcG0p0jvJq6wKjyDytX93Bcs3xVCNWtCGASbvAGcQAAAgQFjA=="} 00422{"flow_id":5,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":239,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714610,"pkt_ts_usec":318069,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoL78AAP8GGuLAqPIPI7yauvdwK1cI1a0IXLN8VlAQEgB69gAAAAAAAAAA"} @@ -66,7 +66,7 @@ 01131{"flow_id":5,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":244,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714613,"pkt_ts_usec":670783,"pkt_caplen":584,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":584,"pkt_l4_len":550,"pkt":"AJD7JidrGLQwJjRACABFAAI6L8MAAP8GGMzAqPIPI7yauvdwK1cI1a0IXLN8VlAYEgD6igAAEAIAEwwDAAA2nicAADC0GAQAAAACMLQYEQqSBgQAAACBAAA5+ABtAAEAWiMlAFojiiIEtkbpjQUSHUoTcWkXUWM9lVbNsoOuvfFUxmbNPsGiW\/wq5UMDWDxf2nPoFbYobKpXR6vLhI5RzviVBwA1ATABCGRioUb7JdsYJAIENwMnEwIAAADuMLQYGCYEvBKUGiYFvF68LTcGJxE2nicAADC0GBgkBwImCCUAWiMwCjkEJgNHeyfLyn8+Y4Q3KJESv6T1UZ7ximwyz0BZXSER6iqTRHr3ZzL\/QcomumvZXRQgQXcoi+vhk5Y1gykBGDWCKQEkAgUYNYQpATYCBAIEARgYNYEwAghG1Bj5qiAzNBg1gDACCE3B2i1iGUvgGDUMMAEdAIXDdHE3JrfWlel2eYaefOia8kf6YmRIxz7Xgq0wAh0Aqggyqhbk0\/a8FDNnwqqs7hWaOpuNhfC6EutljBgYGNUAAA4AAQAlAFojJAEFJAILJQMykCwEEDA1Q0EwMkFDNDQxNDAyOEYwBQgYtDAAACeeNjAGBhi0MCYAACwHCU5FU1QtOUUzNicKNp4nAAAwtBgnC4vxg94wk5+2LAkIMy4xLjRyYzMkDAEpZRiVCAAwARwghzo4rL9IB318LIxg\/LAqaKcA4fCuRscnp+mWMAIcBgUkZfHumFcJND3j932Gu2OJyi6\/7A8Wmb\/nLRg="} 00414{"flow_id":5,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":245,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714613,"pkt_ts_usec":725020,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAosHFAADcGIjAjvJq6wKjyDytX93Bcs3xWCNWvGlAQcRAZ1AAA"} 01329{"flow_id":5,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":246,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714613,"pkt_ts_usec":730371,"pkt_caplen":732,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":732,"pkt_l4_len":698,"pkt":"GLQwJjRAAJD7JidrCABFAALOsHJAADcGH4kjvJq6wKjyDytX93Bcs3xWCNWvGlAYcRAWxwAApAIAE\/507mEEAAAAAjC0GDaeJwAAMLQYEAuSBgQAAACAOewBAAAE7RjXefZ3jl2B73CKyAyp+gzqVRgqLcUisbaa+bAUHTxA+Y+sJXjb9B8VtxsX4AN2V9hwRU+nHa\/VAAAEAAcANQEwAQgMb9c+DCmBkiQCBDcDJxMDAAAA7jC0GBgmBACuiCMmBf8bcyU3BicSBAAAAAIwtBgYJAcCJgglAFojMAo5BOmClNa2L\/0sqyhn7IYa235P1xw1ad7owBLnP8rLfG3TPA0dBMXfrzKvqAFyJ47sRlQQr3qOkdAiNYMpARg1gikBJAIFGDWEKQE2AgQCBAEYGDWBMAIIT2JdLEIid9IYNYAwAghAMCqAESxXYxg1DDABHQD2qSsI\/n0hou9Llf5n3GEbVWuc4D0QHq+l2F+wMAIcbFFqzYrI2WIn6D35aDg1LAuu7NZYbZZk\/HdXyxgYNwPVAAAEAAEAMAEIdFPE8yV1wKQkAgQ3AycTAQAAAO4wtBgYJgSEShYaJgWECPtJNwYnEwMAAADuMLQYGCQHAiYIJQBaIzAKOQRhOKp73vZWzVBkzcIvC7VHSn7kjE4w+wzb4SgMSIJb6yR4pk2B0279JwA\/5iu\/0TQlBvq00DFAwzWDKQEpAhg1gikBJAJgGDWBMAIIQDAqgBEsV2MYNYAwAghDNPcS31+Rzxg1DDABHBLqxXlajT9KXWeBN+P8uG5pHU6a1vmo\/i33mMIwAh0AjB981V9gPTa1niPXvZ7CDdMfpHD9c+6sh9daGBgYGBjVAAAEAAgAMAEdAMVvQ5XlZmGV8QhBhrEA8Y7CKqvTkjoh+ef40ggwAhwVsCu21ub6wpZoRKcG76sWQ+LVYuExLwECJdGJGJcwYthZZrcq6RR30WEt7wyo86zw"} -00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":246,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":7,"flow_first_seen":1536714610253,"flow_last_seen":1536714613730,"flow_tot_l4_data_len":1886,"flow_min_l4_data_len":20,"flow_max_l4_data_len":698,"flow_avg_l4_data_len":269,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63344,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink.Google","breed":"Tracker\/Ads","category":"Cloud"}} +00558{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":246,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":7,"flow_first_seen":1536714610253,"flow_last_seen":1536714613730,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":678,"flow_tot_l4_payload_len":1738,"flow_avg_l4_payload_len":248,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63344,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink.Google","breed":"Tracker\/Ads","category":"Cloud"}} 00423{"flow_id":5,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":247,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714613,"pkt_ts_usec":917860,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoL8QAAP8GGt3AqPIPI7yauvdwK1cI1a8aXLN+\/FAQD1p45AAAAAAAAAAA"} 00490{"flow_id":5,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":248,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714615,"pkt_ts_usec":108363,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"AJD7JidrGLQwJjRACABFAABcL8UAAP8GGqjAqPIPI7yauvdwK1cI1a8aXLN+\/FAYD1qDHQAAMgAAEw0DAAA2nicAADC0GAQAAAACMLQYEQySBgQAAABV\/Z6UAgToaUwXoNzLJI2S7W4xGA=="} 00415{"flow_id":5,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":249,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714615,"pkt_ts_usec":208732,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAosHNAADcGIi4jvJq6wKjyDytX93Bcs378CNWvTlAQcRAW+gAA"} @@ -75,17 +75,17 @@ 00493{"flow_id":5,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":252,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714615,"pkt_ts_usec":264339,"pkt_caplen":111,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":111,"pkt_l4_len":77,"pkt":"GLQwJjRAAJD7JidrCABFAABhsHVAADcGIfMjvJq6wKjyDytX93Bcs378CNWvlFAYcRByXQAANwAQEwAAAAAEAAAAAjC0GDaeJwAAMLQYiiJFUuzMNx8DflOVuOBBLLPLGfrP53rbJB3Obto1XgYJ"} 01036{"flow_id":5,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":253,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714615,"pkt_ts_usec":278043,"pkt_caplen":509,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":509,"pkt_l4_len":475,"pkt":"AJD7JidrGLQwJjRACABFAAHvL8cAAP8GGRPAqPIPI7yauvdwK1cI1a+UXLN\/NVAYDyEJxgAAxQEQEwEAAAA2nicAADC0GAQAAAACMLQYiiI+CssXNgbbOI5KRBlPV+ckmqQY3DK8\/LWnnr+HRKdGl+smZnROwwJpA\/10vbLaoApT4ab9eVEX4GDtWp\/O6sMXDpatNrda+Ox0c7122U2yulciv0wBRa1Q3Et904JxeZAKiz9brEeeyimZQnBvgQ0i9aufaup2bP0SHllfcVNot+eteqTXxPzVw7QEm\/X8x\/26iPbtORYjheueLOW2rEKowcxo5t4YmkgDd7FQJy24Q1PzXxE+HhYeXeLrYiUYVbfZdCN8UVk\/RSOLdfqLUnus+Ij6FtDDpwnbcj9QO\/0QjlTxJV04mNR1221RikjMGZX0NYa6NzTyJab\/sXnsv19mzVjim5U+3oDuFF4ym3MgwGRna96YPvBXJyIzPDR3NYrmUobCHurLrdJCf7djF+vcEvAD9CAmdNNSQ2kTPYZQnW3DttK8S2Zmrk7tlKNbXFLblr1t7PnQPzOuwIGjsY9XduMdsIX2QIBIp1pSv0M0Vsy32SGVR+pppogfAMsiQnNZz5d6Vzs\/dPqWkLyhe+1+Z+XUQbJsoEs6o9PX7M+BsyUL6Onfo+lnKXZOHE0="} 00494{"flow_id":5,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":254,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536714615,"pkt_ts_usec":328350,"pkt_caplen":109,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":109,"pkt_l4_len":75,"pkt":"GLQwJjRAAJD7JidrCABFAABfsHZAADcGIfQjvJq6wKjyDytX93Bcs381CNWxW1AYdUBgWAAANQAQEwEAAAAEAAAAAjC0GDaeJwAAMLQYiiJJQiz+L96IV3SFOxiBSZcbP\/mbp23+qRRvM0Emeg=="} -00535{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":268,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":83,"flow_first_seen":1536712992228,"flow_last_seen":1536714607385,"flow_tot_l4_data_len":1722,"flow_min_l4_data_len":20,"flow_max_l4_data_len":82,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63340,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink","breed":"Acceptable","category":"Cloud"}} -00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":268,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":83,"flow_first_seen":1536712992228,"flow_last_seen":1536714607385,"flow_tot_l4_data_len":1722,"flow_min_l4_data_len":20,"flow_max_l4_data_len":82,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63340,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":268,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":72,"flow_first_seen":1536714602612,"flow_last_seen":1536714607322,"flow_tot_l4_data_len":16279,"flow_min_l4_data_len":20,"flow_max_l4_data_len":699,"flow_avg_l4_data_len":226,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63342,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":274,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":1536714602587,"flow_last_seen":1536714607527,"flow_tot_l4_data_len":314,"flow_min_l4_data_len":48,"flow_max_l4_data_len":135,"flow_avg_l4_data_len":78,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":274,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":21,"flow_first_seen":1536714610253,"flow_last_seen":1536714615546,"flow_tot_l4_data_len":3214,"flow_min_l4_data_len":20,"flow_max_l4_data_len":698,"flow_avg_l4_data_len":153,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63344,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":406,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1536716402804,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00543{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":268,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":83,"flow_first_seen":1536712992228,"flow_last_seen":1536714607385,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":62,"flow_tot_l4_payload_len":62,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63340,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink","breed":"Acceptable","category":"Cloud"}} +00507{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":268,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":83,"flow_first_seen":1536712992228,"flow_last_seen":1536714607385,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":62,"flow_tot_l4_payload_len":62,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63340,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":268,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":72,"flow_first_seen":1536714602612,"flow_last_seen":1536714607322,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":679,"flow_tot_l4_payload_len":14831,"flow_avg_l4_payload_len":205,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63342,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":274,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":1536714602587,"flow_last_seen":1536714607527,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":127,"flow_tot_l4_payload_len":282,"flow_avg_l4_payload_len":70,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":274,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":21,"flow_first_seen":1536714610253,"flow_last_seen":1536714615546,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":678,"flow_tot_l4_payload_len":2786,"flow_avg_l4_payload_len":132,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63344,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":406,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1536716402804,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00456{"flow_id":6,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":406,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716402,"pkt_ts_usec":804764,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AJD7JidrGLQwJjRACABFAABEL\/cAAP8RJk\/AqPIPwKjyAc5xADUAMDxpd90BAAABAAAAAAAADXdlYXZlLWxvZ3NpbmsEbmVzdANjb20AAAEAAQ=="} -00650{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":406,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1536716402804,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00662{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":406,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1536716402804,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00474{"flow_id":6,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":407,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716402,"pkt_ts_usec":805070,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"GLQwJjRAAJD7JidrCABFAABUcEtAAEARZOvAqPIBwKjyDwA1znEAQGW0d92BgAABAAEAAAAADXdlYXZlLWxvZ3NpbmsEbmVzdANjb20AAAEAAcAMAAEAAQAAAHgABCO8mro="} -00678{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":407,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1536716402804,"flow_last_seen":1536716402805,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.188.154.186"}} -00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":408,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1536716402828,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63345,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00689{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":407,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1536716402804,"flow_last_seen":1536716402805,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.188.154.186"}} +00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":408,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1536716402828,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63345,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00423{"flow_id":7,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":408,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716402,"pkt_ts_usec":828004,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"AJD7JidrGLQwJjRACABFAAAsL\/gAAP8GGqXAqPIPI7yauvdxK1cI4Q21AAAAAGACEgDczAAAAgQEgAAA"} 00422{"flow_id":7,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":409,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716402,"pkt_ts_usec":889007,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"GLQwJjRAAJD7JidrCABFAAAsAABAADcG0p0jvJq6wKjyDytX93El8kNOCOENtmASbvAVfwAAAgQFjA=="} 00423{"flow_id":7,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":410,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716402,"pkt_ts_usec":894336,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoL\/kAAP8GGqjAqPIPI7yauvdxK1cI4Q22JfJDT1AQEgCKBAAAAAAAAAAA"} @@ -94,7 +94,7 @@ 01330{"flow_id":7,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":413,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716403,"pkt_ts_usec":590967,"pkt_caplen":732,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":732,"pkt_l4_len":698,"pkt":"GLQwJjRAAJD7JidrCABFAALOksVAADcGPTYjvJq6wKjyDytX93El8kNPCOEPyFAYcRCXggAApAIAE+UjKQQEAAAAAjC0GDaeJwAAMLQYEAuVBgQAAACAOewBAAAELdbwukQcqjzzox9ewnDrC9pWd1r+348WJdG7JwXO5v924q\/oZvIrLWdzv8wbbkTYLFLg8PCkl\/7VAAAEAAcANQEwAQgMb9c+DCmBkiQCBDcDJxMDAAAA7jC0GBgmBACuiCMmBf8bcyU3BicSBAAAAAIwtBgYJAcCJgglAFojMAo5BOmClNa2L\/0sqyhn7IYa235P1xw1ad7owBLnP8rLfG3TPA0dBMXfrzKvqAFyJ47sRlQQr3qOkdAiNYMpARg1gikBJAIFGDWEKQE2AgQCBAEYGDWBMAIIT2JdLEIid9IYNYAwAghAMCqAESxXYxg1DDABHQD2qSsI\/n0hou9Llf5n3GEbVWuc4D0QHq+l2F+wMAIcbFFqzYrI2WIn6D35aDg1LAuu7NZYbZZk\/HdXyxgYNwPVAAAEAAEAMAEIdFPE8yV1wKQkAgQ3AycTAQAAAO4wtBgYJgSEShYaJgWECPtJNwYnEwMAAADuMLQYGCQHAiYIJQBaIzAKOQRhOKp73vZWzVBkzcIvC7VHSn7kjE4w+wzb4SgMSIJb6yR4pk2B0279JwA\/5iu\/0TQlBvq00DFAwzWDKQEpAhg1gikBJAJgGDWBMAIIQDAqgBEsV2MYNYAwAghDNPcS31+Rzxg1DDABHBLqxXlajT9KXWeBN+P8uG5pHU6a1vmo\/i33mMIwAh0AjB981V9gPTa1niPXvZ7CDdMfpHD9c+6sh9daGBgYGBjVAAAEAAgAMAEcFim0koTd9VH24Qi3gwBu+1JGiaYHN0Hss2X7DzACHQDtu7awqIWueyyG\/HSOZ8skGfW6dThFyBg9fjHnGLyBMayeO8OEQW3boWBH0QsRhFZn"} 00424{"flow_id":7,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":414,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716403,"pkt_ts_usec":807631,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoL\/sAAP8GGqbAqPIPI7yauvdxK1cI4Q\/IJfJF9VAQD1qH8gAAAAAAAAAA"} 00490{"flow_id":7,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":415,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716404,"pkt_ts_usec":974579,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"AJD7JidrGLQwJjRACABFAABcL\/wAAP8GGnHAqPIPI7yauvdxK1cI4Q\/IJfJF9VAYD1rm7wAAMgAAEw8DAAA2nicAADC0GAQAAAACMLQYEQyVBgQAAACt0l0ZnY6SlM7vjCpSkumsf2CXpA=="} -00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":415,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":8,"flow_first_seen":1536716402828,"flow_last_seen":1536716404974,"flow_tot_l4_data_len":1428,"flow_min_l4_data_len":20,"flow_max_l4_data_len":698,"flow_avg_l4_data_len":178,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63345,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink.Google","breed":"Tracker\/Ads","category":"Cloud"}} +00558{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":415,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":8,"flow_first_seen":1536716402828,"flow_last_seen":1536716404974,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":678,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63345,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink.Google","breed":"Tracker\/Ads","category":"Cloud"}} 00414{"flow_id":7,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":416,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716405,"pkt_ts_usec":68469,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAoksZAADcGP9sjvJq6wKjyDytX93El8kX1COEP\/FAQcRAmCAAA"} 00515{"flow_id":7,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":417,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716405,"pkt_ts_usec":70831,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":124,"pkt_l4_len":90,"pkt":"AJD7JidrGLQwJjRACABFAABuL\/0AAP8GGl7AqPIPI7yauvdxK1cI4Q\/8JfJF9VAYD1pqmgAARAAQEwAAAAA2nicAADC0GAQAAAACMLQY1yrQmv5AqlhV6\/eZEU6Z83DQLEb0IYwGPVyY7GVzIqmwdr20i6uJtbyrLETLSw=="} 00415{"flow_id":7,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":418,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716405,"pkt_ts_usec":125501,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAoksdAADcGP9ojvJq6wKjyDytX93El8kX1COEQQlAQcRAlwgAA"} @@ -103,10 +103,10 @@ 00493{"flow_id":7,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":421,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716405,"pkt_ts_usec":190412,"pkt_caplen":109,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":109,"pkt_l4_len":75,"pkt":"GLQwJjRAAJD7JidrCABFAABfkslAADcGP6EjvJq6wKjyDytX93El8kYuCOESCVAYdUCWjwAANQAQEwEAAAAEAAAAAjC0GDaeJwAAMLQY1yrUI1pzYO6El4WvDidxBDCiqep2W0Zbn9KnAb9E6Q=="} 01039{"flow_id":7,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":422,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716405,"pkt_ts_usec":203931,"pkt_caplen":509,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":509,"pkt_l4_len":475,"pkt":"AJD7JidrGLQwJjRACABFAAHvL\/8AAP8GGNvAqPIPI7yauvdxK1cI4RIJJfJGZVAYDuoVUQAAxQEQEwIAAAA2nicAADC0GAQAAAACMLQY1yqABAywxCCA8D3PjjoFOb1Ce0gW1cuNNWbRuYysyr1G2YOIKmwfsanQwM2QeneXd5RmeMU0tOCucHcQb7y+XQTA0DJ7MnNP\/O0UR0qAMb5\/v5FUXV+G\/HCzJc18ar\/uvx5yasHK3PlMOeESls718vo62y8zDNEPqWDWEEONI0gJlHP5MGyeYs+xET0zzNaGW2ykoalJUv8h0CIZPYqYbDSxZfmOjlOmCEmbwAjwM8RoKguQdQqJNU+Df969KbeZgmtBFuOjUvYU93LzESNx8gGw4GQl1y7YHw6ifkpKetqgC35kbdVRsJiw4hZHS0iWY6OMUjt9HZPwwAZz2k9CF7dU+nYX+g2He5iPvO7c1uHx7g0+H4XfeFXu9M6z3+SrP4se\/QtOGUnpsL3O81i\/1j38UK0I+SMoCOhWPvK9X8YYVQwUkrz1hC8lypLCGmT4fpu14Vb3+LLffIbsNDgsvuZVzqQ\/mgyA\/SrShvIL9P\/bnjoQzcALIRGtMtxSYplZLTnaGGZ\/Mpb71srs7Bbt2GTgQJN9OcqkHIQJhTnsX\/nlB\/iEn8j0+TDpir+14EI="} 00478{"flow_id":6,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":483,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716407,"pkt_ts_usec":3782,"pkt_caplen":101,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":101,"pkt_l4_len":67,"pkt":"AJD7JidrGLQwJjRACABFAABXMB8AAP8RJhTAqPIPwKjyAc5xADUAQ16pMiMBAAABAAAAAAAAB2N6ZmUxMDUHZnJvbnQwMQVpYWQwMQpwcm9kdWN0aW9uBG5lc3QDY29tAAABAAE="} -00697{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":483,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_first_seen":1536716402804,"flow_last_seen":1536716407003,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":48,"flow_max_l4_data_len":67,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"czfe105.front01.iad01.production.nest.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.188.154.186"}} +00709{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":483,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_first_seen":1536716402804,"flow_last_seen":1536716407003,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":155,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"czfe105.front01.iad01.production.nest.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.188.154.186"}} 00573{"flow_id":6,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":485,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716407,"pkt_ts_usec":116756,"pkt_caplen":169,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":169,"pkt_l4_len":135,"pkt":"GLQwJjRAAJD7JidrCABFAACbebVAAEARWzrAqPIBwKjyDwA1znEAh2X7MiOBgAABAAIAAAAAB2N6ZmUxMDUHZnJvbnQwMQVpYWQwMQpwcm9kdWN0aW9uBG5lc3QDY29tAAABAAHADAAFAAEAAAB4ACgRZWMyLTM1LTE3NC04Mi0yMzcJY29tcHV0ZS0xCWFtYXpvbmF3c8AywEcAAQABAAjtKQAEI65S7Q=="} -00697{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":485,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":4,"flow_first_seen":1536716402804,"flow_last_seen":1536716407116,"flow_tot_l4_data_len":314,"flow_min_l4_data_len":48,"flow_max_l4_data_len":135,"flow_avg_l4_data_len":78,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"czfe105.front01.iad01.production.nest.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.174.82.237"}} -00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":486,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1536716407119,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63346,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00709{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":485,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":4,"flow_first_seen":1536716402804,"flow_last_seen":1536716407116,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":127,"flow_tot_l4_payload_len":282,"flow_avg_l4_payload_len":70,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"czfe105.front01.iad01.production.nest.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.174.82.237"}} +00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":486,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1536716407119,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63346,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00422{"flow_id":8,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":486,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716407,"pkt_ts_usec":119984,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"AJD7JidrGLQwJjRACABFAAAsMCAAAP8GYljAqPIPI65S7fdyK1cI7G5zAAAAAGACEgDD3QAAAgQEgAAA"} 00422{"flow_id":8,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":487,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716407,"pkt_ts_usec":186187,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"GLQwJjRAAJD7JidrCABFAAAsAABAAC0GJHkjrlLtwKjyDytX93Kf6ho7COxudGASaQOxbwAAAgQFtA=="} 00422{"flow_id":8,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":488,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716407,"pkt_ts_usec":188905,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMCEAAP8GYlvAqPIPI65S7fdyK1cI7G50n+oaPFAQEgAgMAAAAAAAAAAA"} @@ -115,7 +115,7 @@ 01328{"flow_id":8,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":493,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716407,"pkt_ts_usec":903994,"pkt_caplen":731,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":731,"pkt_l4_len":697,"pkt":"GLQwJjRAAJD7JidrCABFAALNMnBAAC0G72cjrlLtwKjyDytX93Kf6ho8COxwh1AYbOASbQAAowIAExADAAADAAAAAjC0GDaeJwAAMLQYEAuYBgQAAACAOesBAAAEwI77Gs4t7AJyX0AaOxRCiXl+5ccRafKOTShylxtkuktla3QX2f050OgPx3Dp2Wr29hk8pPxdG3bVAAAEAAcANQEwAQgRAGNdWXuZjyQCBDcDJxMDAAAA7jC0GBgmBACuiCMmBf8bcyU3BicSAwAAAAIwtBgYJAcCJgglAFojMAo5BAmqnD2bjDiK3yLVcr2LQ\/iPmlWn\/iDHinq\/pRMoxaNQgTnwimtBL+qTiTQqENL2xrPIWxZjJGeRNYMpARg1gikBJAIFGDWEKQE2AgQCBAEYGDWBMAIISKnh4YvR26oYNYAwAghAMCqAESxXYxg1DDABHG7LEaIGSLUc\/M2D6faSCjZ4yyUajbt6l0larAowAhxg27mtYz94ldNAgb53O7UEnNbhJ3tZG9saSNIDGBg3A9UAAAQAAQAwAQh0U8TzJXXApCQCBDcDJxMBAAAA7jC0GBgmBIRKFhomBYQI+0k3BicTAwAAAO4wtBgYJAcCJgglAFojMAo5BGE4qnve9lbNUGTNwi8LtUdKfuSMTjD7DNvhKAxIglvrJHimTYHTbv0nAD\/mK7\/RNCUG+rTQMUDDNYMpASkCGDWCKQEkAmAYNYEwAghAMCqAESxXYxg1gDACCEM09xLfX5HPGDUMMAEcEurFeVqNP0pdZ4E34\/y4bmkdTprW+aj+LfeYwjACHQCMH3zVX2A9NrWeI9e9nsIN0x+kcP1z7qyH11oYGBgYGNUAAAQACAAwARwWcS9Yv6Hv443lPnlfVVzRjWEZ2bkD2vo+PkvpMAIdAJwkZf72kBRQoO+o9JB3Ec608mV4lMXj65mTdKwYJoptKOP73tAdI4SBj9d3d4DbZ6c="} 00421{"flow_id":8,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":494,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716408,"pkt_ts_usec":69864,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMCMAAP8GYlnAqPIPI65S7fdyK1cI7HCHn+oc4VAQD1seHQAAAAAAAAAA"} 00488{"flow_id":8,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":495,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716409,"pkt_ts_usec":280467,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"AJD7JidrGLQwJjRACABFAABcMCQAAP8GYiTAqPIPI65S7fdyK1cI7HCHn+oc4VAYD1th7gAAMgAAExEDAAA2nicAADC0GAMAAAACMLQYEQyYBgQAAAAVbG26Bq9GdhOyEiBxNPZ1OT1plA=="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":495,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":8,"flow_first_seen":1536716407119,"flow_last_seen":1536716409280,"flow_tot_l4_data_len":1428,"flow_min_l4_data_len":20,"flow_max_l4_data_len":697,"flow_avg_l4_data_len":178,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63346,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink","breed":"Acceptable","category":"Cloud"}} +00548{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":495,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":8,"flow_first_seen":1536716407119,"flow_last_seen":1536716409280,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":677,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63346,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink","breed":"Acceptable","category":"Cloud"}} 00414{"flow_id":8,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":496,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716409,"pkt_ts_usec":385595,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAoMnFAAC0G8gsjrlLtwKjyDytX93Kf6hzhCOxwu1AQbODAYwAA"} 00967{"flow_id":8,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":497,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716409,"pkt_ts_usec":389222,"pkt_caplen":458,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":458,"pkt_l4_len":424,"pkt":"AJD7JidrGLQwJjRACABFAAG8MCUAAP8GYMPAqPIPI65S7fdyK1cI7HC7n+oc4VAYD1to7AAAkgEQEwAAAAA2nicAADC0GAMAAAACMLQYzy4GzIJNeU2NOmLbKsico\/gTdowUaADFhimxHolLtG\/hS1TVhyqM6UD5w4rVsO92jRtCoQVWAL3BN1XAqoSX7qxIjsLiDez+47F7E8tVj+Idl4NGs2qi0\/Tq96jgh3f6ESKXex6FFMQl5eAyw47M\/kIa\/KtLoDwmvdKnT3WavS8W9vf0FOzrSa6Jcdpv0tgbkVjqigXyPs1u2nGbADbNU4bk5+RHRjQK9x8NxuD366Xj2LevFvQocE7UWyb7GrNer2cftubu62yoJZWnFYsryY+ZcmNgkUWVISSS9j+Prf0SxU5hUMTdac3kKvt8yioN8RBE76j4oMnkuXzFsufeRNX8m+g5QU6Nru5dKmjK4RSUgKGiLDNmTG4odfRi2Z7z1iY6c\/k5DGxw8dSIRmnFAxqNR5Dp2q2J\/HbFbsuohKJPSSSOmG+GpsfswgFISeA4\/mo4W8mu\/ZkVEVZ0eHcQNZXxfZcl2PFUVmlUjm0M35BxuDxkTbevk2JK9iM="} 00415{"flow_id":8,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":498,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716409,"pkt_ts_usec":461802,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAoMnJAAC0G8gojrlLtwKjyDytX93Kf6hzhCOxyT1AQcRC6nwAA"} @@ -123,7 +123,7 @@ 00584{"flow_id":8,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":500,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716409,"pkt_ts_usec":486645,"pkt_caplen":176,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":176,"pkt_l4_len":142,"pkt":"AJD7JidrGLQwJjRACABFAACiMCYAAP8GYdzAqPIPI65S7fdyK1cI7HJPn+odHVAYDx+\/0QAAeAAQEwEAAAA2nicAADC0GAMAAAACMLQYzy6ryDEujkZ2T+O19ZqyWNx5+FQrxlzTPBdpP9gztpQhKCX5iltTclThZpeFGoN8\/JlPFRlM2BsZDWYQZX1pDRaFiJ6oKEh+8AZIhz0AD9Bd2Fw+dpNEUXaUEa9Y3aWUtTg="} 01272{"flow_id":8,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":501,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716409,"pkt_ts_usec":549606,"pkt_caplen":683,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":683,"pkt_l4_len":649,"pkt":"GLQwJjRAAJD7JidrCABFAAKdMnRAAC0G75MjrlLtwKjyDytX93Kf6h0dCOxyyVAYcRDTcQAAcwIQEwEAAAADAAAAAjC0GDaeJwAAMLQYzy4dy2T3uPHoJ5nDkHN5aOILK\/s0WecYf6P8S5FsG4cRnGvPUqp0bkK7R+RTjACAMHxtDciQOXBsmeSoSCTV1D0wlWNVeBu0ghnZ0IongGwrBGbaef67k11IXiS\/KcMV5aATZIzGi\/uHV6tkHJqfo4Ltfvil\/UngR8KDKi3yz6ZTCF6fqdsJ2yb9VQ1EbUuMA0OjIak+3myS06OAON6R567\/fINVJIzGc7LwDdXbK6bZT+rSnLO\/70HvJ\/4GRYr\/V3yDybJNfmHQ9Mt5EZvO6hmjKg8fghDdikOMV0amqoAijgMNo2RMJdfJP3zTqazQtCMPVftqnGXdQIabgeMEZvbu7gnYSZC3LPXgse0x40+KIcTTlF0Tnk2nG4NWd0SID6H0HYpk7uM+VWZeDhpHohnMGNgYb0+DrV5fzQqtWqWYSlYMKWV2L3Yu5pEU38j8NsYrO2YJ6MApWm\/sZlC6dtsvFHPSPyAp0S83G7IzHir+G5x5\/Zfl0XdNcMrcBLzbhJpN\/bKKcARCJfC+VbX4Z3TrfGOao\/WBoWsaz8M35OhLYwzwjqLDt\/4u1aUzx4gpHpg7eVddmcWFUXaEBTqhfEUccjF48C+kEUT7GxDBXc3ov0aYEbjYLVQDbtO8Ixbn\/kpiezH5l0cGPQGURjvXIBDXz6s76Iy9iJocif9O+L9eRwc9hudufPA9XFt3OoLUbcAL+CoZyrLlxeOULNuLLJLeV2GnHyLdgGmegolNO4bWuNjECt65xxXDr6dWG8OgkT7iWwVgo1rkZA6j7XJWbrmVJzeQwzFngRtmdVI="} 00423{"flow_id":8,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":502,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716409,"pkt_ts_usec":559472,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMCcAAP8GYlXAqPIPI65S7fdyK1cI7HLJn+ofklAQEgAWhQAAAAAAAAAA"} -00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":510,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1536716409847,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63347,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":510,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1536716409847,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63347,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00422{"flow_id":9,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":510,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716409,"pkt_ts_usec":847406,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"AJD7JidrGLQwJjRACABFAAAsMCwAAP8GGnHAqPIPI7yauvdzK1cI9889AAAAAGACEgAbLAAAAgQEgAAA"} 00423{"flow_id":9,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":511,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716409,"pkt_ts_usec":908176,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"GLQwJjRAAJD7JidrCABFAAAsAABAADcG0p0jvJq6wKjyDytX93M4S\/jECPfPPmASbvCMDgAAAgQFjA=="} 00422{"flow_id":9,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":512,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716409,"pkt_ts_usec":910872,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMC0AAP8GGnTAqPIPI7yauvdzK1cI988+OEv4xVAQEgAAlAAAAAAAAAAA"} @@ -132,7 +132,7 @@ 01336{"flow_id":9,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":515,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716410,"pkt_ts_usec":611476,"pkt_caplen":733,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":733,"pkt_l4_len":699,"pkt":"GLQwJjRAAJD7JidrCABFAALPKDBAADcGp8ojvJq6wKjyDytX93M4S\/jFCPfRUlAYcRClSwAApQIAE9Xg11sEAAAAAjC0GDaeJwAAMLQYEAueBgQAAACAOewBAAAECbrdUdu12b+SYDLX\/zL0xISgI8pSC\/5jIJHhE9mQVqqkqSQsxI2X5XMa1xKFWXdnjToNgMdQK0HVAAAEAAcANQEwAQgMb9c+DCmBkiQCBDcDJxMDAAAA7jC0GBgmBACuiCMmBf8bcyU3BicSBAAAAAIwtBgYJAcCJgglAFojMAo5BOmClNa2L\/0sqyhn7IYa235P1xw1ad7owBLnP8rLfG3TPA0dBMXfrzKvqAFyJ47sRlQQr3qOkdAiNYMpARg1gikBJAIFGDWEKQE2AgQCBAEYGDWBMAIIT2JdLEIid9IYNYAwAghAMCqAESxXYxg1DDABHQD2qSsI\/n0hou9Llf5n3GEbVWuc4D0QHq+l2F+wMAIcbFFqzYrI2WIn6D35aDg1LAuu7NZYbZZk\/HdXyxgYNwPVAAAEAAEAMAEIdFPE8yV1wKQkAgQ3AycTAQAAAO4wtBgYJgSEShYaJgWECPtJNwYnEwMAAADuMLQYGCQHAiYIJQBaIzAKOQRhOKp73vZWzVBkzcIvC7VHSn7kjE4w+wzb4SgMSIJb6yR4pk2B0279JwA\/5iu\/0TQlBvq00DFAwzWDKQEpAhg1gikBJAJgGDWBMAIIQDAqgBEsV2MYNYAwAghDNPcS31+Rzxg1DDABHBLqxXlajT9KXWeBN+P8uG5pHU6a1vmo\/i33mMIwAh0AjB981V9gPTa1niPXvZ7CDdMfpHD9c+6sh9daGBgYGBjVAAAEAAgAMAEdAN\/WBKON3OvH+sAiPOFCQg845zqoCG2hPyVrt84wAh0A3huP\/H5FOIRRHhmmqtwRXJ8ZVIrkOyBLODeEBxgXWFXujjI0Q256X84LXelzGgS3WA=="} 00422{"flow_id":9,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":516,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716410,"pkt_ts_usec":815005,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMC8AAP8GGnLAqPIPI7yauvdzK1cI99FSOEv7bFAQD1n+fwAAAAAAAAAA"} 00489{"flow_id":9,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":517,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716411,"pkt_ts_usec":997733,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"AJD7JidrGLQwJjRACABFAABcMDAAAP8GGj3AqPIPI7yauvdzK1cI99FSOEv7bFAYD1n58wAAMgAAExMDAAA2nicAADC0GAQAAAACMLQYEQyeBgQAAAAzcom9gnJSb94h3\/jQ09uvI9YfcQ=="} -00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":517,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":8,"flow_first_seen":1536716409847,"flow_last_seen":1536716411997,"flow_tot_l4_data_len":1431,"flow_min_l4_data_len":20,"flow_max_l4_data_len":699,"flow_avg_l4_data_len":178,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63347,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink.Google","breed":"Tracker\/Ads","category":"Cloud"}} +00558{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":517,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":8,"flow_first_seen":1536716409847,"flow_last_seen":1536716411997,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":679,"flow_tot_l4_payload_len":1263,"flow_avg_l4_payload_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63347,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink.Google","breed":"Tracker\/Ads","category":"Cloud"}} 00415{"flow_id":9,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":518,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716412,"pkt_ts_usec":101039,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAoKDFAADcGqnAjvJq6wKjyDytX93M4S\/tsCPfRhlAQcRCclAAA"} 00514{"flow_id":9,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":519,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716412,"pkt_ts_usec":103934,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":124,"pkt_l4_len":90,"pkt":"AJD7JidrGLQwJjRACABFAABuMDEAAP8GGirAqPIPI7yauvdzK1cI99GGOEv7bFAYD1kmgwAARAAQEwAAAAA2nicAADC0GAQAAAACMLQYpi5bMHfrehw79wCLmAJOuqlVC1AEqC\/wWzgJfnIRBAQHVOUpAiGfWUn6f6OE8Q=="} 00416{"flow_id":9,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":520,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716412,"pkt_ts_usec":157162,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAoKDJAADcGqm8jvJq6wKjyDytX93M4S\/tsCPfRzFAQcRCcTgAA"} @@ -140,17 +140,17 @@ 01031{"flow_id":9,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":522,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716412,"pkt_ts_usec":176620,"pkt_caplen":509,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":509,"pkt_l4_len":475,"pkt":"AJD7JidrGLQwJjRACABFAAHvMDIAAP8GGKjAqPIPI7yauvdzK1cI99HMOEv7pVAYDyASjgAAxQEQEwEAAAA2nicAADC0GAQAAAACMLQYpi4l+cv7HVinscC11HzkcO6SJL1Kunc+2jM8HSk4MhhqiyxkJNo7q3BqeIjVGFi+UX4vs2bcvCEfiTCmqAxNm0XjXXG0MwSal0A6zfADY\/kMD4JEO10WgOFCCN9Mzu1gwtxKif5L4i4+KfGVrkA8MDLFdZUxXp7BLLM3h2UA0+LTJ1kUyF4nUBcCi1clI6byns0k9fC8nLL85qXwNwgNmhqz8+hnvejx0IHRkUSuTflnetxnDVVWgCzgJJoSL2Ncbl5fLW40Aslz4bMyFKf2+hC0WXa6FmeAUlu7SNhekGZxZM3XVMKT+teNF0Y9z+FN2kTRSCRjENDLy2MbH4ypyq4DFdWxktK9BlKCy6CfudRFYefIG\/EpdvPIU35yK6cCFQV3vm1xqauZH23QWuoEhhIpP3kCY5V8V4CXuDt51zDNR96xykYbqsdQGUWoMf+hL4bWUU+Jq93DhYt0QMYSTyhv0eiqIWOrEEFa1\/tbVQtE2s1TI0Pqk4g9fi5pvxwDJo\/TpXBgp0TRnRGozTOxenoPKTN\/e5GWRDeC5pqx4E6tHSqsrfaos2LmvDaINeM="} 00495{"flow_id":9,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":523,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716412,"pkt_ts_usec":227528,"pkt_caplen":109,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":109,"pkt_l4_len":75,"pkt":"GLQwJjRAAJD7JidrCABFAABfKDRAADcGqjYjvJq6wKjyDytX93M4S\/ulCPfTk1AYdUDbwAAANQAQEwEAAAAEAAAAAjC0GDaeJwAAMLQYpi6RqU1g2fyvZNgqhxRxPNlqKdyGXnoZw6cV\/h9gzA=="} 00832{"flow_id":9,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":524,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536716412,"pkt_ts_usec":242229,"pkt_caplen":358,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":358,"pkt_l4_len":324,"pkt":"AJD7JidrGLQwJjRACABFAAFYMDMAAP8GGT7AqPIPI7yauvdzK1cI99OTOEv73FAYDulnJwAALgEQEwIAAAA2nicAADC0GAQAAAACMLQYpi4UtiA0Cx13rIj8\/aDtBknj5TpUe+czqdoVD8n6UA7QL+mB0XoM6ch85gGQb4MEAemR4qgbb63DxAQ8hUZN2BayyDPAqHBcr2nupAGGcc6I1zASH0zHmLIg3VBG6EMWnd54NMvCalt+NfLRa5dbK1h\/3AKhkef87gCx5m\/BtBMiu9OQp+Eb8Fyzbv2KhAKsDSHuOGUXHc9Wz\/SqOzD066CW0Ntsua0pkoZYV6ixdfxlvPDDSSLi0xL\/AZOZnQ2pkHxi5gBkPdea\/EUeI9iEafXIfk1SUsg0bskCpy0X15AyUYt2zASNm0LG+EF7JYTugxVX8xZe1AmlbycXRKBuMfyvlHZ1juCzw5L9YRsejkrvAvQ7MG9VyA=="} -00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":537,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":116,"flow_first_seen":1536714607530,"flow_last_seen":1536716407068,"flow_tot_l4_data_len":6397,"flow_min_l4_data_len":20,"flow_max_l4_data_len":697,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63343,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":537,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":71,"flow_first_seen":1536716402828,"flow_last_seen":1536716406969,"flow_tot_l4_data_len":16281,"flow_min_l4_data_len":20,"flow_max_l4_data_len":698,"flow_avg_l4_data_len":229,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63345,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":543,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":4,"flow_first_seen":1536716402804,"flow_last_seen":1536716407116,"flow_tot_l4_data_len":314,"flow_min_l4_data_len":48,"flow_max_l4_data_len":135,"flow_avg_l4_data_len":78,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":543,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":20,"flow_first_seen":1536716409847,"flow_last_seen":1536716412657,"flow_tot_l4_data_len":2667,"flow_min_l4_data_len":20,"flow_max_l4_data_len":699,"flow_avg_l4_data_len":133,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63347,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":611,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1536717427961,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":537,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":116,"flow_first_seen":1536714607530,"flow_last_seen":1536716407068,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":677,"flow_tot_l4_payload_len":4069,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63343,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":537,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":71,"flow_first_seen":1536716402828,"flow_last_seen":1536716406969,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":678,"flow_tot_l4_payload_len":14853,"flow_avg_l4_payload_len":209,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63345,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":543,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":4,"flow_first_seen":1536716402804,"flow_last_seen":1536716407116,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":127,"flow_tot_l4_payload_len":282,"flow_avg_l4_payload_len":70,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":543,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":20,"flow_first_seen":1536716409847,"flow_last_seen":1536716412657,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":679,"flow_tot_l4_payload_len":2259,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63347,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":611,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1536717427961,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00455{"flow_id":10,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":611,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717427,"pkt_ts_usec":961883,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AJD7JidrGLQwJjRACABFAABEME8AAP8RJffAqPIPwKjyAc5xADUAMGWoTp4BAAABAAAAAAAADXdlYXZlLWxvZ3NpbmsEbmVzdANjb20AAAEAAQ=="} -00651{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":611,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1536717427961,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":611,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1536717427961,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00455{"flow_id":10,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":612,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717427,"pkt_ts_usec":984158,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AJD7JidrGLQwJjRACABFAABEMFAAAP8RJfbAqPIPwKjyAc5xADUAMGWoTp4BAAABAAAAAAAADXdlYXZlLWxvZ3NpbmsEbmVzdANjb20AAAEAAQ=="} 00475{"flow_id":10,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":613,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717428,"pkt_ts_usec":84913,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"GLQwJjRAAJD7JidrCABFAABUzkdAAEARBu\/AqPIBwKjyDwA1znEAQGW0Tp6BgAABAAEAAAAADXdlYXZlLWxvZ3NpbmsEbmVzdANjb20AAAEAAcAMAAEAAQAAAHgABCO8mro="} -00679{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":613,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":3,"flow_first_seen":1536717427961,"flow_last_seen":1536717428084,"flow_tot_l4_data_len":160,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.188.154.186"}} -00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":614,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1536717428089,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63348,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00691{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":613,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":3,"flow_first_seen":1536717427961,"flow_last_seen":1536717428084,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":136,"flow_avg_l4_payload_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.188.154.186"}} +00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":614,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1536717428089,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63348,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00422{"flow_id":11,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":614,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717428,"pkt_ts_usec":89363,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"AJD7JidrGLQwJjRACABFAAAsMFEAAP8GGkzAqPIPI7yauvd0K1cJA0ANAAAAAGACEgCqTwAAAgQEgAAA"} 00423{"flow_id":11,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":615,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717428,"pkt_ts_usec":146200,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"GLQwJjRAAJD7JidrCABFAAAsAABAADcG0p0jvJq6wKjyDytX93SD5IA7CQNADmASbvBIIgAAAgQFjA=="} 00424{"flow_id":11,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":616,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717428,"pkt_ts_usec":152738,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMFIAAP8GGk\/AqPIPI7yauvd0K1cJA0AOg+SAPFAQEgC8pwAAAAAAAAAA"} @@ -159,7 +159,7 @@ 01333{"flow_id":11,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":619,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717428,"pkt_ts_usec":843719,"pkt_caplen":732,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":732,"pkt_l4_len":698,"pkt":"GLQwJjRAAJD7JidrCABFAALOS3JAADcGhIkjvJq6wKjyDytX93SD5IA8CQNCIFAYcRBeKwAApAIAE2ZMqY0EAAAAAjC0GDaeJwAAMLQYEAuhBgQAAACAOewBAAAEQV9aO4xK0Ti5pfosvsMq8qMan5I\/lvw0z2uLTLWHTEEmZP5JxgTdqLVmyLoXPa\/bgZ+9Dfm1hg\/VAAAEAAcANQEwAQgMb9c+DCmBkiQCBDcDJxMDAAAA7jC0GBgmBACuiCMmBf8bcyU3BicSBAAAAAIwtBgYJAcCJgglAFojMAo5BOmClNa2L\/0sqyhn7IYa235P1xw1ad7owBLnP8rLfG3TPA0dBMXfrzKvqAFyJ47sRlQQr3qOkdAiNYMpARg1gikBJAIFGDWEKQE2AgQCBAEYGDWBMAIIT2JdLEIid9IYNYAwAghAMCqAESxXYxg1DDABHQD2qSsI\/n0hou9Llf5n3GEbVWuc4D0QHq+l2F+wMAIcbFFqzYrI2WIn6D35aDg1LAuu7NZYbZZk\/HdXyxgYNwPVAAAEAAEAMAEIdFPE8yV1wKQkAgQ3AycTAQAAAO4wtBgYJgSEShYaJgWECPtJNwYnEwMAAADuMLQYGCQHAiYIJQBaIzAKOQRhOKp73vZWzVBkzcIvC7VHSn7kjE4w+wzb4SgMSIJb6yR4pk2B0279JwA\/5iu\/0TQlBvq00DFAwzWDKQEpAhg1gikBJAJgGDWBMAIIQDAqgBEsV2MYNYAwAghDNPcS31+Rzxg1DDABHBLqxXlajT9KXWeBN+P8uG5pHU6a1vmo\/i33mMIwAh0AjB981V9gPTa1niPXvZ7CDdMfpHD9c+6sh9daGBgYGBjVAAAEAAgAMAEcG7hosNZ15e3F8srkX2rX3OoCOj0Q8NqMkoEl0jACHQCvDawplV4gO\/pf2Yd7VIkwH5J8lV0JmwN6nsfYGIF4YNGCZYzNH6JJ4VB3AkaCX\/61"} 00422{"flow_id":11,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":620,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717429,"pkt_ts_usec":59119,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMFQAAP8GGk3AqPIPI7yauvd0K1cJA0Igg+SC4lAQD1q6lQAAAAAAAAAA"} 00489{"flow_id":11,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":621,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717430,"pkt_ts_usec":226245,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"AJD7JidrGLQwJjRACABFAABcMFUAAP8GGhjAqPIPI7yauvd0K1cJA0Igg+SC4lAYD1rmagAAMgAAExUDAAA2nicAADC0GAQAAAACMLQYEQyhBgQAAABBQJTDCM9602OiOlnVzsSlIAFYfg=="} -00548{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":621,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":8,"flow_first_seen":1536717428089,"flow_last_seen":1536717430226,"flow_tot_l4_data_len":1428,"flow_min_l4_data_len":20,"flow_max_l4_data_len":698,"flow_avg_l4_data_len":178,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63348,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink.Google","breed":"Tracker\/Ads","category":"Cloud"}} +00559{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":621,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":8,"flow_first_seen":1536717428089,"flow_last_seen":1536717430226,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":678,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63348,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink.Google","breed":"Tracker\/Ads","category":"Cloud"}} 00415{"flow_id":11,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":622,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717430,"pkt_ts_usec":318726,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAoS3NAADcGhy4jvJq6wKjyDytX93SD5ILiCQNCVFAQcRBYqwAA"} 00514{"flow_id":11,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":623,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717430,"pkt_ts_usec":321126,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":124,"pkt_l4_len":90,"pkt":"AJD7JidrGLQwJjRACABFAABuMFYAAP8GGgXAqPIPI7yauvd0K1cJA0JUg+SC4lAYD1rROwAARAAQEwAAAAA2nicAADC0GAQAAAACMLQYHyNbhn9VDoARCCe8rRLztndNaTEIOzGsgKA+4QD+m30GU58L4iJ+h1FBZ0+xig=="} 00416{"flow_id":11,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":624,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717430,"pkt_ts_usec":375682,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAoS3RAADcGhy0jvJq6wKjyDytX93SD5ILiCQNCmlAQcRBYZQAA"} @@ -168,10 +168,10 @@ 00494{"flow_id":11,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":627,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717430,"pkt_ts_usec":439321,"pkt_caplen":109,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":109,"pkt_l4_len":75,"pkt":"GLQwJjRAAJD7JidrCABFAABfS3ZAADcGhvQjvJq6wKjyDytX93SD5IMbCQNEYVAYdUBdLgAANQAQEwEAAAAEAAAAAjC0GDaeJwAAMLQYHyNzZpXYNZeZdCUgxD2zUDBPIOVRg85SJ3eyC07atQ=="} 01040{"flow_id":11,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":628,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717430,"pkt_ts_usec":453035,"pkt_caplen":509,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":509,"pkt_l4_len":475,"pkt":"AJD7JidrGLQwJjRACABFAAHvMFgAAP8GGILAqPIPI7yauvd0K1cJA0Rhg+SDUlAYDuqWvgAAxQEQEwIAAAA2nicAADC0GAQAAAACMLQYHyMcwtLQNZOmw9EOXmPr\/dRZqGP\/ncecLayXy1ipoYtlg+PzlM8YectnZeKXeGjIego5qNZFuYyy1llTK\/YxCfNv2VA9WA3IAF5BK9t4cks\/aNENNnFyAKGNolDBoJM3SCnPUAT1c0ePzBLlWXYfNPioQgHEXdOYx59BaFVkyqAgbG3vWOZqLaCJ\/Tnr8h2SBx9fF2usGo\/lODsM\/VpbwrzaLgWqoMoyF+gI4jWMh42auc1nzFTDN\/+XG4Ayck9\/rrCxRnGeVJs2PXuygHmW9Gakfmmv4AuwBsoS2CzwMycI6JTltG365gP95C+HHJzV5otFdcgEDpE1IGUcp3MDVTj4Vho5w27LvW8H6L\/zwQXba1PvgHyDFCBmqjfvJ7F\/uLvWzxlci9HYS4+g0YCNsokLikF4zCpA3lmioMXH2hk6C3UHYJLHW9z8cZ+rrddw3WQlert2KUbuNvH3BNXjoW\/9dOCD6deluMxqtR7+puUpB\/OqiOWtbQnBpVROt4zUMdeV9ikST8euCwReTFfAKcRjOZXklfnYqQpvi4XsmADmUUTuKcni8hOG+bmO1Ow="} 00481{"flow_id":10,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":671,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717449,"pkt_ts_usec":934587,"pkt_caplen":101,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":101,"pkt_l4_len":67,"pkt":"AJD7JidrGLQwJjRACABFAABXMG4AAP8RJcXAqPIPwKjyAc5xADUAQy+AYUwBAAABAAAAAAAAB2N6ZmUxMDUHZnJvbnQwMQVpYWQwMQpwcm9kdWN0aW9uBG5lc3QDY29tAAABAAE="} -00698{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":671,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":4,"flow_first_seen":1536717427961,"flow_last_seen":1536717449934,"flow_tot_l4_data_len":227,"flow_min_l4_data_len":48,"flow_max_l4_data_len":67,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"czfe105.front01.iad01.production.nest.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.188.154.186"}} +00710{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":671,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":4,"flow_first_seen":1536717427961,"flow_last_seen":1536717449934,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":195,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"czfe105.front01.iad01.production.nest.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.188.154.186"}} 00574{"flow_id":10,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":673,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717450,"pkt_ts_usec":88270,"pkt_caplen":169,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":169,"pkt_l4_len":135,"pkt":"GLQwJjRAAJD7JidrCABFAACb\/6BAAEAR1U7AqPIBwKjyDwA1znEAh2X7YUyBgAABAAIAAAAAB2N6ZmUxMDUHZnJvbnQwMQVpYWQwMQpwcm9kdWN0aW9uBG5lc3QDY29tAAABAAHADAAFAAEAAAB3ACgRZWMyLTM1LTE3NC04Mi0yMzcJY29tcHV0ZS0xCWFtYXpvbmF3c8AywEcAAQABAAjpFgAEI65S7Q=="} -00698{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":673,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":5,"flow_first_seen":1536717427961,"flow_last_seen":1536717450088,"flow_tot_l4_data_len":362,"flow_min_l4_data_len":48,"flow_max_l4_data_len":135,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"czfe105.front01.iad01.production.nest.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.174.82.237"}} -00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":674,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1536717450091,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63349,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00710{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":673,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":5,"flow_first_seen":1536717427961,"flow_last_seen":1536717450088,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":127,"flow_tot_l4_payload_len":322,"flow_avg_l4_payload_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"czfe105.front01.iad01.production.nest.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.174.82.237"}} +00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":674,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1536717450091,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63349,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00422{"flow_id":12,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":674,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717450,"pkt_ts_usec":91191,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"AJD7JidrGLQwJjRACABFAAAsMG8AAP8GYgnAqPIPI65S7fd1K1cJDrE1AAAAAGACEgCA9gAAAgQEgAAA"} 00423{"flow_id":12,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":675,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717450,"pkt_ts_usec":156309,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"GLQwJjRAAJD7JidrCABFAAAsAABAAC0GJHkjrlLtwKjyDytX93XProMNCQ6xNmASaQPV8QAAAgQFtA=="} 00423{"flow_id":12,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":676,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717450,"pkt_ts_usec":159277,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMHAAAP8GYgzAqPIPI65S7fd1K1cJDrE2z66DDlAQEgBEsgAAAAAAAAAA"} @@ -180,7 +180,7 @@ 01332{"flow_id":12,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":679,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717450,"pkt_ts_usec":921163,"pkt_caplen":732,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":732,"pkt_l4_len":698,"pkt":"GLQwJjRAAJD7JidrCABFAALOodhAAC0Gf\/4jrlLtwKjyDytX93XProMOCQ6zSFAYbODLIgAApAIAExYDAAADAAAAAjC0GDaeJwAAMLQYEAukBgQAAACAOesBAAAEbziNMpKdbJgGRoHyXyFDRQtipDYGnIgfqtt\/iAE5rQQGlnJ5Tud8n9qoqzSFTGcKQHUsx9ZGKYDVAAAEAAcANQEwAQgRAGNdWXuZjyQCBDcDJxMDAAAA7jC0GBgmBACuiCMmBf8bcyU3BicSAwAAAAIwtBgYJAcCJgglAFojMAo5BAmqnD2bjDiK3yLVcr2LQ\/iPmlWn\/iDHinq\/pRMoxaNQgTnwimtBL+qTiTQqENL2xrPIWxZjJGeRNYMpARg1gikBJAIFGDWEKQE2AgQCBAEYGDWBMAIISKnh4YvR26oYNYAwAghAMCqAESxXYxg1DDABHG7LEaIGSLUc\/M2D6faSCjZ4yyUajbt6l0larAowAhxg27mtYz94ldNAgb53O7UEnNbhJ3tZG9saSNIDGBg3A9UAAAQAAQAwAQh0U8TzJXXApCQCBDcDJxMBAAAA7jC0GBgmBIRKFhomBYQI+0k3BicTAwAAAO4wtBgYJAcCJgglAFojMAo5BGE4qnve9lbNUGTNwi8LtUdKfuSMTjD7DNvhKAxIglvrJHimTYHTbv0nAD\/mK7\/RNCUG+rTQMUDDNYMpASkCGDWCKQEkAmAYNYEwAghAMCqAESxXYxg1gDACCEM09xLfX5HPGDUMMAEcEurFeVqNP0pdZ4E34\/y4bmkdTprW+aj+LfeYwjACHQCMH3zVX2A9NrWeI9e9nsIN0x+kcP1z7qyH11oYGBgYGNUAAAQACAAwAR0A2G31fq+TOXoyqvgRUKTA+nYWK49Y5M6pPX1i2DACHQDLeQmsDgLPZIqWGixBFHwTSJsfpkvJb4ZnSPpVGEb\/GHZhO10mK29J0xKM8wSIOLew"} 00423{"flow_id":12,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":680,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717450,"pkt_ts_usec":932392,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMHIAAP8GYgrAqPIPI65S7fd1K1cJDrNIz66FtFAQD1pCoAAAAAAAAAAA"} 00489{"flow_id":12,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":681,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717452,"pkt_ts_usec":328815,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"AJD7JidrGLQwJjRACABFAABcMHMAAP8GYdXAqPIPI65S7fd1K1cJDrNIz66FtFAYD1qYeAAAMgAAExcDAAA2nicAADC0GAMAAAACMLQYEQykBgQAAAAVa3P0RkFW+dlcD7POmwfEvAo6fg=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":681,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":8,"flow_first_seen":1536717450091,"flow_last_seen":1536717452328,"flow_tot_l4_data_len":1428,"flow_min_l4_data_len":20,"flow_max_l4_data_len":698,"flow_avg_l4_data_len":178,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63349,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink","breed":"Acceptable","category":"Cloud"}} +00549{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":681,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":8,"flow_first_seen":1536717450091,"flow_last_seen":1536717452328,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":678,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63349,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink","breed":"Acceptable","category":"Cloud"}} 00415{"flow_id":12,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":682,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717452,"pkt_ts_usec":428867,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAoodlAAC0GgqMjrlLtwKjyDytX93XProW0CQ6zfFAQbODk5QAA"} 00693{"flow_id":12,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":683,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717452,"pkt_ts_usec":433186,"pkt_caplen":258,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":258,"pkt_l4_len":224,"pkt":"AJD7JidrGLQwJjRACABFAAD0MHQAAP8GYTzAqPIPI65S7fd1K1cJDrN8z66FtFAYD1rV4AAAygAQEwAAAAA2nicAADC0GAMAAAACMLQY2Cfv7HvXPsKFYm+Fvy7t+9lgnc56QGmd\/eVjBVdTXBr35uaTDhN1mS6RWjNOlkbKoXHmoupkyGTs+2ZnMWXYdTpAVAdN4hr1I\/iQAzMeygyY4VcYD3qbsRxap6xEmiyJiVhJM9iaT2bmzxF8MC3Rhdf89KqsbjYwOsv9Ldxwd3+8H9SUOpByMMa6nDTYGi3XX5vk+ugYcYYkbmwzwKinTum5rmGQR51hVuA1UUWRaBiDe7FQ"} 00416{"flow_id":12,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":684,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717452,"pkt_ts_usec":499435,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAoodpAAC0GgqIjrlLtwKjyDytX93XProW0CQ60SFAQcRDf6QAA"} @@ -188,10 +188,10 @@ 00585{"flow_id":12,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":686,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717452,"pkt_ts_usec":520876,"pkt_caplen":176,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":176,"pkt_l4_len":142,"pkt":"AJD7JidrGLQwJjRACABFAACiMHUAAP8GYY3AqPIPI65S7fd1K1cJDrRIz66F8FAYDx5oWQAAeAAQEwEAAAA2nicAADC0GAMAAAACMLQY2CeHe3fbvWidKfohKuRa7XDuojHzMgZ2OhqIaxSzulmY1XoAGRd4ENFcqyJqh4aNnK3Zk8\/cV+XMiFuh2rYIlEfPQTViL5\/yMAtxrgtaJegSjYVtcSEEHhb64b0qiEWrpM4="} 01272{"flow_id":12,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":687,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717452,"pkt_ts_usec":582887,"pkt_caplen":683,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":683,"pkt_l4_len":649,"pkt":"GLQwJjRAAJD7JidrCABFAAKdodxAAC0GgCsjrlLtwKjyDytX93XProXwCQ60wlAYcRC4\/AAAcwIQEwEAAAADAAAAAjC0GDaeJwAAMLQY2CdpgLR76mOJh9OcABZMQZxjd6W+4olkuKICGOoEHYAr7uuNJHp5lmVSQcLnoVMK6Pckncv+NG93Wf7\/UfUStKBidDWVzuoHH+KvDDU\/exXRljKxonJqLcgzfK4KHwxJNq0hmXASfbLaIoekpC8pw\/ZpmgM+ayekgJB+CBAZDzA38Kj3fQEXKdPvKi434t49P11HKag+kNjXJjTiBbhC07ZYHYmfROcH+JGVG+sgYvt0GibOChZF74V\/RvixPDzrVDGmlBzlO9osVBV6D6EUcuUx+xdswEFwFHRCLwD76dncYNAon1ZQRjGBHhjNFX0aL1J7yj85gD6Chnn7Psw808CMGMCl8pYpMpJMMK8ys3tgyl+HtbVElVqeunEW2ya2Y9QoNuNBt1hZkYG0k\/EmOpD7dk6ANgZJOjSXBeloJBYH9rh0mH\/dTZeVQBVZavePeJzrwLN2z12WBU07O0ohB2LeO0Pm0BwjErn4+SkZwg7NWyYY4bZBQ7Nw9OIbUghLGGEUTdewDlIJSEpQCi\/KoH6b2glDONkfdY7DNM7m7h0DU+Oax34IhSt6w9ZNB5t5ocBqoyAXmd+780hynw5Whcwk\/NLvCZIrDT501EBJYcXrQYAvAk3wQJb9NkGyofDKIlNph+RRIR7JJ\/tN\/luzKYeYT3jUAx8+pjaQOfOOQ9uOebNAjCUVr34xlZN5Tdfu4L4BdDbLh3UA+oAWbEak3VBSXfZ+EFCr4RX6Jp4b5G9nWh14E2DYXRY19JnweARqxsVgblB4leYp3YzGMnN5lsK892Gsq\/GT05G0\/dE="} 00424{"flow_id":12,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":688,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536717452,"pkt_ts_usec":593864,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMHYAAP8GYgbAqPIPI65S7fd1K1cJDrTCz66IZVAQEgA7zwAAAAAAAAAA"} -00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":703,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":78,"flow_first_seen":1536716407119,"flow_last_seen":1536717449999,"flow_tot_l4_data_len":5476,"flow_min_l4_data_len":20,"flow_max_l4_data_len":697,"flow_avg_l4_data_len":70,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63346,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":703,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":49,"flow_first_seen":1536717428089,"flow_last_seen":1536717431514,"flow_tot_l4_data_len":10331,"flow_min_l4_data_len":20,"flow_max_l4_data_len":698,"flow_avg_l4_data_len":210,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63348,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":707,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":5,"flow_first_seen":1536717427961,"flow_last_seen":1536717450088,"flow_tot_l4_data_len":362,"flow_min_l4_data_len":48,"flow_max_l4_data_len":135,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":745,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1536718052990,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63350,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":703,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":78,"flow_first_seen":1536716407119,"flow_last_seen":1536717449999,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":677,"flow_tot_l4_payload_len":3908,"flow_avg_l4_payload_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63346,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":703,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":49,"flow_first_seen":1536717428089,"flow_last_seen":1536717431514,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":678,"flow_tot_l4_payload_len":9343,"flow_avg_l4_payload_len":190,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63348,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":707,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":5,"flow_first_seen":1536717427961,"flow_last_seen":1536717450088,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":127,"flow_tot_l4_payload_len":322,"flow_avg_l4_payload_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":745,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1536718052990,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63350,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00423{"flow_id":13,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":745,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718052,"pkt_ts_usec":990525,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"AJD7JidrGLQwJjRACABFAAAsMIsAAP8GYe3AqPIPI65S7fd2K1cJGivXAAAAAGACEgAGSAAAAgQEgAAA"} 00422{"flow_id":13,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":747,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718053,"pkt_ts_usec":59160,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"GLQwJjRAAJD7JidrCABFAAAsAABAAC0GJHkjrlLtwKjyDytX93aQyd5SCRor2GASaQM+4wAAAgQFtA=="} 00422{"flow_id":13,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":748,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718053,"pkt_ts_usec":62757,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMIwAAP8GYfDAqPIPI65S7fd2K1cJGivYkMneU1AQEgCtowAAAAAAAAAA"} @@ -200,7 +200,7 @@ 01334{"flow_id":13,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":751,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718053,"pkt_ts_usec":776985,"pkt_caplen":731,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":731,"pkt_l4_len":697,"pkt":"GLQwJjRAAJD7JidrCABFAALNsfRAAC0Gb+MjrlLtwKjyDytX93aQyd5TCRot61AYbOBPtgAAowIAExgDAAADAAAAAjC0GDaeJwAAMLQYEAurBgQAAACAOesBAAAE0sW8P6\/LXxXtSVWgOie0jFpFH\/L7tTiMXUvkzpyGDbX+jfCmn11GvLdTiJofb1GRcypu9DeYwXjVAAAEAAcANQEwAQgRAGNdWXuZjyQCBDcDJxMDAAAA7jC0GBgmBACuiCMmBf8bcyU3BicSAwAAAAIwtBgYJAcCJgglAFojMAo5BAmqnD2bjDiK3yLVcr2LQ\/iPmlWn\/iDHinq\/pRMoxaNQgTnwimtBL+qTiTQqENL2xrPIWxZjJGeRNYMpARg1gikBJAIFGDWEKQE2AgQCBAEYGDWBMAIISKnh4YvR26oYNYAwAghAMCqAESxXYxg1DDABHG7LEaIGSLUc\/M2D6faSCjZ4yyUajbt6l0larAowAhxg27mtYz94ldNAgb53O7UEnNbhJ3tZG9saSNIDGBg3A9UAAAQAAQAwAQh0U8TzJXXApCQCBDcDJxMBAAAA7jC0GBgmBIRKFhomBYQI+0k3BicTAwAAAO4wtBgYJAcCJgglAFojMAo5BGE4qnve9lbNUGTNwi8LtUdKfuSMTjD7DNvhKAxIglvrJHimTYHTbv0nAD\/mK7\/RNCUG+rTQMUDDNYMpASkCGDWCKQEkAmAYNYEwAghAMCqAESxXYxg1gDACCEM09xLfX5HPGDUMMAEcEurFeVqNP0pdZ4E34\/y4bmkdTprW+aj+LfeYwjACHQCMH3zVX2A9NrWeI9e9nsIN0x+kcP1z7qyH11oYGBgYGNUAAAQACAAwARw1T2IcMbxoxOJxWzVUvGZAZjKEZDcm7zKQa67bMAIdAKPrCSVs\/c\/JcdU67zBXeGds8ta1rgpv1q\/OZsgYS8IvNc9SGG7wUPxFuOb9ubzI2y8="} 00423{"flow_id":13,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":752,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718053,"pkt_ts_usec":848053,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMI4AAP8GYe7AqPIPI65S7fd2K1cJGi3rkMng+FAQD1urkAAAAAAAAAAA"} 00491{"flow_id":13,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":753,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718055,"pkt_ts_usec":162308,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"AJD7JidrGLQwJjRACABFAABcMI8AAP8GYbnAqPIPI65S7fd2K1cJGi3rkMng+FAYD1sXwwAAMgAAExkDAAA2nicAADC0GAMAAAACMLQYEQyrBgQAAAC91\/p2XARSKlEAE\/UpbfvFYG1sJQ=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":753,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":8,"flow_first_seen":1536718052990,"flow_last_seen":1536718055162,"flow_tot_l4_data_len":1428,"flow_min_l4_data_len":20,"flow_max_l4_data_len":697,"flow_avg_l4_data_len":178,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63350,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink","breed":"Acceptable","category":"Cloud"}} +00549{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":753,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":8,"flow_first_seen":1536718052990,"flow_last_seen":1536718055162,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":677,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63350,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink","breed":"Acceptable","category":"Cloud"}} 00415{"flow_id":13,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":754,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718055,"pkt_ts_usec":268280,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAosfVAAC0GcocjrlLtwKjyDytX93aQyeD4CRouH1AQbOBN1wAA"} 00694{"flow_id":13,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":755,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718055,"pkt_ts_usec":271521,"pkt_caplen":258,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":258,"pkt_l4_len":224,"pkt":"AJD7JidrGLQwJjRACABFAAD0MJAAAP8GYSDAqPIPI65S7fd2K1cJGi4fkMng+FAYD1t2dQAAygAQEwAAAAA2nicAADC0GAMAAAACMLQYuSAnzQlRb5c23McyQuVT3uwhB720rf8l+1tf9TgDr\/Y2s1FAD3GCnmlmFk7Uphom+LvFr+8\/KFpvvGBpyXq4djXJ8AonV9JeIhGMS+mA\/J6VfcfUE93UnL1ZrFEYueFIh0USTCKXQLMVCHIhIWKHVHuxDKC8xejFBE6Xz79Wuy3mMMAFWAT5nOHnk4gJHsmpCR1A4vyXmEE0aN6McmjOPcVxuCV7pMMaEWxnIAHs5kbrxLpr"} 00416{"flow_id":13,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":756,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718055,"pkt_ts_usec":339269,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAosfZAAC0GcoYjrlLtwKjyDytX93aQyeD4CRou61AQcRBI2wAA"} @@ -208,13 +208,13 @@ 00585{"flow_id":13,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":758,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718055,"pkt_ts_usec":364971,"pkt_caplen":176,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":176,"pkt_l4_len":142,"pkt":"AJD7JidrGLQwJjRACABFAACiMJEAAP8GYXHAqPIPI65S7fd2K1cJGi7rkMnhNFAYDx+UvwAAeAAQEwEAAAA2nicAADC0GAMAAAACMLQYuSAYxN7C6\/gO3nX5RyJn6PJ9iRIqn4rDPj7MUvwmK1p8coXxYhvOuHuK39YrcDbHgfSoB9ZDkVTssG3e2d5k\/BxSNjKzvt3DFGIVz+PwYw38jxPyzt2Hi0LvlmNrwVcQGW0="} 01275{"flow_id":13,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":759,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718055,"pkt_ts_usec":427492,"pkt_caplen":683,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":683,"pkt_l4_len":649,"pkt":"GLQwJjRAAJD7JidrCABFAAKdsfhAAC0GcA8jrlLtwKjyDytX93aQyeE0CRovZVAYcRBJ9AAAcwIQEwEAAAADAAAAAjC0GDaeJwAAMLQYuSDinmqKzVmF\/eXMTOuZcdK+ib75BwO2oRGiiEDaK+3Pnw6Qs3C2noqSiwxhZsWJqdX1dyfTcKsrWwY6rO88+9mzSYz7OLdrdI3Slhl6kFBlRJX1kIcqD9ANTwvp+eTpzPxf3v2eUNECf4c1wvLKvfCJ2DzlvA+9R22EhnwlvZ\/jXuZ4phZepXDYHL\/B3Ss7IGKhJqNLeKkNPk25T3KCgYS54n\/QME\/NXSW1MnR1xtMeue+XPaQa+H\/sQSz+Jftw5+hEy1LhPQrs4pdXJFqRa4dLsnZde2pfv9bCWv+7g4e0jB+2u8pZ8agAkiO4w5ENbZ5RETWjHG+3czkYpXrKJ0sVYYZ0QMi2ckLWdLtdUEbKekl9junNF7tzxieYQO44X4FWADbiNFAL0YXsSu8dJZnutXQtU1DTEumsVdmK8\/YJW\/J1Ra5OniITRIzML7ukbj8J0uachhaLaUkjn5HJHDNQhhapIVEhlCRmOA6uG\/uNuT3SJP7\/5GaOxIzMsS+8HpIlBYra8Eqqtf71DzobHQta6dCKrA3HOPFkSqdxhABE2ev1QwKTvtA4TFr1G0l3s4cWsd\/LI1urCmjHwxJNKWPepNStz+IayuBnhlcYYVQjYFVcm9HCNy046dvNAzpSWuf8rCZg0ZiIkgveI5XtAdGedXl56vAdgQGvLl1ctNPHojREl\/N2ClrxOHSQOHDPpgB\/5Ietx76wgHSTe3iphyBZWgFW4P\/iZ2CTKja71Kgqv6dIFclTSEBenmTt6a+aEnlQUOlUkb0\/KXZkWP1a5v+iBRUsfhAZg\/KIQeI="} 00424{"flow_id":13,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":760,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718055,"pkt_ts_usec":437112,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMJIAAP8GYerAqPIPI65S7fd2K1cJGi9lkMnjqVAQEgCkwAAAAAAAAAAA"} -00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":775,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":52,"flow_first_seen":1536717450091,"flow_last_seen":1536718053058,"flow_tot_l4_data_len":4410,"flow_min_l4_data_len":20,"flow_max_l4_data_len":698,"flow_avg_l4_data_len":84,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63349,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":779,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1536718202959,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":775,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":52,"flow_first_seen":1536717450091,"flow_last_seen":1536718053058,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":678,"flow_tot_l4_payload_len":3362,"flow_avg_l4_payload_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63349,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":779,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1536718202959,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00455{"flow_id":14,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":779,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718202,"pkt_ts_usec":959606,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AJD7JidrGLQwJjRACABFAABEMJoAAP8RJazAqPIPwKjyAc5xADUAMPGqwpsBAAABAAAAAAAADXdlYXZlLWxvZ3NpbmsEbmVzdANjb20AAAEAAQ=="} -00651{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":779,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1536718202959,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":779,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1536718202959,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00475{"flow_id":14,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":780,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718202,"pkt_ts_usec":959785,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"GLQwJjRAAJD7JidrCABFAABUb5VAAEARZaHAqPIBwKjyDwA1znEAQGW0wpuBgAABAAEAAAAADXdlYXZlLWxvZ3NpbmsEbmVzdANjb20AAAEAAcAMAAEAAQAAAHgABCO8mro="} -00679{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":780,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1536718202959,"flow_last_seen":1536718202959,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.188.154.186"}} -00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":781,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1536718202984,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63351,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00690{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":780,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1536718202959,"flow_last_seen":1536718202959,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"weave-logsink.nest.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"35.188.154.186"}} +00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":781,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1536718202984,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63351,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00423{"flow_id":15,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":781,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718202,"pkt_ts_usec":984094,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"AJD7JidrGLQwJjRACABFAAAsMJsAAP8GGgLAqPIPI7yauvd3K1cJJajVAAAAAGACEgBBYgAAAgQEgAAA"} 00422{"flow_id":15,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":782,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718203,"pkt_ts_usec":39605,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"GLQwJjRAAJD7JidrCABFAAAsAABAADcG0p0jvJq6wKjyDytX93fElurmCSWo1mASbvAz1wAAAgQFjA=="} 00422{"flow_id":15,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":783,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718203,"pkt_ts_usec":42198,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMJwAAP8GGgXAqPIPI7yauvd3K1cJJajWxJbq51AQEgCoXAAAAAAAAAAA"} @@ -223,7 +223,7 @@ 01336{"flow_id":15,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":786,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718203,"pkt_ts_usec":746505,"pkt_caplen":733,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":733,"pkt_l4_len":699,"pkt":"GLQwJjRAAJD7JidrCABFAALPdN9AADcGWxsjvJq6wKjyDytX93fElurnCSWq6FAYcRAtCAAApQIAE5aex7wEAAAAAjC0GDaeJwAAMLQYEAuxBgQAAACAOewBAAAE+rolzy+PcOFALB3XOjE\/1avQJZsiItI5DiyJBVIPcZITtPZ2XrnN0E3MfjNOspBvZsP5MHI\/arLVAAAEAAcANQEwAQgMb9c+DCmBkiQCBDcDJxMDAAAA7jC0GBgmBACuiCMmBf8bcyU3BicSBAAAAAIwtBgYJAcCJgglAFojMAo5BOmClNa2L\/0sqyhn7IYa235P1xw1ad7owBLnP8rLfG3TPA0dBMXfrzKvqAFyJ47sRlQQr3qOkdAiNYMpARg1gikBJAIFGDWEKQE2AgQCBAEYGDWBMAIIT2JdLEIid9IYNYAwAghAMCqAESxXYxg1DDABHQD2qSsI\/n0hou9Llf5n3GEbVWuc4D0QHq+l2F+wMAIcbFFqzYrI2WIn6D35aDg1LAuu7NZYbZZk\/HdXyxgYNwPVAAAEAAEAMAEIdFPE8yV1wKQkAgQ3AycTAQAAAO4wtBgYJgSEShYaJgWECPtJNwYnEwMAAADuMLQYGCQHAiYIJQBaIzAKOQRhOKp73vZWzVBkzcIvC7VHSn7kjE4w+wzb4SgMSIJb6yR4pk2B0279JwA\/5iu\/0TQlBvq00DFAwzWDKQEpAhg1gikBJAJgGDWBMAIIQDAqgBEsV2MYNYAwAghDNPcS31+Rzxg1DDABHBLqxXlajT9KXWeBN+P8uG5pHU6a1vmo\/i33mMIwAh0AjB981V9gPTa1niPXvZ7CDdMfpHD9c+6sh9daGBgYGBjVAAAEAAgAMAEdAKQ+FOL4Hy\/vAFY0N\/6Fb4IhwL51Reme7+2nNLcwAh0AxpKlk4REdfygt4LErdP64Xw0tzVxuYpvsCsKrhg00tOd8tGpjSpFtyy2jPZ48AQk5g=="} 00423{"flow_id":15,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":787,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718203,"pkt_ts_usec":812275,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMJ4AAP8GGgPAqPIPI7yauvd3K1cJJaroxJbtjlAQD1mmSgAAAAAAAAAA"} 00489{"flow_id":15,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":788,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718205,"pkt_ts_usec":132060,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"AJD7JidrGLQwJjRACABFAABcMJ8AAP8GGc7AqPIPI7yauvd3K1cJJaroxJbtjlAYD1k4qAAAMgAAExsDAAA2nicAADC0GAQAAAACMLQYEQyxBgQAAABDvk7v9shaoRVwWNA7hKpxzM+I7w=="} -00548{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":788,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":8,"flow_first_seen":1536718202984,"flow_last_seen":1536718205132,"flow_tot_l4_data_len":1429,"flow_min_l4_data_len":20,"flow_max_l4_data_len":699,"flow_avg_l4_data_len":178,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63351,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink.Google","breed":"Tracker\/Ads","category":"Cloud"}} +00559{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":788,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":8,"flow_first_seen":1536718202984,"flow_last_seen":1536718205132,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":679,"flow_tot_l4_payload_len":1261,"flow_avg_l4_payload_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63351,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink.Google","breed":"Tracker\/Ads","category":"Cloud"}} 00415{"flow_id":15,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":789,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718205,"pkt_ts_usec":230507,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAodOBAADcGXcEjvJq6wKjyDytX93fElu2OCSWrHFAQcRBEXwAA"} 00515{"flow_id":15,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":790,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718205,"pkt_ts_usec":232926,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":124,"pkt_l4_len":90,"pkt":"AJD7JidrGLQwJjRACABFAABuMKAAAP8GGbvAqPIPI7yauvd3K1cJJascxJbtjlAYD1lm9wAARAAQEwAAAAA2nicAADC0GAQAAAACMLQYyShOOcoezN7Yf362RQ73eqRmWfIt67XrBhmJNXUpK3Pc3PMt98c6L1fTQX8u\/w=="} 00416{"flow_id":15,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":791,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718205,"pkt_ts_usec":292870,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAodOFAADcGXcAjvJq6wKjyDytX93fElu2OCSWrYlAQcRBEGQAA"} @@ -231,7 +231,7 @@ 01038{"flow_id":15,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":793,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718205,"pkt_ts_usec":306592,"pkt_caplen":509,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":509,"pkt_l4_len":475,"pkt":"AJD7JidrGLQwJjRACABFAAHvMKEAAP8GGDnAqPIPI7yauvd3K1cJJatixJbtx1AYDyCARAAAxQEQEwEAAAA2nicAADC0GAQAAAACMLQYySim\/6WfDHyGhiYdkOdlffoUo+Ifpc1p5N2K5+L8oe31Ch6pwdfuUuAwXADSEGtH0AWRKDzXHJQUXtIfsfhk\/dOO\/P8MfUa7yj+4duxp+HzQRSQnbUKMWWJTc68VzUG6DtxH9F3a7neZ8jZnPvu9v9V1OYIY3\/pSKATwhNAM3o+tNJoWdA8sclQpsC0+nbA+qKxcY5GthBmQHi9wYGQrY1tkU2N7BSpvRLFFZENSy63DS1B+qeHaGLGpOK+KZAi1qFlF0DLrBmvYreuNJRrzWcJQmbaN+WhJrborLuntUQxFr99USFjOoG\/iLho1cuo4ncOqXf+Ihdd0TdjoHYMFa0a\/\/AGIWn0rBCW+ZL0L7xEUMnVdQ6O9MHcKTEAaYb7uqDneE6O6V\/yotDZzUKxTW5U4Vxzxa8N4O266kptCnUs0N+\/JeA25LOJkeHazeWdVfb+L5SvW7Xb9VtbwJIgILLYtSP6OIl2f8UpZvj4YXvA8Ucky4GpNjZOFWBrbL10SmY\/txKHJH7bgZUP7HA+gDvUAe4\/PZOW3M81k8M75cZYOAyQHtjCbTkP5EXMfwXQ="} 00496{"flow_id":15,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":794,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718205,"pkt_ts_usec":359195,"pkt_caplen":109,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":109,"pkt_l4_len":75,"pkt":"GLQwJjRAAJD7JidrCABFAABfdONAADcGXYcjvJq6wKjyDytX93fElu3HCSWtKVAYdUBzegAANQAQEwEAAAAEAAAAAjC0GDaeJwAAMLQYySigtyBx\/khTQjemURb\/Qs+w7XQP60GdxNpwF6Jvbg=="} 01038{"flow_id":15,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":795,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718205,"pkt_ts_usec":372654,"pkt_caplen":509,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":509,"pkt_l4_len":475,"pkt":"AJD7JidrGLQwJjRACABFAAHvMKIAAP8GGDjAqPIPI7yauvd3K1cJJa0pxJbt\/lAYDumVYQAAxQEQEwIAAAA2nicAADC0GAQAAAACMLQYySj2gOCU5OUe+hKIMqISfhEJUZTxcbRhi4Zjm1PMuTVRzBWgvxlv2kfHKDUXJqiAwSDszOCybiev996mpGlBr3j\/r6gkAXuuRTyK3GpQ0CWUcjk39\/UuNA8irC7ymwxtoIQR\/cEFeqZ9O4aMCKICY1hdU\/5p43y20AHxz8j0FZIBv3+wStJEGGAsh4rj0GpPc68V0HumhHqgdtBuLt7rMBKtOPn2\/Gw+M7o2ZPrvmOOmOmzogsyIUXeYyJQyQG2t8CgmTtOPP\/f7L3n8a9ulfVGBKMeiSf5CODdfiOrUGeloOWvjNLTHHsWwkGkEjIMEdNH06bog7hPXHOfxzQMBSxFnlLeaHgxvGX\/4Jo2iAnujkr7sBUWsbdpFQYhUIQ7MYT2sOFCheIiTAtuxz0jw9WCvA\/OnIhfzPXVEKc1zrQH6raizlc401D7XypPqQaAVqtGHQkteOcH2kSWTL8vmESxsXgKLwvkaYdy\/gF3RwED9N\/vMPX9AYIgnJeGGLpe0Xd3nH+TZovEmMCiLrOy95303Un1qCc9z9hOU7WdW9ULp75W6KJaBtsv742zp12g="} -00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":834,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1536718206572,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63352,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":834,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1536718206572,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63352,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00423{"flow_id":16,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":834,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718206,"pkt_ts_usec":572751,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"AJD7JidrGLQwJjRACABFAAAsMLcAAP8GYcHAqPIPI65S7fd4K1cJMSXhAAAAAGACEgAMJQAAAgQEgAAA"} 00423{"flow_id":16,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":836,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718206,"pkt_ts_usec":638073,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"GLQwJjRAAJD7JidrCABFAAAsAABAAC0GJHkjrlLtwKjyDytX93jm8XvxCTEl4mASaQNQ+QAAAgQFtA=="} 00424{"flow_id":16,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":837,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718206,"pkt_ts_usec":640512,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMLgAAP8GYcTAqPIPI65S7fd4K1cJMSXi5vF78lAQEgC\/uQAAAAAAAAAA"} @@ -240,7 +240,7 @@ 01330{"flow_id":16,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":840,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718207,"pkt_ts_usec":366595,"pkt_caplen":730,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":730,"pkt_l4_len":696,"pkt":"GLQwJjRAAJD7JidrCABFAALMfmpAAC0Go24jrlLtwKjyDytX93jm8XvyCTEn9lAYbOBedgAAogIAExwDAAADAAAAAjC0GDaeJwAAMLQYEAu0BgQAAACAOesBAAAEthqMnfUW\/DsSs2ZBrb5xyiDiJGp7OlnGvp5CN1Zk7qIg+9BHv3maqK+Z7juxIrD5FSIgTY9b08vVAAAEAAcANQEwAQgRAGNdWXuZjyQCBDcDJxMDAAAA7jC0GBgmBACuiCMmBf8bcyU3BicSAwAAAAIwtBgYJAcCJgglAFojMAo5BAmqnD2bjDiK3yLVcr2LQ\/iPmlWn\/iDHinq\/pRMoxaNQgTnwimtBL+qTiTQqENL2xrPIWxZjJGeRNYMpARg1gikBJAIFGDWEKQE2AgQCBAEYGDWBMAIISKnh4YvR26oYNYAwAghAMCqAESxXYxg1DDABHG7LEaIGSLUc\/M2D6faSCjZ4yyUajbt6l0larAowAhxg27mtYz94ldNAgb53O7UEnNbhJ3tZG9saSNIDGBg3A9UAAAQAAQAwAQh0U8TzJXXApCQCBDcDJxMBAAAA7jC0GBgmBIRKFhomBYQI+0k3BicTAwAAAO4wtBgYJAcCJgglAFojMAo5BGE4qnve9lbNUGTNwi8LtUdKfuSMTjD7DNvhKAxIglvrJHimTYHTbv0nAD\/mK7\/RNCUG+rTQMUDDNYMpASkCGDWCKQEkAmAYNYEwAghAMCqAESxXYxg1gDACCEM09xLfX5HPGDUMMAEcEurFeVqNP0pdZ4E34\/y4bmkdTprW+aj+LfeYwjACHQCMH3zVX2A9NrWeI9e9nsIN0x+kcP1z7qyH11oYGBgYGNUAAAQACAAwARwOKIaMj7AHHn28W7z1jBVQ5g8J6wcPUn3xdyV1MAIcTtSVXVMH9m+orRYlA0qN3K+rWiK1Cks0qUhJoRhvSZGUsTdXepfzXubz3x9z0QtdSQ=="} 00423{"flow_id":16,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":841,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718207,"pkt_ts_usec":571431,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMLoAAP8GYcLAqPIPI65S7fd4K1cJMSf25vF+llAQD1y9pQAAAAAAAAAA"} 00489{"flow_id":16,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":844,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718208,"pkt_ts_usec":745973,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"AJD7JidrGLQwJjRACABFAABcMLsAAP8GYY3AqPIPI65S7fd4K1cJMSf25vF+llAYD1x4sQAAMgAAEx0DAAA2nicAADC0GAMAAAACMLQYEQy0BgQAAABlWaDYahuGtY52hurUSkcTEusmsg=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":844,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":8,"flow_first_seen":1536718206572,"flow_last_seen":1536718208745,"flow_tot_l4_data_len":1428,"flow_min_l4_data_len":20,"flow_max_l4_data_len":696,"flow_avg_l4_data_len":178,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63352,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink","breed":"Acceptable","category":"Cloud"}} +00549{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":844,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":8,"flow_first_seen":1536718206572,"flow_last_seen":1536718208745,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":676,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63352,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink","breed":"Acceptable","category":"Cloud"}} 00415{"flow_id":16,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":845,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718208,"pkt_ts_usec":848594,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAofmtAAC0GphEjrlLtwKjyDytX93jm8X6WCTEoKlAQbOBf7QAA"} 00968{"flow_id":16,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":846,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718208,"pkt_ts_usec":855080,"pkt_caplen":458,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":458,"pkt_l4_len":424,"pkt":"AJD7JidrGLQwJjRACABFAAG8MLwAAP8GYCzAqPIPI65S7fd4K1cJMSgq5vF+llAYD1z7twAAkgEQEwAAAAA2nicAADC0GAMAAAACMLQY\/SjPGHtbzrmVM3CVhl+AppxaSp4IrDY\/GViBbkMEJhqQi8AE0eg3eSbmcZPne0bFQhcqnByR+n04bi1lhrXkktb2NfS\/5PP5eaYkIBZgm25qW5Fp1Ga\/VMqueGOabuvOeRpP9j+DYO8IGwYUUiVZ\/mwQgWjhAhnZsCm43UT224dGVvQTHKYTceZvqCK9BTKHTZ3l9FsXAjz6X1rM\/edH0f+Flw5iTkPqNuuBlfRgfj1KChJ4EUU40PGFsSsjNeQJRsPIsXg4acNpxv2OYIr1vrlm12zi9UhmPcznwojHO5tN0p++Neoe38ZDERKeC2xQkcqqE1lcieViJKkkqzkIIL+xhBD5GAwIng\/SPG0k1AVubK87SVJYDpHSw9HpudAp8VxQ7xl9oMtQLuGp2\/cetjEH0kX4LW+O4RVqmaS+hWJotP\/MEyr5ufVnhtVjGGAmKTFYw58T4oJGDFW1CAj03lrYcvS4yYYyXbhBUuct5Hh55XYizPwZ3DITyTk="} 00416{"flow_id":16,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":847,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718208,"pkt_ts_usec":920795,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAofmxAAC0GphAjrlLtwKjyDytX93jm8X6WCTEpvlAQcRBaKQAA"} @@ -248,7 +248,7 @@ 00585{"flow_id":16,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":849,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718208,"pkt_ts_usec":945900,"pkt_caplen":176,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":176,"pkt_l4_len":142,"pkt":"AJD7JidrGLQwJjRACABFAACiML0AAP8GYUXAqPIPI65S7fd4K1cJMSm+5vF+0lAYDyCI4wAAeAAQEwEAAAA2nicAADC0GAMAAAACMLQY\/ShK0JLmziBERUFnGG0cwYT5bCaOFhPKR4uycJ3vJGk8vwstkOwQb+MkapwZeHB+v5UdsgTG+DBzLtOB3L0zWSOlSNeHiCGqolQAqCBhm9+\/qzANLhbJTQB3xKp7uCIvees="} 01271{"flow_id":16,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":850,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718209,"pkt_ts_usec":9058,"pkt_caplen":683,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":683,"pkt_l4_len":649,"pkt":"GLQwJjRAAJD7JidrCABFAAKdfm5AAC0Go5kjrlLtwKjyDytX93jm8X7SCTEqOFAYcRDrOwAAcwIQEwEAAAADAAAAAjC0GDaeJwAAMLQY\/SjG21LhIa72I6MxufV\/e+zFbjYn88L8VGuYMHImo+YXoCEKyg6eNPc7YLFfCOr7EkERSelfsamWTS8cpNlR9e535EZICJFdTAKOg+iFKvvWn2lh7aCf3lssBRd33BwbB\/LDe\/r6hddy\/LsL7EafeDSLZCOkNRuZHVZTrU7itNxYetrUTLEDENkX5nzBmvGOiCPoqLZYBSNFAK5X1mXN3g7RSAi7jkcwe2roMoBnbzsqKFlpJDYBXTFmRv5xqfVSKoqbJj2BmjjLMujD7tk57ByiU8gMMayXLRlM+QNAHfjYGbrq\/SOiCBe0hVJ7t6oQv3nFBVFdI5tpEAGT1sDRlxdKzvLH3WoHN5Z8q9mO3bE40B7I0uFYzdg8c8ZU5AWoGkscU9eTIREJf\/Z0ESij5+8DxKftH8mOVjV7dVF1b\/LHUAkAezZFXcV7u3sjB73rzGT3C59IxWsbstKMlWXOpOHLNJh64m3\/iItTzAQK\/4qBPdQ6t4QQo+k5BsZtzSr4sR5oZggAQ\/Ylmg7w+QjP6ZR2jFjL9jPYGCB7JmE5EkDqZiDU9nF6kPWvgz4cAmBIk6JEsibjOWig9J9YRd2e2CP0+6ecPeQqmITCbUlz1K7iIXr1hsOFYS2WrpXt1kNCSifLiO\/ua97ANFXwkWpWEpYh72yDpqyOwdPCFq24QsBytqt5Kzl3AkU9YBl3J\/wtEUsDN\/uyS107Nq1NiFSoq23YH9na5iDWP5QEIvGGOgkri2FfatYHj6cijvbN3un7F7jDO3MLYNEQ2JXIv8MrcUtMB9eQRZIXohzlvDY="} 00423{"flow_id":16,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":851,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718209,"pkt_ts_usec":19114,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoML4AAP8GYb7AqPIPI65S7fd4K1cJMSo45vGBR1AQEgC2DgAAAAAAAAAA"} -00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":858,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1536718209313,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63353,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":858,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1536718209313,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63353,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00423{"flow_id":17,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":858,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718209,"pkt_ts_usec":313555,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"AJD7JidrGLQwJjRACABFAAAsMMIAAP8GGdvAqPIPI7yauvd5K1cJPKL3AAAAAGACEgBHJwAAAgQEgAAA"} 00423{"flow_id":17,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":860,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718209,"pkt_ts_usec":383517,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"GLQwJjRAAJD7JidrCABFAAAsAABAADcG0p0jvJq6wKjyDytX93le92HNCTyi+GASbvAoVQAAAgQFjA=="} 00423{"flow_id":17,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":861,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718209,"pkt_ts_usec":385963,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMMQAAP8GGd3AqPIPI7yauvd5K1cJPKL4XvdhzlAQEgCc2gAAAAAAAAAA"} @@ -257,7 +257,7 @@ 01334{"flow_id":17,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":864,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718210,"pkt_ts_usec":106767,"pkt_caplen":732,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":732,"pkt_l4_len":698,"pkt":"GLQwJjRAAJD7JidrCABFAALO1sRAADcG+TYjvJq6wKjyDytX93le92HOCTylDFAYcRDStgAApAIAE494s64EAAAAAjC0GDaeJwAAMLQYEAu6BgQAAACAOewBAAAEpdwFTFueXN+EhaRf\/GikvCTcPcKN3q0C5qwEiFaYj76TJKuVxqf0Y6m+cFvy3FOPDgMIy\/9mW2\/VAAAEAAcANQEwAQgMb9c+DCmBkiQCBDcDJxMDAAAA7jC0GBgmBACuiCMmBf8bcyU3BicSBAAAAAIwtBgYJAcCJgglAFojMAo5BOmClNa2L\/0sqyhn7IYa235P1xw1ad7owBLnP8rLfG3TPA0dBMXfrzKvqAFyJ47sRlQQr3qOkdAiNYMpARg1gikBJAIFGDWEKQE2AgQCBAEYGDWBMAIIT2JdLEIid9IYNYAwAghAMCqAESxXYxg1DDABHQD2qSsI\/n0hou9Llf5n3GEbVWuc4D0QHq+l2F+wMAIcbFFqzYrI2WIn6D35aDg1LAuu7NZYbZZk\/HdXyxgYNwPVAAAEAAEAMAEIdFPE8yV1wKQkAgQ3AycTAQAAAO4wtBgYJgSEShYaJgWECPtJNwYnEwMAAADuMLQYGCQHAiYIJQBaIzAKOQRhOKp73vZWzVBkzcIvC7VHSn7kjE4w+wzb4SgMSIJb6yR4pk2B0279JwA\/5iu\/0TQlBvq00DFAwzWDKQEpAhg1gikBJAJgGDWBMAIIQDAqgBEsV2MYNYAwAghDNPcS31+Rzxg1DDABHBLqxXlajT9KXWeBN+P8uG5pHU6a1vmo\/i33mMIwAh0AjB981V9gPTa1niPXvZ7CDdMfpHD9c+6sh9daGBgYGBjVAAAEAAgAMAEdAK\/uKm5gCnX5GPgtQmtyJtdm4by\/nu5rPV3odvEwAhw0T7c01v9Eq80XdECIdIMSPdhmII3Ei4TNKMJeGA7xedIT\/VYSz+GGny2vIXFJEaAp"} 00423{"flow_id":17,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":865,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718210,"pkt_ts_usec":319313,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoMMYAAP8GGdvAqPIPI7yauvd5K1cJPKUMXvdkdFAQD1qaxgAAAAAAAAAA"} 00490{"flow_id":17,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":866,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718211,"pkt_ts_usec":481806,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"AJD7JidrGLQwJjRACABFAABcMMcAAP8GGabAqPIPI7yauvd5K1cJPKUMXvdkdFAYD1pFFAAAMgAAEx8DAAA2nicAADC0GAQAAAACMLQYEQy6BgQAAAA9aelf8mf8Tn\/37x8FhSucKJKK0g=="} -00548{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":866,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":8,"flow_first_seen":1536718209313,"flow_last_seen":1536718211481,"flow_tot_l4_data_len":1430,"flow_min_l4_data_len":20,"flow_max_l4_data_len":698,"flow_avg_l4_data_len":178,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63353,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink.Google","breed":"Tracker\/Ads","category":"Cloud"}} +00559{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":866,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":8,"flow_first_seen":1536718209313,"flow_last_seen":1536718211481,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":678,"flow_tot_l4_payload_len":1262,"flow_avg_l4_payload_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63353,"dst_port":11095,"l4_proto":"tcp","ndpi": {"proto":"NestLogSink.Google","breed":"Tracker\/Ads","category":"Cloud"}} 00415{"flow_id":17,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":867,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718211,"pkt_ts_usec":608928,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAo1sVAADcG+9sjvJq6wKjyDytX93le92R0CTylQFAQcRA43AAA"} 00518{"flow_id":17,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":868,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718211,"pkt_ts_usec":614870,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":124,"pkt_l4_len":90,"pkt":"AJD7JidrGLQwJjRACABFAABuMMgAAP8GGZPAqPIPI7yauvd5K1cJPKVAXvdkdFAYD1oY5gAARAAQEwAAAAA2nicAADC0GAQAAAACMLQYciNF2\/rCGXkAU\/GKWBNxFPUOgHv\/N947RBM9x5UH\/ZArfs2InS4vq4FiF0IT5A=="} 00416{"flow_id":17,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":869,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718211,"pkt_ts_usec":682199,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAo1sZAADcG+9ojvJq6wKjyDytX93le92R0CTylhlAQcRA4lgAA"} @@ -265,9 +265,9 @@ 01035{"flow_id":17,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":871,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718211,"pkt_ts_usec":696975,"pkt_caplen":509,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":509,"pkt_l4_len":475,"pkt":"AJD7JidrGLQwJjRACABFAAHvMMkAAP8GGBHAqPIPI7yauvd5K1cJPKWGXvdkrVAYDyF8UAAAxQEQEwEAAAA2nicAADC0GAQAAAACMLQYciOWbJIyL0k3eBxZzg8L4vQfnvySlQsQgJY99Dz0FEI0DHNJPmOK63mv9oYNUsMTnsU3mqjZ4617gugnx3LGjw6E7PL5jOQrq8up309g3dNSYIlSZYOutV2i28fWQDqs6DC0saEsbqP76Bz4+naIL9zMHVnWP1ZcXsuX3PUVyDfejqu+4FP6a+MFZuP4+s5ELll9fmwdKfhXhz8eEyCyYL1Ls9\/MtPTzZ\/i34OEMZB1L\/cMv0YrC6g92eEyMFOqqSuBoAdmfFc16qSur\/1G8O3404yHUhoRdYAYH3O8tVrea6FpBmWoG9fHhsUGiATBwWW9FrrcqSO5u+ZVGX23JLkbgxk\/9kscVfQqgXES8Lsw4KfhlgZ5\/\/RFUBz68Eu3yMX9pdidI+GAfj2opXdJdw6wI3zgSH1YiJjvyem5MBcRcGIYp\/BEoHuSWrQRG3R1jvWihhmMpfhf4JokNzmNoBgGMrLTYzidDGSTlYhuYOpQ1snkwLHJwL6nupVvbvLaFz6E7AW0ATvtyNE2tlz1hvuPZVXFzNAqwFLD2+UUCaCSSEKBpTFHfkxu7GaMaoFc="} 00494{"flow_id":17,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":872,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718211,"pkt_ts_usec":769617,"pkt_caplen":109,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":109,"pkt_l4_len":75,"pkt":"GLQwJjRAAJD7JidrCABFAABf1shAADcG+6EjvJq6wKjyDytX93le92StCTynTVAYdUDImQAANQAQEwEAAAAEAAAAAjC0GDaeJwAAMLQYciOHPSLYgRLyu2n+U4RoIvtsCto1Vv3MASsILXTa6g=="} 00835{"flow_id":17,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":873,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536718211,"pkt_ts_usec":780553,"pkt_caplen":358,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":358,"pkt_l4_len":324,"pkt":"AJD7JidrGLQwJjRACABFAAFYMMoAAP8GGKfAqPIPI7yauvd5K1cJPKdNXvdk5FAYDupN2gAALgEQEwIAAAA2nicAADC0GAQAAAACMLQYciM5hBC5P4r9dMMg1bQyUdvnQDIgqzj6HyzLhe2nVHL2cZtCIAOy\/i3fp5bdXZf4nb6Z0Hyl3x8mWoq1TQfd6fNd1ksXs5ZtEBswWLadYtb7uhxyiyWy\/RUVIUyPQGm+k87r6rnmlRFnkNbkyTrA2AHngAgY9DPu1UpHpEWRv32WuifaIKE2k8ZpEXx8o3+g\/Fdos7xpGPY93\/5ENN7Q3HGTDs2Ff2eWLiUVELBS6F4aRSCi+W65fQuCFD\/qXEp+oih2Yf+3nrTQXpk0VxOmJDEapa+bT72vNbJAtA19E4jiA2zE4jQ4c\/offjX\/oaZIWGhcOLoEEr4q602246pqE7a\/wTlQ5vTZGy2Qols46ca4DMVeOQDMbQ=="} -00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":886,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":32,"flow_first_seen":1536718052990,"flow_last_seen":1536718206634,"flow_tot_l4_data_len":4010,"flow_min_l4_data_len":20,"flow_max_l4_data_len":697,"flow_avg_l4_data_len":125,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63350,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":886,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":49,"flow_first_seen":1536718202984,"flow_last_seen":1536718206546,"flow_tot_l4_data_len":10447,"flow_min_l4_data_len":20,"flow_max_l4_data_len":699,"flow_avg_l4_data_len":213,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63351,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":886,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":20,"flow_first_seen":1536718209313,"flow_last_seen":1536718211968,"flow_tot_l4_data_len":2666,"flow_min_l4_data_len":20,"flow_max_l4_data_len":698,"flow_avg_l4_data_len":133,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63353,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":892,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1536718202959,"flow_last_seen":1536718202959,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":96,"flow_first_seen":1536718206572,"flow_last_seen":1536719715232,"flow_tot_l4_data_len":5774,"flow_min_l4_data_len":20,"flow_max_l4_data_len":696,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63352,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":886,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":32,"flow_first_seen":1536718052990,"flow_last_seen":1536718206634,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":677,"flow_tot_l4_payload_len":3362,"flow_avg_l4_payload_len":105,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63350,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":886,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":49,"flow_first_seen":1536718202984,"flow_last_seen":1536718206546,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":679,"flow_tot_l4_payload_len":9459,"flow_avg_l4_payload_len":193,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63351,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":886,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":20,"flow_first_seen":1536718209313,"flow_last_seen":1536718211968,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":678,"flow_tot_l4_payload_len":2258,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63353,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":892,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1536718202959,"flow_last_seen":1536718202959,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":96,"flow_first_seen":1536718206572,"flow_last_seen":1536719715232,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":676,"flow_tot_l4_payload_len":3846,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63352,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00135{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1000,"source":"nest_log_sink.pcap","alias":"nDPId-test"} |