Fixed invalid "flow_last_seen" timestamp for the first packet.

 * After the first packet was processed, "flow_last_seen" was still 0.
   This behaviour is invalid as the first packet may contain l4 payload data e.g. for UDP
   and it also breaks nDPId json consistency "flow_first_seen" > 0, but "flow_last_seen" == 0.
 * JSON schema: set minimum timestamp value for Epoch timestamps to 24710 for flow_*_seen and
   1 for pcap packet ts. Those values are dependant on some manipulated pcap's in libnDPI/tests/pcap.

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 10 insertions, 10 deletions

diff --git a/test/results/rx.pcap.out b/test/results/rx.pcap.out
index cc12b400a..b6fe8c18b 100644
--- a/test/results/rx.pcap.out
+++ b/test/results/rx.pcap.out
@@ -1,25 +1,25 @@
 00470{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"rx.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":10000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
-00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"rx.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1460647264018,"flow_last_seen":0,"flow_min_l4_payload_len":292,"flow_max_l4_payload_len":292,"flow_tot_l4_payload_len":292,"flow_avg_l4_payload_len":292,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":41559,"dst_port":7002,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"rx.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1460647264018,"flow_last_seen":1460647264018,"flow_min_l4_payload_len":292,"flow_max_l4_payload_len":292,"flow_tot_l4_payload_len":292,"flow_avg_l4_payload_len":292,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":41559,"dst_port":7002,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00781{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647264,"pkt_ts_usec":18403,"pkt_caplen":334,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":334,"pkt_l4_len":300,"pkt":"PIqwbTfwAAjK968mCABFAAFA5\/AAAEARo32DctuowKfOfKJXG1oBLBrkVw+1YFw\/yYgAAAABAAAAAQAAAAEBBQAAAAAASQAAAfgAAAABAAAAZwAAAGkAAABvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
-00515{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"rx.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1460647264018,"flow_last_seen":0,"flow_min_l4_payload_len":292,"flow_max_l4_payload_len":292,"flow_tot_l4_payload_len":292,"flow_avg_l4_payload_len":292,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":41559,"dst_port":7002,"l4_proto":"udp","ndpi": {"proto":"RX","breed":"Acceptable","category":"RPC"}}
+00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"rx.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1460647264018,"flow_last_seen":1460647264018,"flow_min_l4_payload_len":292,"flow_max_l4_payload_len":292,"flow_tot_l4_payload_len":292,"flow_avg_l4_payload_len":292,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":41559,"dst_port":7002,"l4_proto":"udp","ndpi": {"proto":"RX","breed":"Acceptable","category":"RPC"}}
 00433{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647264,"pkt_ts_usec":26287,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"AAjK968mPIqwbTfwCABFAABAOykAADoRV0XAp858g3LbqBtaolcALPkKVw+1YFw\/yYgAAAABAAAAAQAAAAEBBAAAAAAASQAAAAEAACcR"}
 00476{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647264,"pkt_ts_usec":26325,"pkt_caplen":107,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":107,"pkt_l4_len":73,"pkt":"PIqwbTfwAAjK968mCABFAABd5\/IAAEARpF6DctuowKfOfKJXG1oASRKnVw+1YFw\/yYgAAAABAAAAAAAAAAICIQAAAAAASQAAAAAAAAACAAAAAQAAAAAIAAAAAAAAFjwAAAWkAAAAIAAAAAQ="}
-00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4,"source":"rx.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1460647283326,"flow_last_seen":0,"flow_min_l4_payload_len":292,"flow_max_l4_payload_len":292,"flow_tot_l4_payload_len":292,"flow_avg_l4_payload_len":292,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":38331,"dst_port":7002,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4,"source":"rx.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1460647283326,"flow_last_seen":1460647283326,"flow_min_l4_payload_len":292,"flow_max_l4_payload_len":292,"flow_tot_l4_payload_len":292,"flow_avg_l4_payload_len":292,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":38331,"dst_port":7002,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00780{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647283,"pkt_ts_usec":326954,"pkt_caplen":334,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":334,"pkt_l4_len":300,"pkt":"PIqwbTfwAAjK968mCABFAAFA6DUAAEARoziDctuowKfOfJW7G1oBLLHjVw+1c1wtPyQAAAABAAAAAQAAAAEBBQAAAAAASQAAAfgAAAABAAAAZwAAAGkAAABvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
-00515{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"rx.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1460647283326,"flow_last_seen":0,"flow_min_l4_payload_len":292,"flow_max_l4_payload_len":292,"flow_tot_l4_payload_len":292,"flow_avg_l4_payload_len":292,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":38331,"dst_port":7002,"l4_proto":"udp","ndpi": {"proto":"RX","breed":"Acceptable","category":"RPC"}}
+00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"rx.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1460647283326,"flow_last_seen":1460647283326,"flow_min_l4_payload_len":292,"flow_max_l4_payload_len":292,"flow_tot_l4_payload_len":292,"flow_avg_l4_payload_len":292,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":38331,"dst_port":7002,"l4_proto":"udp","ndpi": {"proto":"RX","breed":"Acceptable","category":"RPC"}}
 00433{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647283,"pkt_ts_usec":340393,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"AAjK968mPIqwbTfwCABFAABATVwAADoRRRLAp858g3LbqBtalbsALJAKVw+1c1wtPyQAAAABAAAAAQAAAAEBBAAAAAAASQAAAAEAACcR"}
 00475{"flow_id":2,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647283,"pkt_ts_usec":340531,"pkt_caplen":107,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":107,"pkt_l4_len":73,"pkt":"PIqwbTfwAAjK968mCABFAABd6DcAAEARpBmDctuowKfOfJW7G1oASammVw+1c1wtPyQAAAABAAAAAAAAAAICIQAAAAAASQAAAAAAAAACAAAAAQAAAAAIAAAAAAAAFjwAAAWkAAAAIAAAAAQ="}
-00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7,"source":"rx.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1460647299605,"flow_last_seen":0,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":7001,"dst_port":7003,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7,"source":"rx.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1460647299605,"flow_last_seen":1460647299605,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":7001,"dst_port":7003,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00449{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647299,"pkt_ts_usec":605656,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"PIqwbTfwAAjK968mCABFAABM9uIAAEARlX+DctuowKfOfBtZG1sAOL9z1w+zMFwiT6wAAAABAAAAAQAAAAEBBQAAAAAANAAAAg8AAAAJcm9vdC5jZWxsAAAA"}
-00510{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"rx.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1460647299605,"flow_last_seen":0,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":7001,"dst_port":7003,"l4_proto":"udp","ndpi": {"proto":"RX","breed":"Acceptable","category":"RPC"}}
+00522{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"rx.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1460647299605,"flow_last_seen":1460647299605,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":7001,"dst_port":7003,"l4_proto":"udp","ndpi": {"proto":"RX","breed":"Acceptable","category":"RPC"}}
 01853{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647299,"pkt_ts_usec":669561,"pkt_caplen":1118,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1118,"pkt_l4_len":1084,"pkt":"AAjK968mPIqwbTfwCABFAARQURUAADoRPUnAp858g3LbqBtbG1kEPOsl1w+zMFwiT6wAAAABAAAAAQAAAAEBBAAAAAAANAAAAHIAAABvAAAAbwAAAHQAAAAuAAAAYwAAAGUAAABsAAAAbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwBuMngAAEMHAAAfwf\/\/\/6MAAAAlAAAAAQAAAAEAAAAAAAAAf\/\/\/\/6oAAAB3AIQN5gAA+50AABAS\/\/\/\/mP\/\/\/4QAAAABAAAAAQAAAAAAAAB\/\/\/\/\/qgAAAHcAbjJ4AABDBwAAH8H\/\/\/+jAAAAJQAAAAEAAAABAAAAAAAAAH\/\/\/\/+qAAAAdwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwAAAA8AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUAAAAEgAAABIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAyAAAAROcGeMAAAAAAAAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="}
 00475{"flow_id":3,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647299,"pkt_ts_usec":669639,"pkt_caplen":107,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":107,"pkt_l4_len":73,"pkt":"PIqwbTfwAAjK968mCABFAABd9usAAEARlWWDctuowKfOfBtZG1sASZXi1w+zMFwiT6wAAAABAAAAAAAAAAICIQAAAAAANAAAAAAAAAACAAAAAQAAAAAIAAAAAAAAFjwAAAWkAAAAIAAAAAQ="}
 00523{"flow_id":3,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647299,"pkt_ts_usec":669661,"pkt_caplen":134,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":134,"pkt_l4_len":100,"pkt":"PIqwbTfwAAjK968mCABFAAB49uwAAEARlUmDctuowKfOfBtZG1sAZAqx1w+zMFwiT6wAAAACAAAAAQAAAAMBBQAAAAAANAAAAhUAAAAEAAAAAAAAAAAAAAAAAG4yeAAAQwcAAB\/B\/\/\/\/owAAACUAAAABAAAAAQAAAAAAAAB\/\/\/\/\/qgAAAHc="}
 00515{"flow_id":3,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647299,"pkt_ts_usec":704559,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"pkt":"AAjK968mPIqwbTfwCABFAAB0USMAADoRQRfAp858g3LbqBtbG1kAYH0p1w+zMFwiT6wAAAACAAAAAQAAAAIBBAAAAAAANABuMngAAEMHAAAfwf\/\/\/6MAAAAlAAAAAQAAAAEAAAAAAAAAf\/\/\/\/6oAAAB3AAAADwAAAAEAAAABwKfO8Q=="}
 00476{"flow_id":3,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647299,"pkt_ts_usec":704698,"pkt_caplen":107,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":107,"pkt_l4_len":73,"pkt":"PIqwbTfwAAjK968mCABFAABd9vEAAEARlV+DctuowKfOfBtZG1sASZXf1w+zMFwiT6wAAAACAAAAAAAAAAQCIQAAAAAANAAAAAAAAAACAAAAAQAAAAAIAAAAAAAAFjwAAAWkAAAAIAAAAAQ="}
-00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":13,"source":"rx.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1460647299704,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.241","src_port":7001,"dst_port":7000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":13,"source":"rx.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1460647299704,"flow_last_seen":1460647299704,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.241","src_port":7001,"dst_port":7000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00430{"flow_id":4,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647299,"pkt_ts_usec":704750,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PIqwbTfwAAjK968mCABFAAA8LUMAAEARXrqDctuowKfO8RtZG1gAKKMX1w+zMFwiT7AAAAABAAAAAQAAAAEBBQAAAAAAAQABAAQ="}
-00511{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":13,"source":"rx.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1460647299704,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.241","src_port":7001,"dst_port":7000,"l4_proto":"udp","ndpi": {"proto":"RX","breed":"Acceptable","category":"RPC"}}
+00523{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":13,"source":"rx.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1460647299704,"flow_last_seen":1460647299704,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.241","src_port":7001,"dst_port":7000,"l4_proto":"udp","ndpi": {"proto":"RX","breed":"Acceptable","category":"RPC"}}
 00476{"flow_id":4,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647299,"pkt_ts_usec":782295,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"AAjK968mPIqwbTfwCABFAABeF80AADoReg7Ap87xg3LbqBtYG1kASo9g1w+zMFwiT7AAAAABAAAAAAAAAAECIgAAAAAAAQAAAAAAAAABAAAAAQAAAAAGAQEAAAAAAAWkAAAFpAAAABAAAAAB"}
 00476{"flow_id":4,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647299,"pkt_ts_usec":782351,"pkt_caplen":107,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":107,"pkt_l4_len":73,"pkt":"PIqwbTfwAAjK968mCABFAABdLVQAAEARXoiDctuowKfO8RtZG1gASaag1w+zMFwiT7AAAAABAAAAAAAAAAICIQAAAAAAAQAAAAAAAAABAAAAAAAAAAEHAAAAAAAAFjwAAAWkAAAAEAAAAAQ="}
 00432{"flow_id":4,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647299,"pkt_ts_usec":839343,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AAjK968mPIqwbTfwCABFAAA8F9AAADoRei3Ap87xg3LbqBtYG1kAKJ5Np\/AZ\/luoHUgAAAABAAAAAQAAAAEBBQAAAAAAAQABAAI="}
@@ -33,9 +33,9 @@
 00525{"flow_id":3,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647299,"pkt_ts_usec":944979,"pkt_caplen":134,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":134,"pkt_l4_len":100,"pkt":"PIqwbTfwAAjK968mCABFAAB49wkAAEARlSyDctuowKfOfBtZG1sAZIbt1w+zMFwiT6wAAAADAAAAAQAAAAUBBQAAAAAANAAAAhUAAAAEAAAAAAAAAAAAAAAAAIQN5gAA+50AABAS\/\/\/\/mP\/\/\/4QAAAABAAAAAQAAAAAAAAB\/\/\/\/\/qgAAAHc="}
 00518{"flow_id":3,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":25,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647299,"pkt_ts_usec":986824,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"pkt":"AAjK968mPIqwbTfwCABFAAB0UV4AADoRQNzAp858g3LbqBtbG1kAYPnb1w+zMFwiT6wAAAADAAAAAQAAAAMBBAAAAAAANACEDeYAAPudAAAQEv\/\/\/5j\/\/\/+EAAAAAQAAAAEAAAAAAAAAf\/\/\/\/6oAAAB3AAAADwAAAAEAAAABwKfOfA=="}
 00476{"flow_id":3,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":26,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647299,"pkt_ts_usec":986934,"pkt_caplen":107,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":107,"pkt_l4_len":73,"pkt":"PIqwbTfwAAjK968mCABFAABd9w4AAEARlUKDctuowKfOfBtZG1sASZXc1w+zMFwiT6wAAAADAAAAAAAAAAYCIQAAAAAANAAAAAAAAAACAAAAAQAAAAAIAAAAAAAAFjwAAAWkAAAAIAAAAAQ="}
-00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":27,"source":"rx.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1460647299986,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":7001,"dst_port":7000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":27,"source":"rx.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1460647299986,"flow_last_seen":1460647299986,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":7001,"dst_port":7000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00430{"flow_id":5,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":27,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647299,"pkt_ts_usec":986990,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PIqwbTfwAAjK968mCABFAAA89w8AAEARlWKDctuowKfOfBtZG1gAKKOI1w+zMFwiT7QAAAABAAAAAQAAAAEBBQAAAAAAAQABAAQ="}
-00511{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":27,"source":"rx.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1460647299986,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":7001,"dst_port":7000,"l4_proto":"udp","ndpi": {"proto":"RX","breed":"Acceptable","category":"RPC"}}
+00523{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":27,"source":"rx.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1460647299986,"flow_last_seen":1460647299986,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":7001,"dst_port":7000,"l4_proto":"udp","ndpi": {"proto":"RX","breed":"Acceptable","category":"RPC"}}
 00475{"flow_id":5,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":28,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647300,"pkt_ts_usec":17623,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"AAjK968mPIqwbTfwCABFAABeUWIAADoRQO7Ap858g3LbqBtYG1kASjJ01w+zMFwiT7QAAAABAAAAAAAAAAECIgAAXV0AAQAAAAAAAAABAAAAAQAAAAAGAQEAAAAAAAWkAAAFpAAAABAAAAAB"}
 00475{"flow_id":5,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":29,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647300,"pkt_ts_usec":17672,"pkt_caplen":107,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":107,"pkt_l4_len":73,"pkt":"PIqwbTfwAAjK968mCABFAABd9xIAAEARlT6DctuowKfOfBtZG1gASacR1w+zMFwiT7QAAAABAAAAAAAAAAICIQAAAAAAAQAAAAAAAAABAAAAAAAAAAEHAAAAAAAAFjwAAAWkAAAAEAAAAAQ="}
 00430{"flow_id":5,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":30,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647300,"pkt_ts_usec":35276,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AAjK968mPIqwbTfwCABFAAA8UWMAADoRQQ\/Ap858g3LbqBtYG1kAKDk4na9LKFupW+gAAAABAAAAAQAAAAEBBQAAAAAAAQABAAI="}