Use layer4 specific flow timeouts.

 * default values "stolen" from nf_conntrack

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 37 insertions, 19 deletions

diff --git a/test/results/sip.pcap.out b/test/results/sip.pcap.out
index fde8ed981..093d69a46 100644
--- a/test/results/sip.pcap.out
+++ b/test/results/sip.pcap.out
@@ -1,4 +1,4 @@
-00380{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"sip.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
+00471{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"sip.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
 00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"sip.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1120469572844,"flow_last_seen":0,"flow_tot_l4_data_len":475,"flow_min_l4_data_len":475,"flow_max_l4_data_len":475,"flow_avg_l4_data_len":475,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.35","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 01013{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120469572,"pkt_ts_usec":844249,"pkt_caplen":509,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":509,"pkt_l4_len":475,"pkt":"ADBUADRWAODtAW69CABFAAHvaZgAAIARF6bAqAEC1PIhIxPEE8QB2272UkVHSVNURVIgc2lwOnNpcC5jeWJlcmNpdHkuZGsgU0lQLzIuMA0KVmlhOiBTSVAvMi4wL1VEUCAxOTIuMTY4LjEuMjticmFuY2g9ejloRzRiS25wMTUxMjQ4NzM3LTQ2ZWE3MTVlMTkyLjE2OC4xLjI7cnBvcnQNCkZyb206IDxzaXA6dm9pMTgwNjNAc2lwLmN5YmVyY2l0eS5kaz47dGFnPTkwM2RmMGENClRvOiA8c2lwOnZvaTE4MDYzQHNpcC5jeWJlcmNpdHkuZGs+DQpDYWxsLUlEOiA1NzgyMjI3MjktNDY2NWQ3NzVANTc4MjIyNzMyLTQ2NjVkNzcyDQpDb250YWN0OiAgPHNpcDp2b2kxODA2M0AxOTIuMTY4LjEuMjo1MDYwO2xpbmU9OWM3ZDJkYmQ4ODIyMDEzYz47ZXhwaXJlcz0xMjAwO3E9MC41MDANCkV4cGlyZXM6IDEyMDANCkNTZXE6IDY4IFJFR0lTVEVSDQpDb250ZW50LUxlbmd0aDogMA0KTWF4LUZvcndhcmRzOiA3MA0KVXNlci1BZ2VudDogTmVybyBTSVBQUyBJUCBQaG9uZSBWZXJzaW9uIDIuMC41MS4xNg0KDQo="}
 00499{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"sip.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1120469572844,"flow_last_seen":0,"flow_tot_l4_data_len":475,"flow_min_l4_data_len":475,"flow_max_l4_data_len":475,"flow_avg_l4_data_len":475,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.35","src_port":5060,"dst_port":5060,"l4_proto":"udp","ndpi": {"proto":"SIP","breed":"Acceptable","category":"VoIP"}}
@@ -33,22 +33,40 @@
 00891{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":35,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470098,"pkt_ts_usec":867648,"pkt_caplen":417,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":417,"pkt_l4_len":383,"pkt":"ADBUADRWAODtAW69CABFAAGTao0AAIARzIzAqAECyER4URPEE8QBf5mcQ0FOQ0VMIHNpcDo5NzIzOTI4NzA0NEB2b2lwLmJydWp1bGEubmV0IFNJUC8yLjANClZpYTogU0lQLzIuMC9VRFAgMTkyLjE2OC4xLjI7YnJhbmNoPXo5aEc0YktucDEwNDk4NDA1My00NGNlNGE0MTE5Mi4xNjguMS4yO3Jwb3J0DQpGcm9tOiAiYXJpayIgPHNpcDo4MTY2NjZAdm9pcC5icnVyanVsYS5uZXQ+O3RhZz02NDMzZWY5DQpUbzogPHNpcDo5NzIzOTI4NzA0NEB2b2lwLmJydWp1bGEubmV0Pg0KQ2FsbC1JRDogMTA1MDkwMjU5LTQ0NmZhZjdhQDE5Mi4xNjguMS4yDQpDU2VxOiAxIENBTkNFTA0KQ29udGVudC1MZW5ndGg6IDANCk1heC1Gb3J3YXJkczogNzANClVzZXItQWdlbnQ6IE5lcm8gU0lQUFMgSVAgUGhvbmUgVmVyc2lvbiAyLjAuNTEuMTYNCg0K"}
 00891{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":37,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470102,"pkt_ts_usec":883325,"pkt_caplen":417,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":417,"pkt_l4_len":383,"pkt":"ADBUADRWAODtAW69CABFAAGTapAAAIARzInAqAECyER4URPEE8QBf5mcQ0FOQ0VMIHNpcDo5NzIzOTI4NzA0NEB2b2lwLmJydWp1bGEubmV0IFNJUC8yLjANClZpYTogU0lQLzIuMC9VRFAgMTkyLjE2OC4xLjI7YnJhbmNoPXo5aEc0YktucDEwNDk4NDA1My00NGNlNGE0MTE5Mi4xNjguMS4yO3Jwb3J0DQpGcm9tOiAiYXJpayIgPHNpcDo4MTY2NjZAdm9pcC5icnVyanVsYS5uZXQ+O3RhZz02NDMzZWY5DQpUbzogPHNpcDo5NzIzOTI4NzA0NEB2b2lwLmJydWp1bGEubmV0Pg0KQ2FsbC1JRDogMTA1MDkwMjU5LTQ0NmZhZjdhQDE5Mi4xNjguMS4yDQpDU2VxOiAxIENBTkNFTA0KQ29udGVudC1MZW5ndGg6IDANCk1heC1Gb3J3YXJkczogNzANClVzZXItQWdlbnQ6IE5lcm8gU0lQUFMgSVAgUGhvbmUgVmVyc2lvbiAyLjAuNTEuMTYNCg0K"}
 00891{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":38,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470106,"pkt_ts_usec":888846,"pkt_caplen":417,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":417,"pkt_l4_len":383,"pkt":"ADBUADRWAODtAW69CABFAAGTapEAAIARzIjAqAECyER4URPEE8QBf5mcQ0FOQ0VMIHNpcDo5NzIzOTI4NzA0NEB2b2lwLmJydWp1bGEubmV0IFNJUC8yLjANClZpYTogU0lQLzIuMC9VRFAgMTkyLjE2OC4xLjI7YnJhbmNoPXo5aEc0YktucDEwNDk4NDA1My00NGNlNGE0MTE5Mi4xNjguMS4yO3Jwb3J0DQpGcm9tOiAiYXJpayIgPHNpcDo4MTY2NjZAdm9pcC5icnVyanVsYS5uZXQ+O3RhZz02NDMzZWY5DQpUbzogPHNpcDo5NzIzOTI4NzA0NEB2b2lwLmJydWp1bGEubmV0Pg0KQ2FsbC1JRDogMTA1MDkwMjU5LTQ0NmZhZjdhQDE5Mi4xNjguMS4yDQpDU2VxOiAxIENBTkNFTA0KQ29udGVudC1MZW5ndGg6IDANCk1heC1Gb3J3YXJkczogNzANClVzZXItQWdlbnQ6IE5lcm8gU0lQUFMgSVAgUGhvbmUgVmVyc2lvbiAyLjAuNTEuMTYNCg0K"}
-00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":69,"source":"sip.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":18,"flow_first_seen":1120470049188,"flow_last_seen":1120470116279,"flow_tot_l4_data_len":8900,"flow_min_l4_data_len":355,"flow_max_l4_data_len":830,"flow_avg_l4_data_len":494,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"200.68.120.81","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":95,"source":"sip.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1120470985348,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30000,"dst_port":40392,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00623{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":95,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":348411,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIa\/wAAIARFmjAqAEC1PIhJHUwncgAtBjegAhvrgAABNg3lstx1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1REEHBgYEhIeEBQXahMcGAQEBQYBAQAHBQUZEwUbGRATGQUEBAcDAgMDAAACDQ0NAAEDDQwNAAABAgMBBgYBDw4ODAMABwYAAwMGBwEEBgYbHxwRaWBiFREQFGoTFWBpYX10UltZ10dcVlJVREtCdVlzeFp8bmgUag=="}
-00503{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":95,"source":"sip.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1120470985348,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30000,"dst_port":40392,"l4_proto":"udp","ndpi": {"proto":"RTP","breed":"Acceptable","category":"Media"}}
-00626{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":96,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":418358,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIa\/0AAIARFmfAqAEC1PIhJHUwncgAtL+rgAhvrwAABXg3lstxbmgVFGoUFBVpYG5qbG5kbGoWF2xubWBmfn9Fxsnw\/Ofz+uXwy\/H2z83k+sJTdF9CW\/bw8vzg7pfo8ldaT011Z399ZmV0dUN4S0dVQ2dmbWNsZGZkeGRvbxQUbBcRExAXEBwfHRAQFhAQHxwfGR4YEBcSFGxibWNqFRUXbmV3ckDQ93N9fmJnYmoVahcVZUNxWll+YGZ6cnJJZXpgeF1EQg=="}
-00626{"flow_id":3,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":97,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":421891,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIa\/4AAIARFmbAqAEC1PIhJHUwncgAtNyMgAhvsAAABhg3lstxcX5wdtbF0Et0dn92T1BB0VhmZ2V\/Z294Y2ZmahQXFhQREBAVb2ZPemVlYWJoYE9\/YWZkcnV4bWwVFRVqZ2xpYn94ZmBnY2F0zfjXdmNiYXhveHJgaW5jUFlwZW1kYWdlamoREhAQEx4fHx0XahRvRl1F3V5ESdbQxFFR39TfQXR\/Z9L15ebs6JeW7+DslJOU6uqUn5CcnJKX+Ofs5+Hg6g=="}
-00624{"flow_id":3,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":98,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":427557,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIa\/8AAIARFmXAqAEC1PIhJHUwncgAtJlvgAhvsQAABrg3lstxkpfo6Zfq5frn5uz6+sB4emFkcGBneMvv7+rslZHu5OLqkpKdkpCUlZGcnpuHh4GAgoODgYGGhoGBgIGDg4GAhoSFhZ6ZhYSFhYeHhoWFhICCgIOBmJyQnZ+Yn5CW6u7s6e7ol+ji7vrcWtzJ8\/Lz9ujq7u6XkZaWkZ2Ym5iFh4aGhZyemZ6fmZ+fk5OfhYeEk5STk5eU6fj3T1hDVM9BQg=="}
-00628{"flow_id":3,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":99,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":429664,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIbAAAAIARFmTAqAEC1PIhJHUwncgAtMoSgAhvsgAAB1g3lstxRH1wVt719vLg7uHxw3h4ZGRhfE9UWV\/Rz+Dt5\/PklJOUlJXt4uzx+Pjm5PPHzf38\/fr05+3ikurj4ezn4+H6\/97AwEJ8S9DN9Vd1XdzJ8eDp6eXwzcXWRUJnZHhnYX96aHLW+ubo6eHg5\/DG\/MNRcE3B+ubNy+Xu7Obt7+qX6u7oy9fw3vLT3N1W19X49PBBf39jZnhmbBEdEWpqb2BweA=="}
-00628{"flow_id":3,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":100,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":464477,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIbAEAAIARFmPAqAEC1PIhJHUwncgAtHeogAhvswAAB\/g3lstxZWVmFB0cBQQHBwQbHxZgY21iFGpoFRdvFxMWEBAdFhEQFhcREBVoam1hbmNjFBYQHx4SHRYWEh0XaW0VaWR\/aGoUF2liaBEUFm9mZm1hbWgVER0ZHB0fHRsbHhwdHxgbGREVbmoUEhsFBBgFGx0TFmx6cUZxZWZoaXJ2cmoTExESExRqZFPLyfH47frj+svP1PT6X0\/RW0t\/SXVUy\/7m7A=="}
-00629{"flow_id":3,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":101,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":466372,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIbAIAAIARFmLAqAEC1PIhJHUwncgAtKmigAhvtAAACJg3lstx5NneS0l8Y2kVYm9oFW9tbW1jZWRyc3hvZmpoaGpjaHpzTXRnen5Z2l1FzdHU0dvZy+zx3Pzm7peVlZeX7unjw\/P09\/Xz4fzz9c3C9uXl+vP2Wkl0aG1mZ0twR1TQWU1PflrBy\/PBR3BkZ2ZsZHN6YWRyeHXH4\/\/x8U1W\/Nb15ezv7pWRkJ2FmZubhYWEhZiZm4SFhISYnoWbhISbnJaXlw=="}
-00627{"flow_id":3,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":102,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":504000,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIbAMAAIARFmHAqAEC1PIhJHUwncgAtLaDgAhvtQAACTg3lstx6urs5ueUkJOXlZGWlOyVlOD46O7hzXXbxsfz\/OLg5ufawPH4wk3N8Obu7+Pv6unk4fj\/29jZ1\/7l4+Ht7JOXlOrs4vPPUfVQz97J5fLjl5GXkpyRl+jqk5aQlero4uLh7+rslJfp6uP+9vbL+OLg5vj99\/LL9ub4+uTs6ZSVlJXp6Ojv7eqWkZOTnJORkpCTk5GXlpaRkJCW6erp7JWXlw=="}
-00627{"flow_id":3,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":103,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":511036,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIbAQAAIARFmDAqAEC1PIhJHUwncgAtIfqgAhvtgAACdg3lstxlpDplp2cmZ6fkpaRle3n9PTy\/PyVkZKehIeEmJGRl52QlJaX6OOU6JaRlp2cn4WEhZ2RkJeV6ZaQnZ6EhJuFh4WFmYWYk5+dkpCQ6u\/qkZ2fmYSYnZ6Rk5OU7OD6+Pbh4PTl+OTo6unl9eXi7f7c1VT\/+uiX6JSUkJCV7uXm\/Obu7pWWkZeW7OPpk5Ofm5+Yk5WV7untlJeSkpeV7+qWkA=="}
-00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":104,"source":"sip.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1120470986363,"flow_last_seen":0,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30001,"dst_port":40393,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00531{"flow_id":4,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":104,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470986,"pkt_ts_usec":363611,"pkt_caplen":146,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":146,"pkt_l4_len":112,"pkt":"ADBUADRWAODtAW69CABFAACEbAUAAIARFqPAqAEC1PIhJHUxnckAcCyBgMgABjeWy3FCyQfKXvrGAwAAJMMAAAAJAAAGDIHKAAs3lstxAR0xMTg5NDI5Ny00NDMyYTlmOEAxOTIuMTY4LjEuMgYFU0lQUFMAAIHLAAY3lstxEHNlc3Npb24gc2h1dGRvd24AAAA="}
-00504{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":104,"source":"sip.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1120470986363,"flow_last_seen":0,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30001,"dst_port":40393,"l4_proto":"udp","ndpi": {"proto":"RTCP","breed":"Acceptable","category":"VoIP"}}
-00476{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":105,"source":"sip.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1120470986363,"flow_last_seen":0,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30001,"dst_port":40393,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":112,"source":"sip.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":84,"flow_first_seen":1120469572844,"flow_last_seen":1120471094413,"flow_tot_l4_data_len":34719,"flow_min_l4_data_len":13,"flow_max_l4_data_len":1084,"flow_avg_l4_data_len":413,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.35","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":112,"source":"sip.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":9,"flow_first_seen":1120470985348,"flow_last_seen":1120470985511,"flow_tot_l4_data_len":1620,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30000,"dst_port":40392,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":56,"source":"sip.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":18,"flow_first_seen":1120470049188,"flow_last_seen":1120470116279,"flow_tot_l4_data_len":8900,"flow_min_l4_data_len":355,"flow_max_l4_data_len":830,"flow_avg_l4_data_len":494,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"200.68.120.81","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":69,"source":"sip.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":50,"flow_first_seen":1120469572844,"flow_last_seen":1120470509599,"flow_tot_l4_data_len":18892,"flow_min_l4_data_len":13,"flow_max_l4_data_len":1084,"flow_avg_l4_data_len":377,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.35","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":69,"source":"sip.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1120470796804,"flow_last_seen":0,"flow_tot_l4_data_len":474,"flow_min_l4_data_len":474,"flow_max_l4_data_len":474,"flow_avg_l4_data_len":474,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.35","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+01014{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":69,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470796,"pkt_ts_usec":804243,"pkt_caplen":508,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":508,"pkt_l4_len":474,"pkt":"ADBUADRWAODtAW69CABFAAHua6IAAIARFZ3AqAEC1PIhIxPEE8QB2h4sUkVHSVNURVIgc2lwOnNpcC5jeWJlcmNpdHkuZGsgU0lQLzIuMA0KVmlhOiBTSVAvMi4wL1VEUCAxOTIuMTY4LjEuMjticmFuY2g9ejloRzRiS25wMjg4NzQ2ODYtNDU1ZGJiZDkxOTIuMTY4LjEuMjtycG9ydA0KRnJvbTogPHNpcDozNTEwNDcyM0BzaXAuY3liZXJjaXR5LmRrPjt0YWc9MWI4OWJjZA0KVG86IDxzaXA6MzUxMDQ3MjNAc2lwLmN5YmVyY2l0eS5kaz4NCkNhbGwtSUQ6IDI5ODU4MTQ3LTQ2NWIwNzUyQDI5ODU4MDUxLTQ2NWIwN2IyDQpDb250YWN0OiBwZWwgPHNpcDozNTEwNDcyM0AxOTIuMTY4LjEuMjo1MDYwO2xpbmU9N2QzNjU1OGYzMTM2NzA1MT47ZXhwaXJlcz0xMjAwO3E9MC41MDANCkV4cGlyZXM6IDEyMDANCkNTZXE6IDEgUkVHSVNURVINCkNvbnRlbnQtTGVuZ3RoOiAwDQpNYXgtRm9yd2FyZHM6IDcwDQpVc2VyLUFnZW50OiBOZXJvIFNJUFBTIElQIFBob25lIFZlcnNpb24gMi4wLjUxLjE2DQoNCg=="}
+00500{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":69,"source":"sip.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1120470796804,"flow_last_seen":0,"flow_tot_l4_data_len":474,"flow_min_l4_data_len":474,"flow_max_l4_data_len":474,"flow_avg_l4_data_len":474,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.35","src_port":5060,"dst_port":5060,"l4_proto":"udp","ndpi": {"proto":"SIP","breed":"Acceptable","category":"VoIP"}}
+01035{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":70,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470796,"pkt_ts_usec":941095,"pkt_caplen":524,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":524,"pkt_l4_len":490,"pkt":"AODtAW69ADBUADRWCABFAAH+AABAADcRii\/U8iEjwKgBAhPEE8QB6uoyU0lQLzIuMCA0MDEgVW5hdXRob3JpemVkDQpDYWxsLUlEOiAyOTg1ODE0Ny00NjViMDc1MkAyOTg1ODA1MS00NjViMDdiMg0KQ1NlcTogMSBSRUdJU1RFUg0KRnJvbTogPHNpcDozNTEwNDcyM0BzaXAuY3liZXJjaXR5LmRrPjt0YWc9MWI4OWJjZA0KVG86IDxzaXA6MzUxMDQ3MjNAc2lwLmN5YmVyY2l0eS5kaz47dGFnPTAwLTA0MDcyLTE3MDFiOTQxLTc3OTk0NTg0Mw0KVmlhOiBTSVAvMi4wL1VEUCAxOTIuMTY4LjEuMjtyZWNlaXZlZD04MC4yMzAuMjE5LjcwO3Jwb3J0PTUwNjA7YnJhbmNoPXo5aEc0YktucDI4ODc0Njg2LTQ1NWRiYmQ5MTkyLjE2OC4xLjINCldXVy1BdXRoZW50aWNhdGU6IERpZ2VzdCByZWFsbT0ic2lwLmN5YmVyY2l0eS5kayIsbm9uY2U9IjE3MDFiOTMzM2U4NzEzMmU3Zjc0N2M1MDcyNjNkOTMiLG9wYXF1ZT0iMTcwMWExMzUxZjcwNzk1IixzdGFsZT1mYWxzZSxhbGdvcml0aG09TUQ1DQpDb250ZW50LUxlbmd0aDogMA0KDQo="}
+01298{"flow_id":3,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":71,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470814,"pkt_ts_usec":189540,"pkt_caplen":721,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":721,"pkt_l4_len":687,"pkt":"ADBUADRWAODtAW69CABFAALDa6kAAIARFMHAqAEC1PIhIxPEE8QCr1LWUkVHSVNURVIgc2lwOnNpcC5jeWJlcmNpdHkuZGsgU0lQLzIuMA0KVmlhOiBTSVAvMi4wL1VEUCAxOTIuMTY4LjEuMjticmFuY2g9ejloRzRiS25wMjcxMTExNzUtNDMzMGM5ZDYxOTIuMTY4LjEuMjtycG9ydA0KRnJvbTogPHNpcDozNTEwNDcyM0BzaXAuY3liZXJjaXR5LmRrPjt0YWc9MTlkYjMxNg0KVG86IDxzaXA6MzUxMDQ3MjNAc2lwLmN5YmVyY2l0eS5kaz4NCkNhbGwtSUQ6IDI5ODU4MTQ3LTQ2NWIwNzUyQDI5ODU4MDUxLTQ2NWIwN2IyDQpDb250YWN0OiBwZWwgPHNpcDozNTEwNDcyM0AxOTIuMTY4LjEuMjo1MDYwO2xpbmU9N2QzNjU1OGYzMTM2NzA1MT47ZXhwaXJlcz0xMjAwO3E9MC41MDANCkV4cGlyZXM6IDEyMDANCkNTZXE6IDIgUkVHSVNURVINCkNvbnRlbnQtTGVuZ3RoOiAwDQpBdXRob3JpemF0aW9uOiBEaWdlc3QgdXNlcm5hbWU9InZvaTE4MDYyIixyZWFsbT0ic2lwLmN5YmVyY2l0eS5kayIsdXJpPSJzaXA6MTkyLjE2OC4xLjIiLG5vbmNlPSIxNzAxYjkzMzNlODcxMzJlN2Y3NDdjNTA3MjYzZDkzIixvcGFxdWU9IjE3MDFhMTM1MWY3MDc5NSIsbmM9IjAwMDAwMDAxIixyZXNwb25zZT0iMGRmOTZlYjUyOGJiNjMwYTE2ZmQwMjUyNjE4Y2YzY2IiDQpNYXgtRm9yd2FyZHM6IDcwDQpVc2VyLUFnZW50OiBOZXJvIFNJUFBTIElQIFBob25lIFZlcnNpb24gMi4wLjUxLjE2DQoNCg=="}
+00794{"flow_id":3,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":72,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470814,"pkt_ts_usec":336427,"pkt_caplen":344,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":344,"pkt_l4_len":310,"pkt":"AODtAW69ADBUADRWCABFAAFKAABAADcRiuPU8iEjwKgBAhPEE8QBNvufU0lQLzIuMCAxMDAgVHJ5aW5nDQpDYWxsLUlEOiAyOTg1ODE0Ny00NjViMDc1MkAyOTg1ODA1MS00NjViMDdiMg0KQ1NlcTogMiBSRUdJU1RFUg0KRnJvbTogPHNpcDozNTEwNDcyM0BzaXAuY3liZXJjaXR5LmRrPjt0YWc9MTlkYjMxNg0KVG86IDxzaXA6MzUxMDQ3MjNAc2lwLmN5YmVyY2l0eS5kaz4NClZpYTogU0lQLzIuMC9VRFAgMTkyLjE2OC4xLjI7cmVjZWl2ZWQ9ODAuMjMwLjIxOS43MDtycG9ydD01MDYwO2JyYW5jaD16OWhHNGJLbnAyNzExMTE3NS00MzMwYzlkNjE5Mi4xNjguMS4yDQpDb250ZW50LUxlbmd0aDogMA0KDQo="}
+01018{"flow_id":3,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":73,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470814,"pkt_ts_usec":349707,"pkt_caplen":511,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":511,"pkt_l4_len":477,"pkt":"AODtAW69ADBUADRWCABFAAHxAABAADcRijzU8iEjwKgBAhPEE8QB3VzrU0lQLzIuMCAyMDAgT0sNCkNhbGwtSUQ6IDI5ODU4MTQ3LTQ2NWIwNzUyQDI5ODU4MDUxLTQ2NWIwN2IyDQpDb250YWN0OiBwZWw8c2lwOjM1MTA0NzIzQDE5Mi4xNjguMS4yOjUwNjA7bGluZT03ZDM2NTU4ZjMxMzY3MDUxPjtxPTAuNTAwO2V4cGlyZXM9MTIwMA0KQ1NlcTogMiBSRUdJU1RFUg0KRnJvbTogPHNpcDozNTEwNDcyM0BzaXAuY3liZXJjaXR5LmRrPjt0YWc9MTlkYjMxNg0KUC1Bc3NvY2lhdGVkLVVSSTogPHNpcDozNTEwNDcyM0BzaXAuY3liZXJjaXR5LmRrPg0KVG86IDxzaXA6MzUxMDQ3MjNAc2lwLmN5YmVyY2l0eS5kaz47dGFnPTAwLTA0MDk1LTE3MDFiOTVmLTViZGU3ZTQyMA0KVmlhOiBTSVAvMi4wL1VEUCAxOTIuMTY4LjEuMjtyZWNlaXZlZD04MC4yMzAuMjE5LjcwO3Jwb3J0PTUwNjA7YnJhbmNoPXo5aEc0YktucDI3MTExMTc1LTQzMzBjOWQ2MTkyLjE2OC4xLjINCkNvbnRlbnQtTGVuZ3RoOiAwDQoNCg=="}
+01014{"flow_id":3,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":74,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470831,"pkt_ts_usec":403943,"pkt_caplen":508,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":508,"pkt_l4_len":474,"pkt":"ADBUADRWAODtAW69CABFAAHua7MAAIARFYzAqAEC1PIhIxPEE8QB2oO4UkVHSVNURVIgc2lwOnNpcC5jeWJlcmNpdHkuZGsgU0lQLzIuMA0KVmlhOiBTSVAvMi4wL1VEUCAxOTIuMTY4LjEuMjticmFuY2g9ejloRzRiS25wMjY5MzY5NDUtNDc5ZTgzZjExOTIuMTY4LjEuMjtycG9ydA0KRnJvbTogPHNpcDozNTEwNDcyM0BzaXAuY3liZXJjaXR5LmRrPjt0YWc9MTliMDYxNA0KVG86IDxzaXA6MzUxMDQ3MjNAc2lwLmN5YmVyY2l0eS5kaz4NCkNhbGwtSUQ6IDI5ODU4MTQ3LTQ2NWIwNzUyQDI5ODU4MDUxLTQ2NWIwN2IyDQpDb250YWN0OiBwZWwgPHNpcDozNTEwNDcyM0AxOTIuMTY4LjEuMjo1MDYwO2xpbmU9N2QzNjU1OGYzMTM2NzA1MT47ZXhwaXJlcz0xMjAwO3E9MC41MDANCkV4cGlyZXM6IDEyMDANCkNTZXE6IDMgUkVHSVNURVINCkNvbnRlbnQtTGVuZ3RoOiAwDQpNYXgtRm9yd2FyZHM6IDcwDQpVc2VyLUFnZW50OiBOZXJvIFNJUFBTIElQIFBob25lIFZlcnNpb24gMi4wLjUxLjE2DQoNCg=="}
+01035{"flow_id":3,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":75,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470831,"pkt_ts_usec":540377,"pkt_caplen":524,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":524,"pkt_l4_len":490,"pkt":"AODtAW69ADBUADRWCABFAAH+AABAADcRii\/U8iEjwKgBAhPEE8QB6sOJU0lQLzIuMCA0MDEgVW5hdXRob3JpemVkDQpDYWxsLUlEOiAyOTg1ODE0Ny00NjViMDc1MkAyOTg1ODA1MS00NjViMDdiMg0KQ1NlcTogMyBSRUdJU1RFUg0KRnJvbTogPHNpcDozNTEwNDcyM0BzaXAuY3liZXJjaXR5LmRrPjt0YWc9MTliMDYxNA0KVG86IDxzaXA6MzUxMDQ3MjNAc2lwLmN5YmVyY2l0eS5kaz47dGFnPTAwLTA0MDk1LTE3MDFiOTcwLTQ2M2JhNmIzNg0KVmlhOiBTSVAvMi4wL1VEUCAxOTIuMTY4LjEuMjtyZWNlaXZlZD04MC4yMzAuMjE5LjcwO3Jwb3J0PTUwNjA7YnJhbmNoPXo5aEc0YktucDI2OTM2OTQ1LTQ3OWU4M2YxMTkyLjE2OC4xLjINCldXVy1BdXRoZW50aWNhdGU6IERpZ2VzdCByZWFsbT0ic2lwLmN5YmVyY2l0eS5kayIsbm9uY2U9IjE3MDFiOTZjNDc0ZTBjNGI1ZGNkNDA3ZjI3YmRkZTIiLG9wYXF1ZT0iMTcwMWExMzUxZjcwNzk1IixzdGFsZT1mYWxzZSxhbGdvcml0aG09TUQ1DQpDb250ZW50LUxlbmd0aDogMA0KDQo="}
+01490{"flow_id":3,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":76,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470848,"pkt_ts_usec":528833,"pkt_caplen":867,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":867,"pkt_l4_len":833,"pkt":"ADBUADRWAODtAW69CABFAANVa7oAAIARFB7AqAEC1PIhIxPEE8QDQVroSU5WSVRFIHNpcDowMDk3MjM5Mjg3MDQ0QHNpcC5jeWJlcmNpdHkuZGsgU0lQLzIuMA0KVmlhOiBTSVAvMi4wL1VEUCAxOTIuMTY4LjEuMjo1MDYwO2JyYW5jaD16OWhHNGJLbnAyNDQ2NjQwMi00NWRjNjFkNTE5Mi4xNjguMS4yO3Jwb3J0DQpGcm9tOiAiYXJpayIgPHNpcDozNTEwNDcyM0BzaXAuY3liZXJjaXR5LmRrPjt0YWc9MTc1YTFkZA0KVG86IDxzaXA6MDA5NzIzOTI4NzA0NEBzaXAuY3liZXJjaXR5LmRrPg0KQ2FsbC1JRDogMjQ0ODczOTEtNDQ5YmYyYTBAMTkyLjE2OC4xLjINCkNTZXE6IDEgSU5WSVRFDQpVc2VyLUFnZW50OiBOZXJvIFNJUFBTIElQIFBob25lIFZlcnNpb24gMi4wLjUxLjE2DQpFeHBpcmVzOiAxMjANCkFjY2VwdDogYXBwbGljYXRpb24vc2RwDQpDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3NkcA0KQ29udGVudC1MZW5ndGg6IDI3MA0KQ29udGFjdDogPHNpcDozNTEwNDcyM0AxOTIuMTY4LjEuMj4NCk1heC1Gb3J3YXJkczogNzANCkFsbG93OiBJTlZJVEUsIEFDSywgQ0FOQ0VMLCBCWUUsIFJFRkVSLCBPUFRJT05TLCBOT1RJRlksIElORk8NCg0Kdj0wDQpvPVNJUFBTIDI0NDY2NDIyIDI0NDY2NDE4IElOIElQNCAxOTIuMTY4LjEuMg0Kcz1TSVAgY2FsbA0KYz1JTiBJUDQgMTkyLjE2OC4xLjINCnQ9MCAwDQptPWF1ZGlvIDMwMDAwIFJUUC9BVlAgMCA4IDk3IDIgMw0KYT1ydHBtYXA6MCBwY211LzgwMDANCmE9cnRwbWFwOjggcGNtYS84MDAwDQphPXJ0cG1hcDo5NyBpTEJDLzgwMDANCmE9cnRwbWFwOjIgRzcyNi0zMi84MDAwDQphPXJ0cG1hcDozIEdTTS84MDAwDQphPWZtdHA6OTcgbW9kZT0yMA0KYT1zZW5kcmVjdg0K"}
+01182{"flow_id":3,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":77,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470848,"pkt_ts_usec":682926,"pkt_caplen":635,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":635,"pkt_l4_len":601,"pkt":"AODtAW69ADBUADRWCABFAAJtAABAADcRicDU8iEjwKgBAhPEE8QCWRUBU0lQLzIuMCA0MDcgYXV0aGVudGljYXRpb24gcmVxdWlyZWQNCkFsbG93OiBVUERBVEUsUkVGRVINCkNhbGwtSUQ6IDI0NDg3MzkxLTQ0OWJmMmEwQDE5Mi4xNjguMS4yDQpDb250YWN0OiA8c2lwOjIxMi4yNDIuMzMuMzU6NTA2MD4NCkNTZXE6IDEgSU5WSVRFDQpGcm9tOiAiYXJpayIgPHNpcDozNTEwNDcyM0BzaXAuY3liZXJjaXR5LmRrPjt0YWc9MTc1YTFkZA0KUHJveHktQXV0aGVudGljYXRlOiBEaWdlc3QgcmVhbG09InNpcC5jeWJlcmNpdHkuZGsiLG5vbmNlPSIxNzAxYjk3YjRlYjZjNjZkNjRkMGIyMGY1YTBiZWY4IixvcGFxdWU9IjE3MDFhMTM1MWY3MDc5NSIsc3RhbGU9ZmFsc2UsYWxnb3JpdGhtPU1ENQ0KU2VydmVyOiBDaXJwYWNrL3Y0LjM4ZSAoZ3dfc2lwKQ0KVG86IDxzaXA6MDA5NzIzOTI4NzA0NEBzaXAuY3liZXJjaXR5LmRrPjt0YWc9MDAtMDQwOTUtMTcwMWI5YTAtMTNjOTJhNjcyDQpWaWE6IFNJUC8yLjAvVURQIDE5Mi4xNjguMS4yOjUwNjA7cmVjZWl2ZWQ9ODAuMjMwLjIxOS43MDtycG9ydD01MDYwO2JyYW5jaD16OWhHNGJLbnAyNDQ2NjQwMi00NWRjNjFkNTE5Mi4xNjguMS4yDQpDb250ZW50LUxlbmd0aDogMA0KDQo="}
+00847{"flow_id":3,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":78,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470848,"pkt_ts_usec":686860,"pkt_caplen":382,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":382,"pkt_l4_len":348,"pkt":"ADBUADRWAODtAW69CABFAAFwa7wAAIARFgHAqAEC1PIhIxPEE8QBXMMEQUNLIHNpcDowMDk3MjM5Mjg3MDQ0QHNpcC5jeWJlcmNpdHkuZGsgU0lQLzIuMA0KRnJvbTogImFyaWsiIDxzaXA6MzUxMDQ3MjNAc2lwLmN5YmVyY2l0eS5kaz47dGFnPTE3NWExZGQNCkNhbGwtSUQ6IDI0NDg3MzkxLTQ0OWJmMmEwQDE5Mi4xNjguMS4yDQpWaWE6IFNJUC8yLjAvVURQIDE5Mi4xNjguMS4yOjUwNjA7YnJhbmNoPXo5aEc0YktucDI0NDY2NDAyLTQ1ZGM2MWQ1MTkyLjE2OC4xLjI7cnBvcnQNClRvOiA8c2lwOjAwOTcyMzkyODcwNDRAc2lwLmN5YmVyY2l0eS5kaz47dGFnPTAwLTA0MDk1LTE3MDFiOWEwLTEzYzkyYTY3Mg0KQ1NlcTogMSBBQ0sNCkNvbnRlbnQtTGVuZ3RoOiAwDQoNCg=="}
+01299{"flow_id":3,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":79,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470865,"pkt_ts_usec":653226,"pkt_caplen":721,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":721,"pkt_l4_len":687,"pkt":"ADBUADRWAODtAW69CABFAALDa8YAAIARFKTAqAEC1PIhIxPEE8QCrx6cUkVHSVNURVIgc2lwOnNpcC5jeWJlcmNpdHkuZGsgU0lQLzIuMA0KVmlhOiBTSVAvMi4wL1VEUCAxOTIuMTY4LjEuMjticmFuY2g9ejloRzRiS25wMjM2NTIyMzUtNDZiNTBlN2MxOTIuMTY4LjEuMjtycG9ydA0KRnJvbTogPHNpcDozNTEwNDcyM0BzaXAuY3liZXJjaXR5LmRrPjt0YWc9MTY4ZTc5NQ0KVG86IDxzaXA6MzUxMDQ3MjNAc2lwLmN5YmVyY2l0eS5kaz4NCkNhbGwtSUQ6IDI5ODU4MTQ3LTQ2NWIwNzUyQDI5ODU4MDUxLTQ2NWIwN2IyDQpDb250YWN0OiBwZWwgPHNpcDozNTEwNDcyM0AxOTIuMTY4LjEuMjo1MDYwO2xpbmU9N2QzNjU1OGYzMTM2NzA1MT47ZXhwaXJlcz0xMjAwO3E9MC41MDANCkV4cGlyZXM6IDEyMDANCkNTZXE6IDQgUkVHSVNURVINCkNvbnRlbnQtTGVuZ3RoOiAwDQpBdXRob3JpemF0aW9uOiBEaWdlc3QgdXNlcm5hbWU9InZvaTE4MDYyIixyZWFsbT0ic2lwLmN5YmVyY2l0eS5kayIsdXJpPSJzaXA6MTkyLjE2OC4xLjIiLG5vbmNlPSIxNzAxYjk2YzQ3NGUwYzRiNWRjZDQwN2YyN2JkZGUyIixvcGFxdWU9IjE3MDFhMTM1MWY3MDc5NSIsbmM9IjAwMDAwMDAxIixyZXNwb25zZT0iOWU2NWIzNGY5MTU2YjlmNTVkODNhYzFiY2Q4NGJhNTciDQpNYXgtRm9yd2FyZHM6IDcwDQpVc2VyLUFnZW50OiBOZXJvIFNJUFBTIElQIFBob25lIFZlcnNpb24gMi4wLjUxLjE2DQoNCg=="}
+01043{"flow_id":3,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":80,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470865,"pkt_ts_usec":804796,"pkt_caplen":529,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":529,"pkt_l4_len":495,"pkt":"AODtAW69ADBUADRWCABFAAIDAABAADcRiirU8iEjwKgBAhPEE8QB7x25U0lQLzIuMCA0MDEgbm9uY2UgaGFzIGNoYW5nZWQNCkNhbGwtSUQ6IDI5ODU4MTQ3LTQ2NWIwNzUyQDI5ODU4MDUxLTQ2NWIwN2IyDQpDU2VxOiA0IFJFR0lTVEVSDQpGcm9tOiA8c2lwOjM1MTA0NzIzQHNpcC5jeWJlcmNpdHkuZGs+O3RhZz0xNjhlNzk1DQpUbzogPHNpcDozNTEwNDcyM0BzaXAuY3liZXJjaXR5LmRrPjt0YWc9MDAtMDQwODUtMTcwMWI5YzktNDhlN2IwODYzDQpWaWE6IFNJUC8yLjAvVURQIDE5Mi4xNjguMS4yO3JlY2VpdmVkPTgwLjIzMC4yMTkuNzA7cnBvcnQ9NTA2MDticmFuY2g9ejloRzRiS25wMjM2NTIyMzUtNDZiNTBlN2MxOTIuMTY4LjEuMg0KV1dXLUF1dGhlbnRpY2F0ZTogRGlnZXN0IHJlYWxtPSJzaXAuY3liZXJjaXR5LmRrIixub25jZT0iMTcwMWI5YzA2OTE3M2EyMTVlMzU2ZTMwMTdiMTc5ZCIsb3BhcXVlPSIxNzAxYTEzNTFmNzA3OTUiLHN0YWxlPWZhbHNlLGFsZ29yaXRobT1NRDUNCkNvbnRlbnQtTGVuZ3RoOiAwDQoNCg=="}
+00396{"flow_id":3,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":81,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470882,"pkt_ts_usec":727710,"pkt_caplen":47,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":47,"pkt_l4_len":13,"pkt":"ADBUADRWAODtAW69CABFAAAha9AAAIARFzzAqAEC1PIhIxPEE8QADcBLICAgICA="}
+01830{"flow_id":3,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":82,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470899,"pkt_ts_usec":862890,"pkt_caplen":1118,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1118,"pkt_l4_len":1084,"pkt":"ADBUADRWAODtAW69CABFAARQa9cAAIAREwbAqAEC1PIhIxPEE8QEPH6wSU5WSVRFIHNpcDowMDk3MjM5Mjg3MDQ0QHNpcC5jeWJlcmNpdHkuZGsgU0lQLzIuMA0KVmlhOiBTSVAvMi4wL1VEUCAxOTIuMTY4LjEuMjticmFuY2g9ejloRzRiS25wMjAyMzgyNzUtNDc4OTI3YmExOTIuMTY4LjEuMjtycG9ydA0KRnJvbTogImFyaWsiIDxzaXA6MzUxMDQ3MjNAc2lwLmN5YmVyY2l0eS5kaz47dGFnPTE3NWExZGQNClRvOiA8c2lwOjAwOTcyMzkyODcwNDRAc2lwLmN5YmVyY2l0eS5kaz4NCkNhbGwtSUQ6IDI0NDg3MzkxLTQ0OWJmMmEwQDE5Mi4xNjguMS4yDQpDU2VxOiAyIElOVklURQ0KUHJveHktQXV0aG9yaXphdGlvbjogRGlnZXN0IHVzZXJuYW1lPSJ2b2kxODA2MiIscmVhbG09InNpcC5jeWJlcmNpdHkuZGsiLHVyaT0ic2lwOjE5Mi4xNjguMS4yIixub25jZT0iMTcwMWI5N2I0ZWI2YzY2ZDY0ZDBiMjBmNWEwYmVmOCIsb3BhcXVlPSIxNzAxYTEzNTFmNzA3OTUiLG5jPSIwMDAwMDAwMSIscmVzcG9uc2U9IjBiNzk5MGJiMjFkNTU3MmQ2NTcxZTk3Yjk4YzZkNzBmIg0KQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9zZHANCkNvbnRlbnQtTGVuZ3RoOiAyNzANCkRhdGU6IE1vbiwgMDQgSnVsIDIwMDUgMDk6NTQ6MjUgR01UDQpDb250YWN0OiA8c2lwOjM1MTA0NzIzQDE5Mi4xNjguMS4yPg0KRXhwaXJlczogMTIwDQpBY2NlcHQ6IGFwcGxpY2F0aW9uL3NkcA0KTWF4LUZvcndhcmRzOiA3MA0KVXNlci1BZ2VudDogTmVybyBTSVBQUyBJUCBQaG9uZSBWZXJzaW9uIDIuMC41MS4xNg0KQWxsb3c6IElOVklURSwgQUNLLCBDQU5DRUwsIEJZRSwgUkVGRVIsIE9QVElPTlMsIE5PVElGWSwgSU5GTw0KDQp2PTANCm89U0lQUFMgMjQ0NjY0MjIgMjQ0NjY0MTggSU4gSVA0IDE5Mi4xNjguMS4yDQpzPVNJUCBjYWxsDQpjPUlOIElQNCAxOTIuMTY4LjEuMg0KdD0wIDANCm09YXVkaW8gMzAwMDAgUlRQL0FWUCAwIDggOTcgMiAzDQphPXJ0cG1hcDowIHBjbXUvODAwMA0KYT1ydHBtYXA6OCBwY21hLzgwMDANCmE9cnRwbWFwOjk3IGlMQkMvODAwMA0KYT1ydHBtYXA6MiBHNzI2LTMyLzgwMDANCmE9cnRwbWFwOjMgR1NNLzgwMDANCmE9Zm10cDo5NyBtb2RlPTIwDQphPXNlbmRyZWN2DQo="}
+00918{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":83,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470900,"pkt_ts_usec":37074,"pkt_caplen":437,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":437,"pkt_l4_len":403,"pkt":"AODtAW69ADBUADRWCABFAAGnAABAADcRiobU8iEjwKgBAhPEE8QBk5azU0lQLzIuMCAxMDAgVHJ5aW5nDQpBbGxvdzogVVBEQVRFLFJFRkVSDQpDYWxsLUlEOiAyNDQ4NzM5MS00NDliZjJhMEAxOTIuMTY4LjEuMg0KQ29udGFjdDogPHNpcDoyMTIuMjQyLjMzLjM1OjUwNjA+DQpDU2VxOiAyIElOVklURQ0KRnJvbTogImFyaWsiIDxzaXA6MzUxMDQ3MjNAc2lwLmN5YmVyY2l0eS5kaz47dGFnPTE3NWExZGQNClNlcnZlcjogQ2lycGFjay92NC4zOGUgKGd3X3NpcCkNClRvOiA8c2lwOjAwOTcyMzkyODcwNDRAc2lwLmN5YmVyY2l0eS5kaz4NClZpYTogU0lQLzIuMC9VRFAgMTkyLjE2OC4xLjI7cmVjZWl2ZWQ9ODAuMjMwLjIxOS43MDtycG9ydD01MDYwO2JyYW5jaD16OWhHNGJLbnAyMDIzODI3NS00Nzg5MjdiYTE5Mi4xNjguMS4yDQpDb250ZW50LUxlbmd0aDogMA0KDQo="}
+00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":95,"source":"sip.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1120470985348,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30000,"dst_port":40392,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00623{"flow_id":4,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":95,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":348411,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIa\/wAAIARFmjAqAEC1PIhJHUwncgAtBjegAhvrgAABNg3lstx1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1REEHBgYEhIeEBQXahMcGAQEBQYBAQAHBQUZEwUbGRATGQUEBAcDAgMDAAACDQ0NAAEDDQwNAAABAgMBBgYBDw4ODAMABwYAAwMGBwEEBgYbHxwRaWBiFREQFGoTFWBpYX10UltZ10dcVlJVREtCdVlzeFp8bmgUag=="}
+00503{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":95,"source":"sip.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1120470985348,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30000,"dst_port":40392,"l4_proto":"udp","ndpi": {"proto":"RTP","breed":"Acceptable","category":"Media"}}
+00626{"flow_id":4,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":96,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":418358,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIa\/0AAIARFmfAqAEC1PIhJHUwncgAtL+rgAhvrwAABXg3lstxbmgVFGoUFBVpYG5qbG5kbGoWF2xubWBmfn9Fxsnw\/Ofz+uXwy\/H2z83k+sJTdF9CW\/bw8vzg7pfo8ldaT011Z399ZmV0dUN4S0dVQ2dmbWNsZGZkeGRvbxQUbBcRExAXEBwfHRAQFhAQHxwfGR4YEBcSFGxibWNqFRUXbmV3ckDQ93N9fmJnYmoVahcVZUNxWll+YGZ6cnJJZXpgeF1EQg=="}
+00626{"flow_id":4,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":97,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":421891,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIa\/4AAIARFmbAqAEC1PIhJHUwncgAtNyMgAhvsAAABhg3lstxcX5wdtbF0Et0dn92T1BB0VhmZ2V\/Z294Y2ZmahQXFhQREBAVb2ZPemVlYWJoYE9\/YWZkcnV4bWwVFRVqZ2xpYn94ZmBnY2F0zfjXdmNiYXhveHJgaW5jUFlwZW1kYWdlamoREhAQEx4fHx0XahRvRl1F3V5ESdbQxFFR39TfQXR\/Z9L15ebs6JeW7+DslJOU6uqUn5CcnJKX+Ofs5+Hg6g=="}
+00624{"flow_id":4,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":98,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":427557,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIa\/8AAIARFmXAqAEC1PIhJHUwncgAtJlvgAhvsQAABrg3lstxkpfo6Zfq5frn5uz6+sB4emFkcGBneMvv7+rslZHu5OLqkpKdkpCUlZGcnpuHh4GAgoODgYGGhoGBgIGDg4GAhoSFhZ6ZhYSFhYeHhoWFhICCgIOBmJyQnZ+Yn5CW6u7s6e7ol+ji7vrcWtzJ8\/Lz9ujq7u6XkZaWkZ2Ym5iFh4aGhZyemZ6fmZ+fk5OfhYeEk5STk5eU6fj3T1hDVM9BQg=="}
+00628{"flow_id":4,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":99,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":429664,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIbAAAAIARFmTAqAEC1PIhJHUwncgAtMoSgAhvsgAAB1g3lstxRH1wVt719vLg7uHxw3h4ZGRhfE9UWV\/Rz+Dt5\/PklJOUlJXt4uzx+Pjm5PPHzf38\/fr05+3ikurj4ezn4+H6\/97AwEJ8S9DN9Vd1XdzJ8eDp6eXwzcXWRUJnZHhnYX96aHLW+ubo6eHg5\/DG\/MNRcE3B+ubNy+Xu7Obt7+qX6u7oy9fw3vLT3N1W19X49PBBf39jZnhmbBEdEWpqb2BweA=="}
+00628{"flow_id":4,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":100,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":464477,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIbAEAAIARFmPAqAEC1PIhJHUwncgAtHeogAhvswAAB\/g3lstxZWVmFB0cBQQHBwQbHxZgY21iFGpoFRdvFxMWEBAdFhEQFhcREBVoam1hbmNjFBYQHx4SHRYWEh0XaW0VaWR\/aGoUF2liaBEUFm9mZm1hbWgVER0ZHB0fHRsbHhwdHxgbGREVbmoUEhsFBBgFGx0TFmx6cUZxZWZoaXJ2cmoTExESExRqZFPLyfH47frj+svP1PT6X0\/RW0t\/SXVUy\/7m7A=="}
+00629{"flow_id":4,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":101,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":466372,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIbAIAAIARFmLAqAEC1PIhJHUwncgAtKmigAhvtAAACJg3lstx5NneS0l8Y2kVYm9oFW9tbW1jZWRyc3hvZmpoaGpjaHpzTXRnen5Z2l1FzdHU0dvZy+zx3Pzm7peVlZeX7unjw\/P09\/Xz4fzz9c3C9uXl+vP2Wkl0aG1mZ0twR1TQWU1PflrBy\/PBR3BkZ2ZsZHN6YWRyeHXH4\/\/x8U1W\/Nb15ezv7pWRkJ2FmZubhYWEhZiZm4SFhISYnoWbhISbnJaXlw=="}
+00627{"flow_id":4,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":102,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":504000,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIbAMAAIARFmHAqAEC1PIhJHUwncgAtLaDgAhvtQAACTg3lstx6urs5ueUkJOXlZGWlOyVlOD46O7hzXXbxsfz\/OLg5ufawPH4wk3N8Obu7+Pv6unk4fj\/29jZ1\/7l4+Ht7JOXlOrs4vPPUfVQz97J5fLjl5GXkpyRl+jqk5aQlero4uLh7+rslJfp6uP+9vbL+OLg5vj99\/LL9ub4+uTs6ZSVlJXp6Ojv7eqWkZOTnJORkpCTk5GXlpaRkJCW6erp7JWXlw=="}
+00627{"flow_id":4,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":103,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470985,"pkt_ts_usec":511036,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"ADBUADRWAODtAW69CABFAADIbAQAAIARFmDAqAEC1PIhJHUwncgAtIfqgAhvtgAACdg3lstxlpDplp2cmZ6fkpaRle3n9PTy\/PyVkZKehIeEmJGRl52QlJaX6OOU6JaRlp2cn4WEhZ2RkJeV6ZaQnZ6EhJuFh4WFmYWYk5+dkpCQ6u\/qkZ2fmYSYnZ6Rk5OU7OD6+Pbh4PTl+OTo6unl9eXi7f7c1VT\/+uiX6JSUkJCV7uXm\/Obu7pWWkZeW7OPpk5Ofm5+Yk5WV7untlJeSkpeV7+qWkA=="}
+00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":104,"source":"sip.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1120470986363,"flow_last_seen":0,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30001,"dst_port":40393,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00531{"flow_id":5,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":104,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470986,"pkt_ts_usec":363611,"pkt_caplen":146,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":146,"pkt_l4_len":112,"pkt":"ADBUADRWAODtAW69CABFAACEbAUAAIARFqPAqAEC1PIhJHUxnckAcCyBgMgABjeWy3FCyQfKXvrGAwAAJMMAAAAJAAAGDIHKAAs3lstxAR0xMTg5NDI5Ny00NDMyYTlmOEAxOTIuMTY4LjEuMgYFU0lQUFMAAIHLAAY3lstxEHNlc3Npb24gc2h1dGRvd24AAAA="}
+00504{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":104,"source":"sip.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1120470986363,"flow_last_seen":0,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30001,"dst_port":40393,"l4_proto":"udp","ndpi": {"proto":"RTCP","breed":"Acceptable","category":"VoIP"}}
+00476{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":105,"source":"sip.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1120470986363,"flow_last_seen":0,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30001,"dst_port":40393,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":112,"source":"sip.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":34,"flow_first_seen":1120470796804,"flow_last_seen":1120471094413,"flow_tot_l4_data_len":15827,"flow_min_l4_data_len":13,"flow_max_l4_data_len":1084,"flow_avg_l4_data_len":465,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.35","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":112,"source":"sip.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":9,"flow_first_seen":1120470985348,"flow_last_seen":1120470985511,"flow_tot_l4_data_len":1620,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30000,"dst_port":40392,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":112,"source":"sip.pcap","alias":"nDPId-test"}