Reworked layer 4 flow length naming/calculation.

 * nDPIsrvd services usually do not care about layer4 data length,
   payload length is quite more essential for further processing

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 175 insertions, 175 deletions

diff --git a/test/results/telegram.pcap.out b/test/results/telegram.pcap.out
index 0d77b0b6a..788badcb5 100644
--- a/test/results/telegram.pcap.out
+++ b/test/results/telegram.pcap.out
@@ -1,29 +1,29 @@
 00476{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"telegram.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
-00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"telegram.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1588779596451,"flow_last_seen":0,"flow_tot_l4_data_len":287,"flow_min_l4_data_len":287,"flow_max_l4_data_len":287,"flow_avg_l4_data_len":287,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"telegram.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1588779596451,"flow_last_seen":0,"flow_min_l4_payload_len":279,"flow_max_l4_payload_len":279,"flow_tot_l4_payload_len":279,"flow_avg_l4_payload_len":279,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00780{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779596,"pkt_ts_usec":451825,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJVAAEARYHzAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGANsCwWgAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
-00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"telegram.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1588779596451,"flow_last_seen":0,"flow_tot_l4_data_len":287,"flow_min_l4_data_len":287,"flow_max_l4_data_len":287,"flow_avg_l4_data_len":287,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"fingerprint":"1,3"}}
-00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"telegram.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1588779596464,"flow_last_seen":0,"flow_tot_l4_data_len":134,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":54306,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00548{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"telegram.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1588779596451,"flow_last_seen":0,"flow_min_l4_payload_len":279,"flow_max_l4_payload_len":279,"flow_tot_l4_payload_len":279,"flow_avg_l4_payload_len":279,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"fingerprint":"1,3"}}
+00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"telegram.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1588779596464,"flow_last_seen":0,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":126,"flow_tot_l4_payload_len":126,"flow_avg_l4_payload_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":54306,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00567{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779596,"pkt_ts_usec":464499,"pkt_caplen":168,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":168,"pkt_l4_len":134,"pkt":"AQBef\/\/6wJrQLWJ0CABFAACavyQAAAERSFfAqAE17\/\/\/+tQiB2wAhkPyTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KDQoA"}
-00511{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"telegram.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1588779596464,"flow_last_seen":0,"flow_tot_l4_data_len":134,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":54306,"dst_port":1900,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}}
-00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1588779596464,"flow_last_seen":0,"flow_tot_l4_data_len":53,"flow_min_l4_data_len":53,"flow_max_l4_data_len":53,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00523{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"telegram.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1588779596464,"flow_last_seen":0,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":126,"flow_tot_l4_payload_len":126,"flow_avg_l4_payload_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":54306,"dst_port":1900,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1588779596464,"flow_last_seen":0,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":45,"flow_avg_l4_payload_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00451{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779596,"pkt_ts_usec":464729,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"pkt":"AQBeAAD7wJrQLWJ0CABFAABJuJEAAAERXjrAqAE14AAA+xTpFOkANQuaAAAAAAABAAAAAAAAEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAAADAAB"}
-00552{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1588779596464,"flow_last_seen":0,"flow_tot_l4_data_len":53,"flow_min_l4_data_len":53,"flow_max_l4_data_len":53,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_spotify-connect._tcp.local"}}
-00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4,"source":"telegram.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1588779596465,"flow_last_seen":0,"flow_tot_l4_data_len":319,"flow_min_l4_data_len":319,"flow_max_l4_data_len":319,"flow_avg_l4_data_len":319,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00564{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1588779596464,"flow_last_seen":0,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":45,"flow_avg_l4_payload_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_spotify-connect._tcp.local"}}
+00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4,"source":"telegram.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1588779596465,"flow_last_seen":0,"flow_min_l4_payload_len":311,"flow_max_l4_payload_len":311,"flow_tot_l4_payload_len":311,"flow_avg_l4_payload_len":311,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00811{"flow_id":4,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779596,"pkt_ts_usec":465053,"pkt_caplen":353,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":353,"pkt_l4_len":319,"pkt":"AQBeAAD7eCjKBfrMCABFAAFTehJAAAERW5\/AqAFF4AAA+xTpFOkBP9DmAACEAAAAAAEAAAADEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAAADAABAAAAeAAvEXNvbm9zNzgyOENBMDVGQUNDEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAARc29ub3M3ODI4Q0EwNUZBQ0MQX3Nwb3RpZnktY29ubmVjdARfdGNwBWxvY2FsAAAQgAEAABGUAB0LVkVSU0lPTj0xLjAQQ1BhdGg9L3Nwb3RpZnl6YxFzb25vczc4MjhDQTA1RkFDQxBfc3BvdGlmeS1jb25uZWN0BF90Y3AFbG9jYWwAACGAAQAAAHgAHwAAAAAFeBFzb25vczc4MjhDQTA1RkFDQwVsb2NhbAARc29ub3M3ODI4Q0EwNUZBQ0MFbG9jYWwAAAGAAQAAAHgABMCoAUU="}
-00556{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"telegram.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1588779596465,"flow_last_seen":0,"flow_tot_l4_data_len":319,"flow_min_l4_data_len":319,"flow_max_l4_data_len":319,"flow_avg_l4_data_len":319,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_spotify-connect._tcp.local"}}
-00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5,"source":"telegram.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1588779596708,"flow_last_seen":0,"flow_tot_l4_data_len":108,"flow_min_l4_data_len":108,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":108,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.75","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00568{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"telegram.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1588779596465,"flow_last_seen":0,"flow_min_l4_payload_len":311,"flow_max_l4_payload_len":311,"flow_tot_l4_payload_len":311,"flow_avg_l4_payload_len":311,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_spotify-connect._tcp.local"}}
+00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5,"source":"telegram.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1588779596708,"flow_last_seen":0,"flow_min_l4_payload_len":100,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":100,"flow_avg_l4_payload_len":100,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.75","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00530{"flow_id":5,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779596,"pkt_ts_usec":708234,"pkt_caplen":142,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":142,"pkt_l4_len":108,"pkt":"AQBeAAD7jP5XIzfkCABFAACAA9gAAP8RFKbAqAFL4AAA+xTpFOkAbODJAACEAAAAAAEAAAABBV9kYWNwBF90Y3AFbG9jYWwAAAwAAQAAAAAAHxxpVHVuZXNfQ3RybF80QUJCMzlBNDFFRUZERUIzwAwAACkFoAAAEZQAEgAEAA4A2a7+VyM35Iz+VyM35A=="}
-00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":5,"source":"telegram.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1588779596708,"flow_last_seen":0,"flow_tot_l4_data_len":108,"flow_min_l4_data_len":108,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":108,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.75","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_dacp._tcp.local"}}
-00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6,"source":"telegram.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1588779596708,"flow_last_seen":0,"flow_tot_l4_data_len":108,"flow_min_l4_data_len":108,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":108,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4ba:91a:7817:e318","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00557{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":5,"source":"telegram.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1588779596708,"flow_last_seen":0,"flow_min_l4_payload_len":100,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":100,"flow_avg_l4_payload_len":100,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.75","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_dacp._tcp.local"}}
+00495{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6,"source":"telegram.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1588779596708,"flow_last_seen":0,"flow_min_l4_payload_len":100,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":100,"flow_avg_l4_payload_len":100,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4ba:91a:7817:e318","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00558{"flow_id":6,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779596,"pkt_ts_usec":708683,"pkt_caplen":162,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":162,"pkt_l4_len":108,"pkt":"MzMAAAD7jP5XIzfkht1gD8IfAGwR\/\/6AAAAAAAAABLoJGngX4xj\/AgAAAAAAAAAAAAAAAAD7FOkU6QBsHDYAAIQAAAAAAQAAAAEFX2RhY3AEX3RjcAVsb2NhbAAADAABAAAAAAAfHGlUdW5lc19DdHJsXzRBQkIzOUE0MUVFRkRFQjPADAAAKQWgAAARlAASAAQADgDZrv5XIzfkjP5XIzfk"}
-00553{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"telegram.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1588779596708,"flow_last_seen":0,"flow_tot_l4_data_len":108,"flow_min_l4_data_len":108,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":108,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4ba:91a:7817:e318","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_dacp._tcp.local"}}
+00565{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"telegram.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1588779596708,"flow_last_seen":0,"flow_min_l4_payload_len":100,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":100,"flow_avg_l4_payload_len":100,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4ba:91a:7817:e318","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_dacp._tcp.local"}}
 00653{"flow_id":5,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779597,"pkt_ts_usec":257598,"pkt_caplen":233,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":233,"pkt_l4_len":199,"pkt":"AQBeAAD7jP5XIzfkCABFAADbeQgAAP8RnxrAqAFL4AAA+xTpFOkAx\/OHAAAAAAAFAAAAAQABD19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMgAEIX2hvbWVraXTAHAAMgAEIX2FpcnBsYXnAHAAMgAEFX3Jhb3DAHAAMgAEcaVR1bmVzX0N0cmxfNEFCQjM5QTQxRUVGREVCMwVfZGFjcMAcAP+AAcBWACEAAQAAAHgAFwAAAADHIw5HYWJyaWVsZXMtaVBhZMAhAAApBaAAABGUABIABAAOANqu\/lcjN+SM\/lcjN+Q="}
 00683{"flow_id":6,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779597,"pkt_ts_usec":258319,"pkt_caplen":253,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":253,"pkt_l4_len":199,"pkt":"MzMAAAD7jP5XIzfkht1gD8IfAMcR\/\/6AAAAAAAAABLoJGngX4xj\/AgAAAAAAAAAAAAAAAAD7FOkU6QDHLvQAAAAAAAUAAAABAAEPX2NvbXBhbmlvbi1saW5rBF90Y3AFbG9jYWwAAAyAAQhfaG9tZWtpdMAcAAyAAQhfYWlycGxhecAcAAyAAQVfcmFvcMAcAAyAARxpVHVuZXNfQ3RybF80QUJCMzlBNDFFRUZERUIzBV9kYWNwwBwA\/4ABwFYAIQABAAAAeAAXAAAAAMcjDkdhYnJpZWxlcy1pUGFkwCEAACkFoAAAEZQAEgAEAA4A2q7+VyM35Iz+VyM35A=="}
 00752{"flow_id":5,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779597,"pkt_ts_usec":258438,"pkt_caplen":308,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":308,"pkt_l4_len":274,"pkt":"AQBeAAD7jP5XIzfkCABFAAEmpacAAP8RcjDAqAFL4AAA+xTpFOkBEl+aAACEAAAAAAMAAAADCV9zZXJ2aWNlcwdfZG5zLXNkBF91ZHAFbG9jYWwAAAwAAQAAEZQADQVfZGFjcARfdGNwwCMBOAExATMBRQE3ATEBOAE3AUEBMQE5ATABQQFCATQBMAEwATABMAEwATABMAEwATABMAEwATABMAEwATgBRQFGA2lwNgRhcnBhAAAMgAEAAAB4ABEOR2FicmllbGVzLWlQYWTAIwI3NQExAzE2OAMxOTIHaW4tYWRkcsCFAAyAAQAAAHgAAsCVwEEAL4ABAAAAeAAGwEEAAgAIwKYAL4ABAAAAeAAGwKYAAgAIAAApBaAAABGUABIABAAOANqu\/lcjN+SM\/lcjN+Q="}
 00783{"flow_id":6,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779597,"pkt_ts_usec":258687,"pkt_caplen":328,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":328,"pkt_l4_len":274,"pkt":"MzMAAAD7jP5XIzfkht1gD8IfARIR\/\/6AAAAAAAAABLoJGngX4xj\/AgAAAAAAAAAAAAAAAAD7FOkU6QESmwYAAIQAAAAAAwAAAAMJX3NlcnZpY2VzB19kbnMtc2QEX3VkcAVsb2NhbAAADAABAAARlAANBV9kYWNwBF90Y3DAIwE4ATEBMwFFATcBMQE4ATcBQQExATkBMAFBAUIBNAEwATABMAEwATABMAEwATABMAEwATABMAEwATABOAFFAUYDaXA2BGFycGEAAAyAAQAAAHgAEQ5HYWJyaWVsZXMtaVBhZMAjAjc1ATEDMTY4AzE5Mgdpbi1hZGRywIUADIABAAAAeAACwJXAQQAvgAEAAAB4AAbAQQACAAjApgAvgAEAAAB4AAbApgACAAgAACkFoAAAEZQAEgAEAA4A2q7+VyM35Iz+VyM35A=="}
-00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":11,"source":"telegram.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1588779597291,"flow_last_seen":0,"flow_tot_l4_data_len":286,"flow_min_l4_data_len":286,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":286,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.75","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":11,"source":"telegram.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1588779597291,"flow_last_seen":0,"flow_min_l4_payload_len":278,"flow_max_l4_payload_len":278,"flow_tot_l4_payload_len":278,"flow_avg_l4_payload_len":278,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.75","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00769{"flow_id":7,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779597,"pkt_ts_usec":291316,"pkt_caplen":320,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":320,"pkt_l4_len":286,"pkt":"jP5XIzfkKDc3AG3ICABFAAEy\/KUAAP8ROizAqAFNwKgBSxTpFOkBHhkOAACEAAAAAAEAAAAED19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMAAEAABGUABANTHVjYeKAmXMgaU1hY8AMwDIAIYABAAAAeAATAAAAAMAFCkx1Y2FzLWlNYWPAIcAyABCAAQAAEZQAWBZycEJBPTM5OjJBOjg4OkFDOjQxOkFCCnJwVnI9MTUyLjERcnBIST1mOWM0NmM2ZGQwN2QRcnBITj0zYzVkYzVjZTk1NzgRcnBIQT04Y2E4Y2I3MzFjMWMNTHVjYeKAmXMgaU1hYwxfZGV2aWNlLWluZm\/AHAAQAAEAABGUABoObW9kZWw9aU1hYzExLDMKb3N4dmVycz0xN8BUAAGAAQAAAHgABMCoAU0="}
-00557{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"telegram.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1588779597291,"flow_last_seen":0,"flow_tot_l4_data_len":286,"flow_min_l4_data_len":286,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":286,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.75","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_companion-link._tcp.local"}}
+00569{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"telegram.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1588779597291,"flow_last_seen":0,"flow_min_l4_payload_len":278,"flow_max_l4_payload_len":278,"flow_tot_l4_payload_len":278,"flow_avg_l4_payload_len":278,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.75","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_companion-link._tcp.local"}}
 00569{"flow_id":5,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779597,"pkt_ts_usec":511254,"pkt_caplen":169,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":169,"pkt_l4_len":135,"pkt":"AQBeAAD7jP5XIzfkCABFAACbIpQAAP8R9c7AqAFL4AAA+xTpFOkAh0T\/AAAAAAABAAAAAQABHGlUdW5lc19DdHJsXzRBQkIzOUE0MUVFRkRFQjMFX2RhY3AEX3RjcAVsb2NhbAAA\/wABwAwAIQABAAAAeAAXAAAAAMcjDkdhYnJpZWxlcy1pUGFkwDQAACkFoAAAEZQAEgAEAA4A2q7+VyM35Iz+VyM35A=="}
 00596{"flow_id":6,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779597,"pkt_ts_usec":511362,"pkt_caplen":189,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":189,"pkt_l4_len":135,"pkt":"MzMAAAD7jP5XIzfkht1gD8IfAIcR\/\/6AAAAAAAAABLoJGngX4xj\/AgAAAAAAAAAAAAAAAAD7FOkU6QCHgGsAAAAAAAEAAAABAAEcaVR1bmVzX0N0cmxfNEFCQjM5QTQxRUVGREVCMwVfZGFjcARfdGNwBWxvY2FsAAD\/AAHADAAhAAEAAAB4ABcAAAAAxyMOR2FicmllbGVzLWlQYWTANAAAKQWgAAARlAASAAQADgDarv5XIzfkjP5XIzfk"}
 00544{"flow_id":5,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779597,"pkt_ts_usec":760485,"pkt_caplen":153,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":153,"pkt_l4_len":119,"pkt":"AQBeAAD7jP5XIzfkCABFAACLhdQAAP8Rkp7AqAFL4AAA+xTpFOkAd9R+AAAAAAABAAAAAgABDkdhYnJpZWxlcy1pUGFkBWxvY2FsAAD\/gAHADAAcAAEAAAB4ABD+gAAAAAAAAAS6CRp4F+MYwAwAAQABAAAAeAAEwKgBSwAAKQWgAAARlAASAAQADgDarv5XIzfkjP5XIzfk"}
@@ -49,85 +49,85 @@
 00560{"flow_id":6,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779600,"pkt_ts_usec":214854,"pkt_caplen":162,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":162,"pkt_l4_len":108,"pkt":"MzMAAAD7jP5XIzfkht1gD8IfAGwR\/\/6AAAAAAAAABLoJGngX4xj\/AgAAAAAAAAAAAAAAAAD7FOkU6QBsHDUAAIQAAAAAAQAAAAEFX2RhY3AEX3RjcAVsb2NhbAAADAABAAAAAAAfHGlUdW5lc19DdHJsXzRBQkIzOUE0MUVFRkRFQjPADAAAKQWgAAARlAASAAQADgDarv5XIzfkjP5XIzfk"}
 00655{"flow_id":5,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":35,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779600,"pkt_ts_usec":739288,"pkt_caplen":233,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":233,"pkt_l4_len":199,"pkt":"AQBeAAD7jP5XIzfkCABFAADbJxEAAP8R8RHAqAFL4AAA+xTpFOkAx\/KHAAAAAAAFAAAAAQABD19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMgAEIX2hvbWVraXTAHAAMgAEIX2FpcnBsYXnAHAAMgAEFX3Jhb3DAHAAMgAEcaVR1bmVzX0N0cmxfNEFCQjM5QTQxRUVGREVCMwVfZGFjcMAcAP+AAcBWACEAAQAAAHgAFwAAAADHIw5HYWJyaWVsZXMtaVBhZMAhAAApBaAAABGUABIABAAOANuu\/lcjN+SM\/lcjN+Q="}
 00685{"flow_id":6,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":36,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779600,"pkt_ts_usec":739491,"pkt_caplen":253,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":253,"pkt_l4_len":199,"pkt":"MzMAAAD7jP5XIzfkht1gD8IfAMcR\/\/6AAAAAAAAABLoJGngX4xj\/AgAAAAAAAAAAAAAAAAD7FOkU6QDHLfQAAAAAAAUAAAABAAEPX2NvbXBhbmlvbi1saW5rBF90Y3AFbG9jYWwAAAyAAQhfaG9tZWtpdMAcAAyAAQhfYWlycGxhecAcAAyAAQVfcmFvcMAcAAyAARxpVHVuZXNfQ3RybF80QUJCMzlBNDFFRUZERUIzBV9kYWNwwBwA\/4ABwFYAIQABAAAAeAAXAAAAAMcjDkdhYnJpZWxlcy1pUGFkwCEAACkFoAAAEZQAEgAEAA4A267+VyM35Iz+VyM35A=="}
-00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":39,"source":"telegram.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1588779600828,"flow_last_seen":0,"flow_tot_l4_data_len":50,"flow_min_l4_data_len":50,"flow_max_l4_data_len":50,"flow_avg_l4_data_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61631,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":39,"source":"telegram.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1588779600828,"flow_last_seen":0,"flow_min_l4_payload_len":42,"flow_max_l4_payload_len":42,"flow_tot_l4_payload_len":42,"flow_avg_l4_payload_len":42,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61631,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00449{"flow_id":8,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":39,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779600,"pkt_ts_usec":828022,"pkt_caplen":84,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":84,"pkt_l4_len":50,"pkt":"EBMx8Tl2KDc3AG3ICABFAABGiX4AAP8RronAqAFNwKgBAfC\/ADUAMkhio9MBAAABAAAAAAAABWU3MDQ3A2UxMgpha2FtYWllZGdlA25ldAAAAQAB"}
-00642{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":39,"source":"telegram.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1588779600828,"flow_last_seen":0,"flow_tot_l4_data_len":50,"flow_min_l4_data_len":50,"flow_max_l4_data_len":50,"flow_avg_l4_data_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61631,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"e7047.e12.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
+00654{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":39,"source":"telegram.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1588779600828,"flow_last_seen":0,"flow_min_l4_payload_len":42,"flow_max_l4_payload_len":42,"flow_tot_l4_payload_len":42,"flow_avg_l4_payload_len":42,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61631,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"e7047.e12.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
 00768{"flow_id":7,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":40,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779600,"pkt_ts_usec":838194,"pkt_caplen":320,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":320,"pkt_l4_len":286,"pkt":"jP5XIzfkKDc3AG3ICABFAAEyb04AAP8Rx4PAqAFNwKgBSxTpFOkBHhkOAACEAAAAAAEAAAAED19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMAAEAABGUABANTHVjYeKAmXMgaU1hY8AMwDIAIYABAAAAeAATAAAAAMAFCkx1Y2FzLWlNYWPAIcAyABCAAQAAEZQAWBZycEJBPTM5OjJBOjg4OkFDOjQxOkFCCnJwVnI9MTUyLjERcnBIST1mOWM0NmM2ZGQwN2QRcnBITj0zYzVkYzVjZTk1NzgRcnBIQT04Y2E4Y2I3MzFjMWMNTHVjYeKAmXMgaU1hYwxfZGV2aWNlLWluZm\/AHAAQAAEAABGUABoObW9kZWw9aU1hYzExLDMKb3N4dmVycz0xN8BUAAGAAQAAAHgABMCoAU0="}
 00475{"flow_id":8,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":41,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779600,"pkt_ts_usec":842525,"pkt_caplen":100,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":100,"pkt_l4_len":66,"pkt":"KDc3AG3IEBMx8Tl2CABFAABWE2lAADkRqo\/AqAEBwKgBTQA18L8AQgAAo9OBgAABAAEAAAAABWU3MDQ3A2UxMgpha2FtYWllZGdlA25ldAAAAQABwAwAAQABAAAAFAAEXHr3XA=="}
-00669{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":41,"source":"telegram.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1588779600828,"flow_last_seen":1588779600842,"flow_tot_l4_data_len":116,"flow_min_l4_data_len":50,"flow_max_l4_data_len":66,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61631,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"e7047.e12.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"92.122.247.92"}}
-00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":44,"source":"telegram.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1588779601222,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00681{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":41,"source":"telegram.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1588779600828,"flow_last_seen":1588779600842,"flow_min_l4_payload_len":42,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":100,"flow_avg_l4_payload_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61631,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"e7047.e12.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"92.122.247.92"}}
+00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":44,"source":"telegram.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1588779601222,"flow_last_seen":0,"flow_min_l4_payload_len":464,"flow_max_l4_payload_len":464,"flow_tot_l4_payload_len":464,"flow_avg_l4_payload_len":464,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 01028{"flow_id":9,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":44,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779601,"pkt_ts_usec":222806,"pkt_caplen":506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":506,"pkt_l4_len":472,"pkt":"\/\/\/\/\/\/\/\/KDc3AG3ICABFAAHsBFEAAEARsrvAqAFN\/\/\/\/\/0RcRFwB2FvpeyJ2ZXJzaW9uIjogWzIsIDBdLCAicG9ydCI6IDE3NTAwLCAiaG9zdF9pbnQiOiA0MDk1NjMzNTA1MDQ3NDIyMDI0ODQ4MjA1NjAzMDgyNTQwNDYyOSwgImRpc3BsYXluYW1lIjogIiIsICJuYW1lc3BhY2VzIjogWzUzMDMzMDEyNDgsIDc4NTI2NjE3NywgMTUyNjI2MzA0NSwgMjg1MjE2MDcsIDE0ODE5MzM3LCA0NTE0NzI2NTgsIDczNjM0MTUyOCwgOTM4ODEzODQ5LCAyNzUwMzcwNTYwLCAxMjY3Njk1MTA5LCA1NDQwNDA3MDcyLCA1ODM0NDk5NiwgNDA1NjQ2MjU5MiwgNzA1MzYyNzE4NCwgMTUyMjE3NzU4NywgMTQyMTExNDM5OSwgMTI1MjExNjQyOSwgNzA3OTYzNjY4OCwgMTc2OTY0MzA3LCAxMjU1NDA1NjYsIDEwNDc0MjgxODksIDQ3MTYxOTAwNDgsIDU0NjcxNjMwODgsIDExOTUwNDQwNzEsIDk2ODUzMjI0LCAxNzYwOTk2MywgNjQ3ODMwMzQ0MCwgNTExNzA2NjQyLCA2Mjk3OTU1MTg0LCAxNDE1NjIwMzUwXX0="}
-00515{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":44,"source":"telegram.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1588779601222,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}}
-00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":45,"source":"telegram.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1588779601223,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":44,"source":"telegram.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1588779601222,"flow_last_seen":0,"flow_min_l4_payload_len":464,"flow_max_l4_payload_len":464,"flow_tot_l4_payload_len":464,"flow_avg_l4_payload_len":464,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}}
+00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":45,"source":"telegram.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1588779601223,"flow_last_seen":0,"flow_min_l4_payload_len":464,"flow_max_l4_payload_len":464,"flow_tot_l4_payload_len":464,"flow_avg_l4_payload_len":464,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 01025{"flow_id":10,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":45,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779601,"pkt_ts_usec":223133,"pkt_caplen":506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":506,"pkt_l4_len":472,"pkt":"\/\/\/\/\/\/\/\/KDc3AG3ICABFAAHskFkAAEARZAvAqAFNwKgB\/0RcRFwB2JlBeyJ2ZXJzaW9uIjogWzIsIDBdLCAicG9ydCI6IDE3NTAwLCAiaG9zdF9pbnQiOiA0MDk1NjMzNTA1MDQ3NDIyMDI0ODQ4MjA1NjAzMDgyNTQwNDYyOSwgImRpc3BsYXluYW1lIjogIiIsICJuYW1lc3BhY2VzIjogWzUzMDMzMDEyNDgsIDc4NTI2NjE3NywgMTUyNjI2MzA0NSwgMjg1MjE2MDcsIDE0ODE5MzM3LCA0NTE0NzI2NTgsIDczNjM0MTUyOCwgOTM4ODEzODQ5LCAyNzUwMzcwNTYwLCAxMjY3Njk1MTA5LCA1NDQwNDA3MDcyLCA1ODM0NDk5NiwgNDA1NjQ2MjU5MiwgNzA1MzYyNzE4NCwgMTUyMjE3NzU4NywgMTQyMTExNDM5OSwgMTI1MjExNjQyOSwgNzA3OTYzNjY4OCwgMTc2OTY0MzA3LCAxMjU1NDA1NjYsIDEwNDc0MjgxODksIDQ3MTYxOTAwNDgsIDU0NjcxNjMwODgsIDExOTUwNDQwNzEsIDk2ODUzMjI0LCAxNzYwOTk2MywgNjQ3ODMwMzQ0MCwgNTExNzA2NjQyLCA2Mjk3OTU1MTg0LCAxNDE1NjIwMzUwXX0="}
-00514{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":45,"source":"telegram.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1588779601223,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}}
+00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":45,"source":"telegram.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1588779601223,"flow_last_seen":0,"flow_min_l4_payload_len":464,"flow_max_l4_payload_len":464,"flow_tot_l4_payload_len":464,"flow_avg_l4_payload_len":464,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}}
 00781{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":50,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779601,"pkt_ts_usec":447909,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJZAAEARYHvAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGAM98X0EAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
 00583{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":67,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779603,"pkt_ts_usec":292776,"pkt_caplen":181,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":181,"pkt_l4_len":147,"pkt":"AQBeAAD7wJrQLWJ0CABFAACnQj4AAP8R1i7AqAE14AAA+xTpFOkAk34YAAAAAAAFAAAAAAABCF9ob21la2l0BF90Y3AFbG9jYWwAAAyAAQ9fY29tcGFuaW9uLWxpbmvAFQAMgAEFX3Jhb3DAFQAMgAEIX2FpcnBsYXnAFQAMgAEMX3NsZWVwLXByb3h5BF91ZHDAGgAMgAEAACkFoAAAEZQAEgAEAA4AMeKa0C1idMCa0C1idA=="}
-00568{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":67,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1588779596464,"flow_last_seen":1588779603292,"flow_tot_l4_data_len":200,"flow_min_l4_data_len":53,"flow_max_l4_data_len":147,"flow_avg_l4_data_len":100,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_homekit._tcp.local"}}
-00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":68,"source":"telegram.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1588779603292,"flow_last_seen":0,"flow_tot_l4_data_len":147,"flow_min_l4_data_len":147,"flow_max_l4_data_len":147,"flow_avg_l4_data_len":147,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::18a0:a412:8935:c01b","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00579{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":67,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1588779596464,"flow_last_seen":1588779603292,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":139,"flow_tot_l4_payload_len":184,"flow_avg_l4_payload_len":92,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_homekit._tcp.local"}}
+00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":68,"source":"telegram.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1588779603292,"flow_last_seen":0,"flow_min_l4_payload_len":139,"flow_max_l4_payload_len":139,"flow_tot_l4_payload_len":139,"flow_avg_l4_payload_len":139,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::18a0:a412:8935:c01b","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00612{"flow_id":11,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":68,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779603,"pkt_ts_usec":292829,"pkt_caplen":201,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":201,"pkt_l4_len":147,"pkt":"MzMAAAD7wJrQLWJ0ht1gBqDxAJMR\/\/6AAAAAAAAAGKCkEok1wBv\/AgAAAAAAAAAAAAAAAAD7FOkU6QCTHG8AAAAAAAUAAAAAAAEIX2hvbWVraXQEX3RjcAVsb2NhbAAADIABD19jb21wYW5pb24tbGlua8AVAAyAAQVfcmFvcMAVAAyAAQhfYWlycGxhecAVAAyAAQxfc2xlZXAtcHJveHkEX3VkcMAaAAyAAQAAKQWgAAARlAASAAQADgAx4prQLWJ0wJrQLWJ0"}
-00560{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":68,"source":"telegram.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1588779603292,"flow_last_seen":0,"flow_tot_l4_data_len":147,"flow_min_l4_data_len":147,"flow_max_l4_data_len":147,"flow_avg_l4_data_len":147,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::18a0:a412:8935:c01b","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_homekit._tcp.local"}}
-00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":69,"source":"telegram.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1588779603320,"flow_last_seen":0,"flow_tot_l4_data_len":286,"flow_min_l4_data_len":286,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":286,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.53","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00572{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":68,"source":"telegram.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1588779603292,"flow_last_seen":0,"flow_min_l4_payload_len":139,"flow_max_l4_payload_len":139,"flow_tot_l4_payload_len":139,"flow_avg_l4_payload_len":139,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::18a0:a412:8935:c01b","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_homekit._tcp.local"}}
+00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":69,"source":"telegram.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1588779603320,"flow_last_seen":0,"flow_min_l4_payload_len":278,"flow_max_l4_payload_len":278,"flow_tot_l4_payload_len":278,"flow_avg_l4_payload_len":278,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.53","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00769{"flow_id":12,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":69,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779603,"pkt_ts_usec":320702,"pkt_caplen":320,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":320,"pkt_l4_len":286,"pkt":"wJrQLWJ0KDc3AG3ICABFAAEyUGUAAP8R5oLAqAFNwKgBNRTpFOkBHhkkAACEAAAAAAEAAAAED19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMAAEAABGUABANTHVjYeKAmXMgaU1hY8AMwDIAIYABAAAAeAATAAAAAMAFCkx1Y2FzLWlNYWPAIcAyABCAAQAAEZQAWBZycEJBPTM5OjJBOjg4OkFDOjQxOkFCCnJwVnI9MTUyLjERcnBIST1mOWM0NmM2ZGQwN2QRcnBITj0zYzVkYzVjZTk1NzgRcnBIQT04Y2E4Y2I3MzFjMWMNTHVjYeKAmXMgaU1hYwxfZGV2aWNlLWluZm\/AHAAQAAEAABGUABoObW9kZWw9aU1hYzExLDMKb3N4dmVycz0xN8BUAAGAAQAAAHgABMCoAU0="}
-00558{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":69,"source":"telegram.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1588779603320,"flow_last_seen":0,"flow_tot_l4_data_len":286,"flow_min_l4_data_len":286,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":286,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.53","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_companion-link._tcp.local"}}
+00570{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":69,"source":"telegram.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1588779603320,"flow_last_seen":0,"flow_min_l4_payload_len":278,"flow_max_l4_payload_len":278,"flow_tot_l4_payload_len":278,"flow_avg_l4_payload_len":278,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.53","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_companion-link._tcp.local"}}
 00659{"flow_id":3,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":76,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779604,"pkt_ts_usec":297208,"pkt_caplen":238,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":238,"pkt_l4_len":204,"pkt":"AQBeAAD7wJrQLWJ0CABFAADgDXQAAP8RCsDAqAE14AAA+xTpFOkAzL4AAAAAAAADAAMAAAABCF9ob21la2l0BF90Y3AFbG9jYWwAAAwAAQ9fY29tcGFuaW9uLWxpbmvAFQAMAAEMX3NsZWVwLXByb3h5BF91ZHDAGgAMAAHAJQAMAAEAABGUABANTHVjYeKAmXMgaU1hY8AlwCUADAABAAARlAAOC0x1Y2EncyBpUGFkwCXAOwAMAAEAABGUABIPNTAtMzUtMTAtNzAuMSAxwDsAACkFoAAAEZQAEgAEAA4AMeKa0C1idMCa0C1idA=="}
 00688{"flow_id":11,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":77,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779604,"pkt_ts_usec":297420,"pkt_caplen":258,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":258,"pkt_l4_len":204,"pkt":"MzMAAAD7wJrQLWJ0ht1gBqDxAMwR\/\/6AAAAAAAAAGKCkEok1wBv\/AgAAAAAAAAAAAAAAAAD7FOkU6QDMXFcAAAAAAAMAAwAAAAEIX2hvbWVraXQEX3RjcAVsb2NhbAAADAABD19jb21wYW5pb24tbGlua8AVAAwAAQxfc2xlZXAtcHJveHkEX3VkcMAaAAwAAcAlAAwAAQAAEZQAEA1MdWNh4oCZcyBpTWFjwCXAJQAMAAEAABGUAA4LTHVjYSdzIGlQYWTAJcA7AAwAAQAAEZQAEg81MC0zNS0xMC03MC4xIDHAOwAAKQWgAAARlAASAAQADgAx4prQLWJ0wJrQLWJ0"}
 00769{"flow_id":7,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":78,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779604,"pkt_ts_usec":398986,"pkt_caplen":320,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":320,"pkt_l4_len":286,"pkt":"jP5XIzfkKDc3AG3ICABFAAEy\/rUAAP8ROBzAqAFNwKgBSxTpFOkBHhkOAACEAAAAAAEAAAAED19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMAAEAABGUABANTHVjYeKAmXMgaU1hY8AMwDIAIYABAAAAeAATAAAAAMAFCkx1Y2FzLWlNYWPAIcAyABCAAQAAEZQAWBZycEJBPTM5OjJBOjg4OkFDOjQxOkFCCnJwVnI9MTUyLjERcnBIST1mOWM0NmM2ZGQwN2QRcnBITj0zYzVkYzVjZTk1NzgRcnBIQT04Y2E4Y2I3MzFjMWMNTHVjYeKAmXMgaU1hYwxfZGV2aWNlLWluZm\/AHAAQAAEAABGUABoObW9kZWw9aU1hYzExLDMKb3N4dmVycz0xN8BUAAGAAQAAAHgABMCoAU0="}
-00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":99,"source":"telegram.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1588779601222,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00482{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":99,"source":"telegram.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1588779601223,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":99,"source":"telegram.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1588779603320,"flow_last_seen":0,"flow_tot_l4_data_len":286,"flow_min_l4_data_len":286,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":286,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.53","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":99,"source":"telegram.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1588779596465,"flow_last_seen":0,"flow_tot_l4_data_len":319,"flow_min_l4_data_len":319,"flow_max_l4_data_len":319,"flow_avg_l4_data_len":319,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":99,"source":"telegram.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1588779601222,"flow_last_seen":0,"flow_min_l4_payload_len":464,"flow_max_l4_payload_len":464,"flow_tot_l4_payload_len":464,"flow_avg_l4_payload_len":464,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":99,"source":"telegram.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1588779601223,"flow_last_seen":0,"flow_min_l4_payload_len":464,"flow_max_l4_payload_len":464,"flow_tot_l4_payload_len":464,"flow_avg_l4_payload_len":464,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":99,"source":"telegram.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1588779603320,"flow_last_seen":0,"flow_min_l4_payload_len":278,"flow_max_l4_payload_len":278,"flow_tot_l4_payload_len":278,"flow_avg_l4_payload_len":278,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.53","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":99,"source":"telegram.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1588779596465,"flow_last_seen":0,"flow_min_l4_payload_len":311,"flow_max_l4_payload_len":311,"flow_tot_l4_payload_len":311,"flow_avg_l4_payload_len":311,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00781{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":99,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779606,"pkt_ts_usec":465822,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJdAAEARYHrAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGABAmSTUAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
 00533{"flow_id":3,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":102,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779607,"pkt_ts_usec":307651,"pkt_caplen":142,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":142,"pkt_l4_len":108,"pkt":"AQBeAAD7wJrQLWJ0CABFAACAeJ4AAP8Rn\/XAqAE14AAA+xTpFOkAbGrlAAAAAAABAAEAAAABDF9zbGVlcC1wcm94eQRfdWRwBWxvY2FsAAAMAAHADAAMAAEAABGRABIPNTAtMzUtMTAtNzAuMSAxwAwAACkFoAAAEZQAEgAEAA4AMeKa0C1idMCa0C1idA=="}
-00573{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":102,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_first_seen":1588779596464,"flow_last_seen":1588779607307,"flow_tot_l4_data_len":512,"flow_min_l4_data_len":53,"flow_max_l4_data_len":204,"flow_avg_l4_data_len":128,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_sleep-proxy._udp.local"}}
+00585{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":102,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_first_seen":1588779596464,"flow_last_seen":1588779607307,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":196,"flow_tot_l4_payload_len":480,"flow_avg_l4_payload_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_sleep-proxy._udp.local"}}
 00561{"flow_id":11,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":103,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779607,"pkt_ts_usec":308336,"pkt_caplen":162,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":162,"pkt_l4_len":108,"pkt":"MzMAAAD7wJrQLWJ0ht1gBqDxAGwR\/\/6AAAAAAAAAGKCkEok1wBv\/AgAAAAAAAAAAAAAAAAD7FOkU6QBsCTwAAAAAAAEAAQAAAAEMX3NsZWVwLXByb3h5BF91ZHAFbG9jYWwAAAwAAcAMAAwAAQAAEZEAEg81MC0zNS0xMC03MC4xIDHADAAAKQWgAAARlAASAAQADgAx4prQLWJ0wJrQLWJ0"}
-00585{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":103,"source":"telegram.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":3,"flow_first_seen":1588779603292,"flow_last_seen":1588779607308,"flow_tot_l4_data_len":459,"flow_min_l4_data_len":108,"flow_max_l4_data_len":204,"flow_avg_l4_data_len":153,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::18a0:a412:8935:c01b","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_sleep-proxy._udp.local"}}
-00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":104,"source":"telegram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1588779607374,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":52118,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00597{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":103,"source":"telegram.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":3,"flow_first_seen":1588779603292,"flow_last_seen":1588779607308,"flow_min_l4_payload_len":100,"flow_max_l4_payload_len":196,"flow_tot_l4_payload_len":435,"flow_avg_l4_payload_len":145,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::18a0:a412:8935:c01b","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_sleep-proxy._udp.local"}}
+00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":104,"source":"telegram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1588779607374,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":52118,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00438{"flow_id":13,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":104,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779607,"pkt_ts_usec":374355,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA9u6QAAP8RfGzAqAFNwKgBAcuWADUAKd8a0oUBAAABAAAAAAAAAmluCWFwcGNlbnRlcgJtcwAAAQAB"}
-00637{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":104,"source":"telegram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1588779607374,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":52118,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Microsoft","breed":"Safe","category":"Cloud"},"dns": {"query":"in.appcenter.ms","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
+00649{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":104,"source":"telegram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1588779607374,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":52118,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Microsoft","breed":"Safe","category":"Cloud"},"dns": {"query":"in.appcenter.ms","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
 00621{"flow_id":13,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":105,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779607,"pkt_ts_usec":388567,"pkt_caplen":209,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":209,"pkt_l4_len":175,"pkt":"KDc3AG3IEBMx8Tl2CABFAADD2ppAADkR4vDAqAEBwKgBTQA1y5YArwAA0oWBgAABAAMAAAAAAmluCWFwcGNlbnRlcgJtcwAAAQABwAwABQABAAAAXQAuGWluMi1wcm9kLWVhc3QtdXMyLTIzZmEzMzAOdHJhZmZpY21hbmFnZXIDbmV0AMAtAAUAAQAAAAsAMBNpbjItZ3cyLTA0LWVkZTZmMDZlB2Vhc3R1czIIY2xvdWRhcHAFYXp1cmUDY29tAMBnAAEAAQAAAAUABBQsTvs="}
-00665{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":105,"source":"telegram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1588779607374,"flow_last_seen":1588779607388,"flow_tot_l4_data_len":216,"flow_min_l4_data_len":41,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":108,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":52118,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Microsoft","breed":"Safe","category":"Cloud"},"dns": {"query":"in.appcenter.ms","num_queries":1,"num_answers":3,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"20.44.78.251"}}
+00677{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":105,"source":"telegram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1588779607374,"flow_last_seen":1588779607388,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":167,"flow_tot_l4_payload_len":200,"flow_avg_l4_payload_len":100,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":52118,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Microsoft","breed":"Safe","category":"Cloud"},"dns": {"query":"in.appcenter.ms","num_queries":1,"num_answers":3,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"20.44.78.251"}}
 00769{"flow_id":7,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":110,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779607,"pkt_ts_usec":883587,"pkt_caplen":320,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":320,"pkt_l4_len":286,"pkt":"jP5XIzfkKDc3AG3ICABFAAEyjSEAAP8RqbDAqAFNwKgBSxTpFOkBHhkOAACEAAAAAAEAAAAED19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMAAEAABGUABANTHVjYeKAmXMgaU1hY8AMwDIAIYABAAAAeAATAAAAAMAFCkx1Y2FzLWlNYWPAIcAyABCAAQAAEZQAWBZycEJBPTM5OjJBOjg4OkFDOjQxOkFCCnJwVnI9MTUyLjERcnBIST1mOWM0NmM2ZGQwN2QRcnBITj0zYzVkYzVjZTk1NzgRcnBIQT04Y2E4Y2I3MzFjMWMNTHVjYeKAmXMgaU1hYwxfZGV2aWNlLWluZm\/AHAAQAAEAABGUABoObW9kZWw9aU1hYzExLDMKb3N4dmVycz0xN8BUAAGAAQAAAHgABMCoAU0="}
-00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":113,"source":"telegram.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1588779608134,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":113,"source":"telegram.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1588779608134,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00460{"flow_id":14,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":113,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779608,"pkt_ts_usec":134321,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"\/\/\/\/\/\/\/\/wJrQLWJ0CABFAABEQD4AAEARtebAqAE1wKgB\/+EV4RUAMNBmU3BvdFVkcDClWtsnvt2XzwABAACyJIr8D\/N2Z9WO7tpCHKgrvJhaBg=="}
-00511{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":113,"source":"telegram.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1588779608134,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","ndpi": {"proto":"Spotify","breed":"Acceptable","category":"Music"}}
+00523{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":113,"source":"telegram.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1588779608134,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","ndpi": {"proto":"Spotify","breed":"Acceptable","category":"Music"}}
 00460{"flow_id":14,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":134,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779611,"pkt_ts_usec":135146,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"\/\/\/\/\/\/\/\/wJrQLWJ0CABFAABE4wYAAEAREx7AqAE1wKgB\/+EV4RUAMNBmU3BvdFVkcDClWtsnvt2XzwABAACyJIr8D\/N2Z9WO7tpCHKgrvJhaBg=="}
-00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":139,"source":"telegram.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1588779611355,"flow_last_seen":0,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":133,"flow_max_l4_data_len":133,"flow_avg_l4_data_len":133,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.75","dst_ip":"239.255.255.250","src_port":57916,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00495{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":139,"source":"telegram.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1588779611355,"flow_last_seen":0,"flow_min_l4_payload_len":125,"flow_max_l4_payload_len":125,"flow_tot_l4_payload_len":125,"flow_avg_l4_payload_len":125,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.75","dst_ip":"239.255.255.250","src_port":57916,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00570{"flow_id":15,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":139,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779611,"pkt_ts_usec":355675,"pkt_caplen":167,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":167,"pkt_l4_len":133,"pkt":"AQBef\/\/6jP5XIzfkCABFAACZH80AAAER55nAqAFL7\/\/\/+uI8B2wAhTXETS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KDQo="}
-00514{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":139,"source":"telegram.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1588779611355,"flow_last_seen":0,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":133,"flow_max_l4_data_len":133,"flow_avg_l4_data_len":133,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.75","dst_ip":"239.255.255.250","src_port":57916,"dst_port":1900,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":139,"source":"telegram.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1588779611355,"flow_last_seen":0,"flow_min_l4_payload_len":125,"flow_max_l4_payload_len":125,"flow_tot_l4_payload_len":125,"flow_avg_l4_payload_len":125,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.75","dst_ip":"239.255.255.250","src_port":57916,"dst_port":1900,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00769{"flow_id":7,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":140,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779611,"pkt_ts_usec":393437,"pkt_caplen":320,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":320,"pkt_l4_len":286,"pkt":"jP5XIzfkKDc3AG3ICABFAAEyXK8AAP8R2iLAqAFNwKgBSxTpFOkBHhkOAACEAAAAAAEAAAAED19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMAAEAABGUABANTHVjYeKAmXMgaU1hY8AMwDIAIYABAAAAeAATAAAAAMAFCkx1Y2FzLWlNYWPAIcAyABCAAQAAEZQAWBZycEJBPTM5OjJBOjg4OkFDOjQxOkFCCnJwVnI9MTUyLjERcnBIST1mOWM0NmM2ZGQwN2QRcnBITj0zYzVkYzVjZTk1NzgRcnBIQT04Y2E4Y2I3MzFjMWMNTHVjYeKAmXMgaU1hYwxfZGV2aWNlLWluZm\/AHAAQAAEAABGUABoObW9kZWw9aU1hYzExLDMKb3N4dmVycz0xN8BUAAGAAQAAAHgABMCoAU0="}
 00782{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":141,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779611,"pkt_ts_usec":451548,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJhAAEARYHnAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGALuAMeAAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
 00570{"flow_id":15,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":142,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779611,"pkt_ts_usec":458582,"pkt_caplen":167,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":167,"pkt_l4_len":133,"pkt":"AQBef\/\/6jP5XIzfkCABFAACZnzoAAAERaCzAqAFL7\/\/\/+uI8B2wAhTXETS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KDQo="}
 00570{"flow_id":15,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":145,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779611,"pkt_ts_usec":657864,"pkt_caplen":167,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":167,"pkt_l4_len":133,"pkt":"AQBef\/\/6jP5XIzfkCABFAACZ2TYAAAERLjDAqAFL7\/\/\/+uI8B2wAhTXETS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KDQo="}
-00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":164,"source":"telegram.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1588779615019,"flow_last_seen":0,"flow_tot_l4_data_len":51,"flow_min_l4_data_len":51,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61120,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":164,"source":"telegram.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1588779615019,"flow_last_seen":0,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61120,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00453{"flow_id":16,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":164,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779615,"pkt_ts_usec":19709,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"pkt":"EBMx8Tl2KDc3AG3ICABFAABHiDkAAP8Rr83AqAFNwKgBAe7AADUAMxxUuQsBAAABAAAAAAAABWU0NTE4BGRzY3gKYWthbWFpZWRnZQNuZXQAAAEAAQ=="}
-00645{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":164,"source":"telegram.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1588779615019,"flow_last_seen":0,"flow_tot_l4_data_len":51,"flow_min_l4_data_len":51,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61120,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"e4518.dscx.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
+00657{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":164,"source":"telegram.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1588779615019,"flow_last_seen":0,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61120,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"e4518.dscx.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
 00475{"flow_id":16,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":165,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779615,"pkt_ts_usec":32983,"pkt_caplen":101,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":101,"pkt_l4_len":67,"pkt":"KDc3AG3IEBMx8Tl2CABFAABXJ0xAADkRlqvAqAEBwKgBTQA17sAAQwAAuQuBgAABAAEAAAAABWU0NTE4BGRzY3gKYWthbWFpZWRnZQNuZXQAAAEAAcAMAAEAAQAAAA4ABFx69t8="}
-00673{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":165,"source":"telegram.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1588779615019,"flow_last_seen":1588779615032,"flow_tot_l4_data_len":118,"flow_min_l4_data_len":51,"flow_max_l4_data_len":67,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61120,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"e4518.dscx.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"92.122.246.223"}}
-00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":168,"source":"telegram.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1588779615961,"flow_last_seen":0,"flow_tot_l4_data_len":57,"flow_min_l4_data_len":57,"flow_max_l4_data_len":57,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.52","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00685{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":165,"source":"telegram.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1588779615019,"flow_last_seen":1588779615032,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61120,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"e4518.dscx.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"92.122.246.223"}}
+00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":168,"source":"telegram.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1588779615961,"flow_last_seen":0,"flow_min_l4_payload_len":49,"flow_max_l4_payload_len":49,"flow_tot_l4_payload_len":49,"flow_avg_l4_payload_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.52","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00462{"flow_id":17,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":168,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779615,"pkt_ts_usec":961995,"pkt_caplen":91,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":91,"pkt_l4_len":57,"pkt":"AQBeAAD78KNaMBgSCABFAABNRwcAAP8R0cDAqAE04AAA+xTpFOkAOcUdAAAAAAACAAAAAAAABV9yYW9wBF90Y3AFbG9jYWwAAAyAAQhfYWlycGxhecASAAyAAQ=="}
-00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":168,"source":"telegram.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1588779615961,"flow_last_seen":0,"flow_tot_l4_data_len":57,"flow_min_l4_data_len":57,"flow_max_l4_data_len":57,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.52","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_raop._tcp.local"}}
-00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":169,"source":"telegram.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1588779615962,"flow_last_seen":0,"flow_tot_l4_data_len":57,"flow_min_l4_data_len":57,"flow_max_l4_data_len":57,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4dc:edec:5b0c:a661","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00556{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":168,"source":"telegram.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1588779615961,"flow_last_seen":0,"flow_min_l4_payload_len":49,"flow_max_l4_payload_len":49,"flow_tot_l4_payload_len":49,"flow_avg_l4_payload_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.52","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_raop._tcp.local"}}
+00495{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":169,"source":"telegram.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1588779615962,"flow_last_seen":0,"flow_min_l4_payload_len":49,"flow_max_l4_payload_len":49,"flow_tot_l4_payload_len":49,"flow_avg_l4_payload_len":49,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4dc:edec:5b0c:a661","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00492{"flow_id":18,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":169,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779615,"pkt_ts_usec":962218,"pkt_caplen":111,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":111,"pkt_l4_len":57,"pkt":"MzMAAAD78KNaMBgSht1gBhFuADkR\/\/6AAAAAAAAABNzt7FsMpmH\/AgAAAAAAAAAAAAAAAAD7FOkU6QA5dUAAAAAAAAIAAAAAAAAFX3Jhb3AEX3RjcAVsb2NhbAAADIABCF9haXJwbGF5wBIADIAB"}
-00553{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":169,"source":"telegram.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1588779615962,"flow_last_seen":0,"flow_tot_l4_data_len":57,"flow_min_l4_data_len":57,"flow_max_l4_data_len":57,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4dc:edec:5b0c:a661","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_raop._tcp.local"}}
-00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":170,"source":"telegram.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.7","src_port":23174,"dst_port":521,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00565{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":169,"source":"telegram.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1588779615962,"flow_last_seen":0,"flow_min_l4_payload_len":49,"flow_max_l4_payload_len":49,"flow_tot_l4_payload_len":49,"flow_avg_l4_payload_len":49,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4dc:edec:5b0c:a661","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_raop._tcp.local"}}
+00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":170,"source":"telegram.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.7","src_port":23174,"dst_port":521,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00469{"flow_id":19,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":170,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":36528,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABERC0AAEARERTAqAFNW2wIB1qGAgkAMLAM3EwAKRVlt6y8I22p7aDVl\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/8o+UYRJgGi8A=="}
-00506{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":170,"source":"telegram.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.7","src_port":23174,"dst_port":521,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
-00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":171,"source":"telegram.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.5","src_port":23174,"dst_port":523,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00518{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":170,"source":"telegram.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.7","src_port":23174,"dst_port":521,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
+00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":171,"source":"telegram.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.5","src_port":23174,"dst_port":523,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00470{"flow_id":20,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":171,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":36609,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABEWYkAAEAR97nAqAFNW2wMBVqGAgsAMMZE3EwAKRVlt6y8I22p7aDVl\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/\/VYJzCLkR9XA=="}
-00507{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":171,"source":"telegram.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.5","src_port":23174,"dst_port":523,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
-00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":172,"source":"telegram.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.1","src_port":23174,"dst_port":527,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00519{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":171,"source":"telegram.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.5","src_port":23174,"dst_port":523,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
+00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":172,"source":"telegram.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.1","src_port":23174,"dst_port":527,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00469{"flow_id":21,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":172,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":36707,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABEZqwAAEAR5prAqAFNW2wQAVqGAg8AMLyJ3EwAKRVlt6y8I22p7aDVl\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/9u+DapRNA5DQ=="}
-00507{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":172,"source":"telegram.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.1","src_port":23174,"dst_port":527,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
-00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":173,"source":"telegram.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.1","src_port":23174,"dst_port":536,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00519{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":172,"source":"telegram.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.1","src_port":23174,"dst_port":527,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
+00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":173,"source":"telegram.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.1","src_port":23174,"dst_port":536,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00470{"flow_id":22,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":173,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":36797,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABEMZgAAEARH6\/AqAFNW2wMAVqGAhgAMB7S3EwAKRVlt6y8I22p7aDVl\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/8nsGAWUhbrUA=="}
-00507{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":173,"source":"telegram.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.1","src_port":23174,"dst_port":536,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
-00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":174,"source":"telegram.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.8","src_port":23174,"dst_port":538,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00519{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":173,"source":"telegram.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.1","src_port":23174,"dst_port":536,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
+00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":174,"source":"telegram.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.8","src_port":23174,"dst_port":538,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00469{"flow_id":23,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":174,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":36876,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABECJIAAEARTK7AqAFNW2wICFqGAhoAMJgJ3EwAKRVlt6y8I22p7aDVl\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/8HjiXC2fxIoA=="}
-00506{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":174,"source":"telegram.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.8","src_port":23174,"dst_port":538,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
-00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":175,"source":"telegram.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.4","src_port":23174,"dst_port":538,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00518{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":174,"source":"telegram.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.8","src_port":23174,"dst_port":538,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
+00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":175,"source":"telegram.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.4","src_port":23174,"dst_port":538,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00469{"flow_id":24,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":175,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":36955,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABEVZYAAEAR963AqAFNW2wQBFqGAhoAMGBV3EwAKRVlt6y8I22p7aDVl\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/8kkP6VHClAVg=="}
-00507{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":175,"source":"telegram.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.4","src_port":23174,"dst_port":538,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
+00519{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":175,"source":"telegram.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1588779616036,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.4","src_port":23174,"dst_port":538,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
 00501{"flow_id":19,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":176,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":70253,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"KDc3AG3IEBMx8Tl2CABFAABcvxJAADMRYxZbbAgHwKgBTQIJWoYASDvF3EwAKRVlt6y8I22p7aDVl\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/8dyFcBg2rJeKPlGESYBovAAAAAAAAAAAAAA\/\/9XC83DXdwAAA=="}
 00501{"flow_id":23,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":177,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":76440,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"KDc3AG3IEBMx8Tl2CABFAABc0gJAADMRUCVbbAgIwKgBTQIaWoYASCPC3EwAKRVlt6y8I22p7aDVl\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/8dyFcBg2rJeB44lwtn8SKAAAAAAAAAAAAAA\/\/9XC83DXdwAAA=="}
 00503{"flow_id":20,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":178,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":161820,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"KDc3AG3IEBMx8Tl2CABFAABcHlxAADQR\/s5bbAwFwKgBTQILWoYASFH93EwAKRVlt6y8I22p7aDVl\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/8dyFcBg2rJe1WCcwi5EfVwAAAAAAAAAAAAA\/\/9XC83DXdwAAA=="}
@@ -140,8 +140,8 @@
 00527{"flow_id":22,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":185,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":374470,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"EBMx8Tl2KDc3AG3ICABFAAB8TYUAAEARA4rAqAFNW2wMAVqGAhgAaPtH3EwAKRVlt6y8I22p7aDVlzF9tkqG8Vy9mc+httTfBLUUKD3nPIpyRy3ItnD3hVzo5GeIoM2qaFz\/yCQX0+y0hipTw\/kylFSjOOn2uuzWtdHeg39EeEdeCXu4W27oK0KN"}
 00525{"flow_id":23,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":186,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":374717,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"KDc3AG3IEBMx8Tl2CABFAAB80idAADMRT+BbbAgIwKgBTQIaWoYAaCPe3EwAKRVlt6y8I22p7aDVl5GbCK4j4zRv3DTd8DT6OUw6qpjroPsdobKbJkssqpPX5uXMLNXGSRggLwmRIKQDuFEnjoz+E5Zlydodds5mKwEYgkGhNIjlK85eZgSRk81C"}
 00782{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":187,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":446782,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJlAAEARYHjAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGAPwKR20AAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
-00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":188,"source":"telegram.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1588779615962,"flow_last_seen":0,"flow_tot_l4_data_len":57,"flow_min_l4_data_len":57,"flow_max_l4_data_len":57,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4dc:edec:5b0c:a661","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00475{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":188,"source":"telegram.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1588779615961,"flow_last_seen":0,"flow_tot_l4_data_len":57,"flow_min_l4_data_len":57,"flow_max_l4_data_len":57,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.52","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":188,"source":"telegram.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1588779615962,"flow_last_seen":0,"flow_min_l4_payload_len":49,"flow_max_l4_payload_len":49,"flow_tot_l4_payload_len":49,"flow_avg_l4_payload_len":49,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4dc:edec:5b0c:a661","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":188,"source":"telegram.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1588779615961,"flow_last_seen":0,"flow_min_l4_payload_len":49,"flow_max_l4_payload_len":49,"flow_tot_l4_payload_len":49,"flow_avg_l4_payload_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.52","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00527{"flow_id":20,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":188,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":466029,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"KDc3AG3IEBMx8Tl2CABFAAB8HoJAADQR\/ohbbAwFwKgBTQILWoYAaHRJ3EwAKRVlt6y8I22p7aDVl5cYNmc7owIGPJxlskGx5br+SSQy40sMDI5d++f\/6aTzwNmsmc+tH0QUeknBRS9SCGoK6JwfyvJhza8gjx8KUlZD1YkPUiuIlncqMpzfBBG3"}
 00528{"flow_id":22,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":189,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":484536,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"KDc3AG3IEBMx8Tl2CABFAAB8KBFAADQR9P1bbAwBwKgBTQIYWoYAaKHG3EwAKRVlt6y8I22p7aDVl1abu3bDGz6o8fsNot++0zK7RzO7PBk+7Vrmoj8ysTske1f\/EcqIuDby2Fk6mUM4OzQiEPo4kF6e\/Y9\/bAWD7HEOuyvzTKmDTuxutup64haF"}
 00525{"flow_id":24,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":190,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779616,"pkt_ts_usec":505295,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"KDc3AG3IEBMx8Tl2CABFAAB8dyVAADYRn+ZbbBAEwKgBTQIaWoYAaCIT3EwAKRVlt6y8I22p7aDVl45mJpEhOWgZ6A6Kc6hID4w4KLG36jYh+Cxfh82Yl8XDNtvIeuCeB52AwTUXULg6UcBqL7rYB23KloHtMZxkmQf1gFMMk8wX4hEL6yN80sZ2"}
@@ -201,11 +201,11 @@
 00527{"flow_id":22,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":244,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779617,"pkt_ts_usec":173924,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"EBMx8Tl2KDc3AG3ICABFAAB8dtkAAEAR2jXAqAFNW2wMAVqGAhgAaBww3EwAKRVlt6y8I22p7aDVl4vdmXzL72TBwedu7KHurKAh2P1dZR4VCu529CPBH17fOUG3BML2yTk2nLmjgNfhYpep7QwAOhc9vcf32ofx\/+LJzcEwwk2H80BEPwH6IV27"}
 00528{"flow_id":23,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":245,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779617,"pkt_ts_usec":174002,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"EBMx8Tl2KDc3AG3ICABFAAB8f+UAAEAR1SLAqAFNW2wICFqGAhoAaL863EwAKRVlt6y8I22p7aDVl2Z+eUAsmBtQeyC0OUCkfafRX4V225PAmCB0ZuqiMkYuVH6y\/\/nCzJBhcNkpFmRP0pMKp8O1m88zc2drgTh2WlOw+HbtYOEO6ont+XVyA4Ix"}
 00528{"flow_id":24,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":246,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779617,"pkt_ts_usec":174079,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"EBMx8Tl2KDc3AG3ICABFAAB8zjwAAEARfs\/AqAFNW2wQBFqGAhoAaNO63EwAKRVlt6y8I22p7aDVl2tG15m00Z4O5OQSm8Uf2GNj8pAbvopp1wpqnYKwsNZGvZRa0ShBkvgF25\/+Y5mE73LLX4U7zxEu5AntT0mzac2u85OXiFO8LcRPWoBqHH6T"}
-00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":247,"source":"telegram.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1588779617174,"flow_last_seen":0,"flow_tot_l4_data_len":88,"flow_min_l4_data_len":88,"flow_max_l4_data_len":88,"flow_avg_l4_data_len":88,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.52","src_port":23174,"dst_port":31480,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":247,"source":"telegram.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1588779617174,"flow_last_seen":0,"flow_min_l4_payload_len":80,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":80,"flow_avg_l4_payload_len":80,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.52","src_port":23174,"dst_port":31480,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00506{"flow_id":25,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":247,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779617,"pkt_ts_usec":174153,"pkt_caplen":122,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":122,"pkt_l4_len":88,"pkt":"8KNaMBgSKDc3AG3ICABFAABsqlYAAEARTFnAqAFNwKgBNFqGevgAWLgQjfykZ0OTWbVGSN3cMHZvNB3RufFF5FIV8MQ0P3KjKgWFEWl4FO4hV\/puQOILS4RjUor87I6iIoOnx\/A9NueumG+cX0HrNbBHt0bLwMXSB9A="}
-00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":248,"source":"telegram.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1588779617174,"flow_last_seen":0,"flow_tot_l4_data_len":88,"flow_min_l4_data_len":88,"flow_max_l4_data_len":88,"flow_avg_l4_data_len":88,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":23174,"dst_port":60723,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":248,"source":"telegram.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1588779617174,"flow_last_seen":0,"flow_min_l4_payload_len":80,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":80,"flow_avg_l4_payload_len":80,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":23174,"dst_port":60723,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00508{"flow_id":26,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":248,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779617,"pkt_ts_usec":174225,"pkt_caplen":122,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":122,"pkt_l4_len":88,"pkt":"EBMx8Tl2KDc3AG3ICABFAABs\/QcAAEARlrXAqAFNVwvNw1qG7TMAWH9So7C\/sNzcuk+cyiR2EyU9Q\/nbaTxTjDBemDeFTsb5lNpyEwlgOlPEUd9m7ay58cjORIuAWP8IcwSg0vb1EIxOrmmqeB4nTaYDWzAgf8R5\/bQ="}
-00509{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":248,"source":"telegram.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1588779617174,"flow_last_seen":0,"flow_tot_l4_data_len":88,"flow_min_l4_data_len":88,"flow_max_l4_data_len":88,"flow_avg_l4_data_len":88,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":23174,"dst_port":60723,"l4_proto":"udp","ndpi": {"proto":"OpenVPN","breed":"Acceptable","category":"VPN"}}
+00521{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":248,"source":"telegram.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1588779617174,"flow_last_seen":0,"flow_min_l4_payload_len":80,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":80,"flow_avg_l4_payload_len":80,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":23174,"dst_port":60723,"l4_proto":"udp","ndpi": {"proto":"OpenVPN","breed":"Acceptable","category":"VPN"}}
 00503{"flow_id":24,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":249,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779617,"pkt_ts_usec":203544,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"KDc3AG3IEBMx8Tl2CABFAABcd3tAADYRn7BbbBAEwKgBTQIaWoYASL6H3EwAKRVlt6y8I22p7aDVl\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/8dyFcBh2rJe25Xh4b4bMJgAAAAAAAAAAAAA\/\/9XC83DXdwAAA=="}
 00659{"flow_id":19,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":250,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779617,"pkt_ts_usec":209923,"pkt_caplen":234,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":234,"pkt_l4_len":200,"pkt":"KDc3AG3IEBMx8Tl2CABFAADcv79AADMRYelbbAgHwKgBTQIJWoYAyO2t3EwAKRVlt6y8I22p7aDVlz0hS6R\/P6+h7iDam6YNZso1HdbCXaIDIoav8iPnn0fy6+kW9pNMmLa42T9nF\/vZoSfsIHIOW25zUxWLLAxS+KjdCoqjtaEnysQ9pWmOqty88YWXptpYLJIsnEoYpLj73ezoCreiNoCQ4U69zJz9X3a0\/UDc7Pi882XCIV9co6HLki9cZNIlEUT1D\/ZlHKeKTlQV8OBLC21Y0mtlViOwDpz2GB\/I0aD0+8OrgNpr858X"}
 00503{"flow_id":21,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":251,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779617,"pkt_ts_usec":217072,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"KDc3AG3IEBMx8Tl2CABFAABca2FAADYRq81bbBABwKgBTQIPWoYASEuO3EwAKRVlt6y8I22p7aDVl\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/8dyFcBh2rJeR1ZfLL10uzsAAAAAAAAAAAAA\/\/9XC83DXdwAAA=="}
@@ -229,11 +229,11 @@
 00458{"flow_id":25,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":339,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779618,"pkt_ts_usec":677132,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"8KNaMBgSKDc3AG3ICABFAABM2MgAAEARHgfAqAFNwKgBNFqGevgAOHVzLDN7SsFyWuK6F0tpc5OATWnzbEU7qCpTN1Xozj8qtDOuKYxZPvphz9N0EPmGit2J"}
 00458{"flow_id":26,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":340,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779618,"pkt_ts_usec":677198,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"EBMx8Tl2KDc3AG3ICABFAABMg0kAAEAREJTAqAFNVwvNw1qG7TMAOE0OU2RiXNjy8sJRKs8KhnTyEy6Nhnt95vQlharNkBkXr2lvtMgl2dlHhYY4WvPjXQkp"}
 00486{"flow_id":25,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":341,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779618,"pkt_ts_usec":681115,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"KDc3AG3I8KNaMBgSCABFAABcQqkAAEARtBbAqAE0wKgBTXr4WoYASPszoQUCF9P7scTQPabFpgbA0VyPrQrjBdPkNrzYYnOrrtS8RRJbPFmnTpzV\/p+26\/mmrLK5EkJB2QBg75XmqKGTLA=="}
-00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":389,"source":"telegram.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1588779619914,"flow_last_seen":0,"flow_tot_l4_data_len":51,"flow_min_l4_data_len":51,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":47127,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":389,"source":"telegram.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1588779619914,"flow_last_seen":0,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":47127,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00454{"flow_id":27,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":389,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779619,"pkt_ts_usec":914905,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"pkt":"EBMx8Tl2KDc3AG3ICABFAABHqTUAAEARTdLAqAFNwKgBAbgXADUAM25TALgBAAABAAAAAAAAA3d3dxFnb29nbGV0YWdzZXJ2aWNlcwNjb20AAAEAAQ=="}
-00656{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":389,"source":"telegram.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1588779619914,"flow_last_seen":0,"flow_tot_l4_data_len":51,"flow_min_l4_data_len":51,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":47127,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.GoogleServices","breed":"Acceptable","category":"Web"},"dns": {"query":"www.googletagservices.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
+00668{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":389,"source":"telegram.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1588779619914,"flow_last_seen":0,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":47127,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.GoogleServices","breed":"Acceptable","category":"Web"},"dns": {"query":"www.googletagservices.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
 00476{"flow_id":27,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":390,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779619,"pkt_ts_usec":916408,"pkt_caplen":101,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":101,"pkt_l4_len":67,"pkt":"KDc3AG3IAICPmq69CABFAABXwqhAAEAR9E7AqAEBwKgBTQA1uBcAQ5UvALiBgAABAAEAAAAAA3d3dxFnb29nbGV0YWdzZXJ2aWNlcwNjb20AAAEAAcAMAAEAAQAAAAAABMCoAZ0="}
-00683{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":390,"source":"telegram.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1588779619914,"flow_last_seen":1588779619916,"flow_tot_l4_data_len":118,"flow_min_l4_data_len":51,"flow_max_l4_data_len":67,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":47127,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.GoogleServices","breed":"Acceptable","category":"Web"},"dns": {"query":"www.googletagservices.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"192.168.1.157"}}
+00695{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":390,"source":"telegram.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1588779619914,"flow_last_seen":1588779619916,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":47127,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.GoogleServices","breed":"Acceptable","category":"Web"},"dns": {"query":"www.googletagservices.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"192.168.1.157"}}
 00657{"flow_id":25,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":406,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779620,"pkt_ts_usec":362388,"pkt_caplen":234,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":234,"pkt_l4_len":200,"pkt":"KDc3AG3I8KNaMBgSCABFAADcfG8AAEARedDAqAE0wKgBTXr4WoYAyKTrFri0AOIdoUF8HgC1gBiBR4WYAW+Y6ixI\/CimmbnvmNPc+7RWqRDiYYB5BtoNOZ+GYknJLF6vnmq\/vZVQVX\/qPiXfvr596tV5ihbzsQEUXujBr6CW5Jx7mLZKATUjQZG4pqkScDCtoGFYwLbXUskyWRSbrC6hy+uBu0qPmfd4SD\/7qckjnc8v4qbewk41c5gifJqMys+k7q5JK0Iwk8+BFQhZBUejZZ6XcaO0DUWhA3vqRiw7b6ii7Tnk1Hel1Nqd"}
 00702{"flow_id":25,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":408,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779620,"pkt_ts_usec":426617,"pkt_caplen":266,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":266,"pkt_l4_len":232,"pkt":"KDc3AG3I8KNaMBgSCABFAAD8M2UAAEARwrrAqAE0wKgBTXr4WoYA6OlehgGD1Gs0b120gEqf\/nK6f5WdQYejVzOsfJQlZP1AA6F9i0G7vZx1n8e25\/f5Mg3Jxah8nNc1tpxpe\/hy5cvvXVKXhfzXSLG1Qs8LShdTAgKPSWKnJDG+WOm1vZmRgd1Fi6ndcEV4W69AKGJdSjWzqB2FMtgvLbL75OcZDujIR2L6+0iE7z9X0+MJRjiEmby2aw0x8v+3mcowSs8zThHH\/YXo85JS0WXttk3c7nWNkJTbpXRKOSjL6vZwlv27BEWBuawzbbdbMQbuJj7r8dESqiyUArN7hdiDWj\/hscj136s="}
 00721{"flow_id":25,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":410,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779620,"pkt_ts_usec":490069,"pkt_caplen":282,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":282,"pkt_l4_len":248,"pkt":"KDc3AG3I8KNaMBgSCABFAAEMW60AAEARmmLAqAE0wKgBTXr4WoYA+BFfLsDgPR+aI0jSmDeUwtyB2xUsT4BFGGcaH00QmXPwbTrfpMgsc5AFbeWTFhj50GiOMhjqhcxWRVD1a5b3PE53mT8NyoSlP80Z9AfMMyDTBtzFX1Zb5T18rhJNznSbJwRwMxKMQJlFd7U7yyptA46tU7ICSikqYFU6C\/HoJbvjNUIdP7NxZQQ4THckr2o2NhcBPqHLYNfMbjACd5hNPNrUai5y9Yb27TnsHBAeqmUL\/EpdipPTlGxY65\/wQFQiP9mrcF8pvutmbHhwhtyfXetd+bmrGzGSy3SZ+qTszdMo+XnEKdOPdC9JaZjlpY3MCcQh"}
@@ -243,95 +243,95 @@
 00638{"flow_id":25,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":417,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779620,"pkt_ts_usec":675886,"pkt_caplen":218,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":218,"pkt_l4_len":184,"pkt":"8KNaMBgSKDc3AG3ICABFAADMZvUAAEARj1rAqAFNwKgBNFqGevgAuJMYkbG\/KIwIwQnayLD0LMXcqEj4lfZ8P9V2iOgexzXB+FkyVtJQfJJnKJmRVHq7SYjBzTc81jea\/W4JIV63if0rV5VmSeagRTwkiWOdGd9o02IQOA+PZJoz0lbdO4rIb8YnZr2XoGAdftw\/Xvcd7TrER6tHinrYdVg4a727UMkOFw96i+NaQr+lRQwgZr4Zf8u+FORrz2a5CnGe4doPuGXE8geBfZgxu\/1NsVKk2aHZjlE="}
 00661{"flow_id":25,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":418,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779620,"pkt_ts_usec":724400,"pkt_caplen":234,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":234,"pkt_l4_len":200,"pkt":"KDc3AG3I8KNaMBgSCABFAADcPBYAAEARuinAqAE0wKgBTXr4WoYAyD7zXC3NU7wX1h\/h\/kWcJ8qpQmiUN4mhou4JHo77YBPu7\/VIjDsoEmtNSaKDnbUdu9rsQvahuCrdo6qM8+WBlFmUqWfA9spsOUDbGhwiOu\/lCsyDdexur637pbnJEdrQnE5HC5ssaS6AKLWy49YhWHXZpaKXSUEpzSC6ItBDxBR3fKHkGB5NVGyHr8\/h4eaV5mQuKkaNSXZCpy8wOZWWvDRFDXwW4QKX+b0Qm\/U5oaRB0uDYUq\/aULnstigk7puyQYRj"}
 00782{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":443,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779621,"pkt_ts_usec":450773,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJpAAEARYHfAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGAKhEc1gAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
-00524{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":501,"source":"telegram.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":97,"flow_first_seen":1588779617174,"flow_last_seen":1588779623177,"flow_tot_l4_data_len":19160,"flow_min_l4_data_len":56,"flow_max_l4_data_len":248,"flow_avg_l4_data_len":197,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.52","src_port":23174,"dst_port":31480,"l4_proto":"udp","ndpi": {"proto":"RTP","breed":"Acceptable","category":"Media"}}
-00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":597,"source":"telegram.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1588779625981,"flow_last_seen":0,"flow_tot_l4_data_len":363,"flow_min_l4_data_len":363,"flow_max_l4_data_len":363,"flow_avg_l4_data_len":363,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":501,"source":"telegram.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":97,"flow_first_seen":1588779617174,"flow_last_seen":1588779623177,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":240,"flow_tot_l4_payload_len":18384,"flow_avg_l4_payload_len":189,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.52","src_port":23174,"dst_port":31480,"l4_proto":"udp","ndpi": {"proto":"RTP","breed":"Acceptable","category":"Media"}}
+00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":597,"source":"telegram.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1588779625981,"flow_last_seen":0,"flow_min_l4_payload_len":355,"flow_max_l4_payload_len":355,"flow_tot_l4_payload_len":355,"flow_avg_l4_payload_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00890{"flow_id":28,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":597,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779625,"pkt_ts_usec":981468,"pkt_caplen":397,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":397,"pkt_l4_len":363,"pkt":"\/\/\/\/\/\/\/\/AICPmq69CABFAAF\/jrEAAEAR6r0AAAAA\/\/\/\/\/wBEAEMBa16\/AQEGAN7JmyKFuQAAAAAAAAAAAAAAAAAAAAAAAACAj5quvQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBPRP\/j5quvQABAAEfyzfOuCfrPQjbUAB0AQE5AgXcPC1kaGNwY2QtNi4xMC4xOkxpbnV4LTQuOS41Ny12Nys6YXJtdjdsOkJDTTI4MzUMDHBpMy5udG9wLm9yZ5EBATcPAXkhAwYMDxocKjM2Ojt3\/w=="}
-00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":597,"source":"telegram.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1588779625981,"flow_last_seen":0,"flow_tot_l4_data_len":363,"flow_min_l4_data_len":363,"flow_max_l4_data_len":363,"flow_avg_l4_data_len":363,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"fingerprint":""}}
-00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":612,"source":"telegram.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1588779626393,"flow_last_seen":0,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":209,"flow_max_l4_data_len":209,"flow_avg_l4_data_len":209,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.43","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":597,"source":"telegram.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1588779625981,"flow_last_seen":0,"flow_min_l4_payload_len":355,"flow_max_l4_payload_len":355,"flow_tot_l4_payload_len":355,"flow_avg_l4_payload_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"fingerprint":""}}
+00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":612,"source":"telegram.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1588779626393,"flow_last_seen":0,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":201,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.43","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00675{"flow_id":29,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":612,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779626,"pkt_ts_usec":393710,"pkt_caplen":243,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":243,"pkt_l4_len":209,"pkt":"\/\/\/\/\/\/\/\/BJImXJc1CABFAADlSCQAAIARbWnAqAErwKgB\/wCKAIoA0XdaEQLkXsCoASsAigC7AAAgRUVFRkZERUxGRUVQRkFDTkZDRUNERkZFREJEQ0VIQ0EAIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUJOAP9TTUIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQAAIQAAAAAAAAAAAOgDAAAAAAAAAAAhAFYAAwABAAAAAgAyAFxNQUlMU0xPVFxCUk9XU0UAAQCA\/AoAREVTS1RPUC1SQjVUMTJHAAoAAxAAAA8BVaoA"}
-00555{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":612,"source":"telegram.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1588779626393,"flow_last_seen":0,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":209,"flow_max_l4_data_len":209,"flow_avg_l4_data_len":209,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.43","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","ndpi": {"flow_risk": {"22":"Unsafe Protocol"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
-00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":613,"source":"telegram.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1588779626394,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00567{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":612,"source":"telegram.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1588779626393,"flow_last_seen":0,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":201,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.43","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","ndpi": {"flow_risk": {"22":"Unsafe Protocol"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
+00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":613,"source":"telegram.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1588779626394,"flow_last_seen":0,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":50,"flow_tot_l4_payload_len":50,"flow_avg_l4_payload_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00471{"flow_id":30,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":613,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779626,"pkt_ts_usec":394307,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/KDc3AG3ICABFAABOW9EAAEARmjHAqAFNwKgB\/wCJAIkAOrFARg4BEAABAAAAAAAAIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUJOAAAgAAE="}
-00508{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":613,"source":"telegram.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1588779626394,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","ndpi": {"proto":"NetBIOS","breed":"Acceptable","category":"System"}}
+00520{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":613,"source":"telegram.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1588779626394,"flow_last_seen":0,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":50,"flow_tot_l4_payload_len":50,"flow_avg_l4_payload_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","ndpi": {"proto":"NetBIOS","breed":"Acceptable","category":"System"}}
 00471{"flow_id":30,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":614,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779626,"pkt_ts_usec":394380,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/KDc3AG3ICABFAABOiakAAEARbFnAqAFNwKgB\/wCJAIkAOrE9RhEBEAABAAAAAAAAIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUJOAAAgAAE="}
 00471{"flow_id":30,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":615,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779626,"pkt_ts_usec":394481,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/KDc3AG3ICABFAABONx8AAEARvuPAqAFNwKgB\/wCJAIkAOrE5RhUBEAABAAAAAAAAIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUJOAAAgAAE="}
-00474{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":618,"source":"telegram.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1588779625981,"flow_last_seen":0,"flow_tot_l4_data_len":363,"flow_min_l4_data_len":363,"flow_max_l4_data_len":363,"flow_avg_l4_data_len":363,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":618,"source":"telegram.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1588779626393,"flow_last_seen":0,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":209,"flow_max_l4_data_len":209,"flow_avg_l4_data_len":209,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.43","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":618,"source":"telegram.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1588779625981,"flow_last_seen":0,"flow_min_l4_payload_len":355,"flow_max_l4_payload_len":355,"flow_tot_l4_payload_len":355,"flow_avg_l4_payload_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":618,"source":"telegram.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1588779626393,"flow_last_seen":0,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":201,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.43","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00782{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":618,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779626,"pkt_ts_usec":467979,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJtAAEARYHbAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGAOKuuvkAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
-00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":695,"source":"telegram.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1588779628757,"flow_last_seen":0,"flow_tot_l4_data_len":39,"flow_min_l4_data_len":39,"flow_max_l4_data_len":39,"flow_avg_l4_data_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49764,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":695,"source":"telegram.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1588779628757,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49764,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00438{"flow_id":31,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":695,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779628,"pkt_ts_usec":757409,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA7n3IAAP8RmKDAqAFNwKgBAcJkADUAJ31bFnMBAAABAAAAAAAABGRhdGkEbnRvcANvcmcAAAEAAQ=="}
-00632{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":695,"source":"telegram.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1588779628757,"flow_last_seen":0,"flow_tot_l4_data_len":39,"flow_min_l4_data_len":39,"flow_max_l4_data_len":39,"flow_avg_l4_data_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49764,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.ntop","breed":"Safe","category":"Network"},"dns": {"query":"dati.ntop.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
+00644{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":695,"source":"telegram.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1588779628757,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49764,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.ntop","breed":"Safe","category":"Network"},"dns": {"query":"dati.ntop.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
 00504{"flow_id":31,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":698,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779628,"pkt_ts_usec":804372,"pkt_caplen":121,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":121,"pkt_l4_len":87,"pkt":"KDc3AG3IEBMx8Tl2CABFAABr7g4AAEARCNXAqAEBwKgBTQA1wmQAVwAAFnOBgAABAAIAAAAABGRhdGkEbnRvcANvcmcAAAEAAcAMAAUAAQAAADwAFBFtYWlsLWRpZ2l0YWxvY2VhbsARwCsAAQABAAAAPAAEp2PXpA=="}
-00660{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":698,"source":"telegram.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1588779628757,"flow_last_seen":1588779628804,"flow_tot_l4_data_len":126,"flow_min_l4_data_len":39,"flow_max_l4_data_len":87,"flow_avg_l4_data_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49764,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.ntop","breed":"Safe","category":"Network"},"dns": {"query":"dati.ntop.org","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"167.99.215.164"}}
-00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":707,"source":"telegram.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1588779629044,"flow_last_seen":0,"flow_tot_l4_data_len":38,"flow_min_l4_data_len":38,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":5812,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00672{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":698,"source":"telegram.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1588779628757,"flow_last_seen":1588779628804,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":110,"flow_avg_l4_payload_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49764,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.ntop","breed":"Safe","category":"Network"},"dns": {"query":"dati.ntop.org","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"167.99.215.164"}}
+00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":707,"source":"telegram.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1588779629044,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":5812,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00433{"flow_id":32,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":707,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779629,"pkt_ts_usec":44577,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA6m54AAEARW3bAqAFNwKgBARa0ADUAJpvbsPwBAAABAAAAAAAABXBpeGVsAndwA2NvbQAAAQAB"}
-00631{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":707,"source":"telegram.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1588779629044,"flow_last_seen":0,"flow_tot_l4_data_len":38,"flow_min_l4_data_len":38,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":5812,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"pixel.wp.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
+00643{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":707,"source":"telegram.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1588779629044,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":5812,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"pixel.wp.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
 00457{"flow_id":32,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":708,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779629,"pkt_ts_usec":45803,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"KDc3AG3IAICPmq69CABFAABKxbFAAEAR8VLAqAEBwKgBTQA1FrQANpjhsPyBgAABAAEAAAAABXBpeGVsAndwA2NvbQAAAQABwAwAAQABAAAAAAAEwKgBnQ=="}
-00657{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":708,"source":"telegram.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1588779629044,"flow_last_seen":1588779629045,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":38,"flow_max_l4_data_len":54,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":5812,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"pixel.wp.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"192.168.1.157"}}
-00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":710,"source":"telegram.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1588779629079,"flow_last_seen":0,"flow_tot_l4_data_len":49,"flow_min_l4_data_len":49,"flow_max_l4_data_len":49,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00669{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":708,"source":"telegram.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1588779629044,"flow_last_seen":1588779629045,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":76,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":5812,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"pixel.wp.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"192.168.1.157"}}
+00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":710,"source":"telegram.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1588779629079,"flow_last_seen":0,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":41,"flow_tot_l4_payload_len":41,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00449{"flow_id":33,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":710,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779629,"pkt_ts_usec":79368,"pkt_caplen":83,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":83,"pkt_l4_len":49,"pkt":"EBMx8Tl2KDc3AG3ICABFAABFpC4AAP8Rk9rAqAFNwKgBAdVDADUAMZzqakQBAAABAAAAAAAAAWIHX2Rucy1zZARfdWRwBG50b3ADb3JnAAAMAAE="}
-00643{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":710,"source":"telegram.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1588779629079,"flow_last_seen":0,"flow_tot_l4_data_len":49,"flow_min_l4_data_len":49,"flow_max_l4_data_len":49,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.ntop","breed":"Safe","category":"Network"},"dns": {"query":"b._dns-sd._udp.ntop.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":12,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
+00655{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":710,"source":"telegram.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1588779629079,"flow_last_seen":0,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":41,"flow_tot_l4_payload_len":41,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.ntop","breed":"Safe","category":"Network"},"dns": {"query":"b._dns-sd._udp.ntop.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":12,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
 00782{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":719,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779631,"pkt_ts_usec":447782,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJxAAEARYHXAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGALnIwr0AAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
 00479{"flow_id":3,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":720,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779631,"pkt_ts_usec":710543,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"AQBeAAD7wJrQLWJ0CABFAABZzLkAAAIRSQLAqAE14AAA+xTpFOkARfrBAAoAAAACAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQlfQ0MzMkU3NTMEX3N1YsAMAAwAAQ=="}
-00572{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":720,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":6,"flow_first_seen":1588779596464,"flow_last_seen":1588779631710,"flow_tot_l4_data_len":689,"flow_min_l4_data_len":53,"flow_max_l4_data_len":204,"flow_avg_l4_data_len":114,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_googlecast._tcp.local"}}
-00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":721,"source":"telegram.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1588779632305,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00584{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":720,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":6,"flow_first_seen":1588779596464,"flow_last_seen":1588779631710,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":196,"flow_tot_l4_payload_len":641,"flow_avg_l4_payload_len":106,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_googlecast._tcp.local"}}
+00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":721,"source":"telegram.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1588779632305,"flow_last_seen":0,"flow_min_l4_payload_len":464,"flow_max_l4_payload_len":464,"flow_tot_l4_payload_len":464,"flow_avg_l4_payload_len":464,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 01030{"flow_id":34,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":721,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779632,"pkt_ts_usec":305252,"pkt_caplen":506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":506,"pkt_l4_len":472,"pkt":"\/\/\/\/\/\/\/\/KDc3AG3ICABFAAHsdQUAAEARQgfAqAFN\/\/\/\/\/0RcRFwB2FvpeyJ2ZXJzaW9uIjogWzIsIDBdLCAicG9ydCI6IDE3NTAwLCAiaG9zdF9pbnQiOiA0MDk1NjMzNTA1MDQ3NDIyMDI0ODQ4MjA1NjAzMDgyNTQwNDYyOSwgImRpc3BsYXluYW1lIjogIiIsICJuYW1lc3BhY2VzIjogWzUzMDMzMDEyNDgsIDc4NTI2NjE3NywgMTUyNjI2MzA0NSwgMjg1MjE2MDcsIDE0ODE5MzM3LCA0NTE0NzI2NTgsIDczNjM0MTUyOCwgOTM4ODEzODQ5LCAyNzUwMzcwNTYwLCAxMjY3Njk1MTA5LCA1NDQwNDA3MDcyLCA1ODM0NDk5NiwgNDA1NjQ2MjU5MiwgNzA1MzYyNzE4NCwgMTUyMjE3NzU4NywgMTQyMTExNDM5OSwgMTI1MjExNjQyOSwgNzA3OTYzNjY4OCwgMTc2OTY0MzA3LCAxMjU1NDA1NjYsIDEwNDc0MjgxODksIDQ3MTYxOTAwNDgsIDU0NjcxNjMwODgsIDExOTUwNDQwNzEsIDk2ODUzMjI0LCAxNzYwOTk2MywgNjQ3ODMwMzQ0MCwgNTExNzA2NjQyLCA2Mjk3OTU1MTg0LCAxNDE1NjIwMzUwXX0="}
-00517{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":721,"source":"telegram.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1588779632305,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}}
-00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":722,"source":"telegram.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1588779632305,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":721,"source":"telegram.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1588779632305,"flow_last_seen":0,"flow_min_l4_payload_len":464,"flow_max_l4_payload_len":464,"flow_tot_l4_payload_len":464,"flow_avg_l4_payload_len":464,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}}
+00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":722,"source":"telegram.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1588779632305,"flow_last_seen":0,"flow_min_l4_payload_len":464,"flow_max_l4_payload_len":464,"flow_tot_l4_payload_len":464,"flow_avg_l4_payload_len":464,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 01026{"flow_id":35,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":722,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779632,"pkt_ts_usec":305662,"pkt_caplen":506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":506,"pkt_l4_len":472,"pkt":"\/\/\/\/\/\/\/\/KDc3AG3ICABFAAHsvq0AAEARNbfAqAFNwKgB\/0RcRFwB2JlBeyJ2ZXJzaW9uIjogWzIsIDBdLCAicG9ydCI6IDE3NTAwLCAiaG9zdF9pbnQiOiA0MDk1NjMzNTA1MDQ3NDIyMDI0ODQ4MjA1NjAzMDgyNTQwNDYyOSwgImRpc3BsYXluYW1lIjogIiIsICJuYW1lc3BhY2VzIjogWzUzMDMzMDEyNDgsIDc4NTI2NjE3NywgMTUyNjI2MzA0NSwgMjg1MjE2MDcsIDE0ODE5MzM3LCA0NTE0NzI2NTgsIDczNjM0MTUyOCwgOTM4ODEzODQ5LCAyNzUwMzcwNTYwLCAxMjY3Njk1MTA5LCA1NDQwNDA3MDcyLCA1ODM0NDk5NiwgNDA1NjQ2MjU5MiwgNzA1MzYyNzE4NCwgMTUyMjE3NzU4NywgMTQyMTExNDM5OSwgMTI1MjExNjQyOSwgNzA3OTYzNjY4OCwgMTc2OTY0MzA3LCAxMjU1NDA1NjYsIDEwNDc0MjgxODksIDQ3MTYxOTAwNDgsIDU0NjcxNjMwODgsIDExOTUwNDQwNzEsIDk2ODUzMjI0LCAxNzYwOTk2MywgNjQ3ODMwMzQ0MCwgNTExNzA2NjQyLCA2Mjk3OTU1MTg0LCAxNDE1NjIwMzUwXX0="}
-00515{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":722,"source":"telegram.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1588779632305,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}}
+00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":722,"source":"telegram.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1588779632305,"flow_last_seen":0,"flow_min_l4_payload_len":464,"flow_max_l4_payload_len":464,"flow_tot_l4_payload_len":464,"flow_avg_l4_payload_len":464,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}}
 00461{"flow_id":14,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":723,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779632,"pkt_ts_usec":315962,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"\/\/\/\/\/\/\/\/wJrQLWJ0CABFAABES\/gAAEARqizAqAE1wKgB\/+EV4RUAMNBmU3BvdFVkcDClWtsnvt2XzwABAACyJIr8D\/N2Z9WO7tpCHKgrvJhaBg=="}
 00479{"flow_id":3,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":724,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779632,"pkt_ts_usec":717737,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"AQBeAAD7wJrQLWJ0CABFAABZVrUAAAIRvwbAqAE14AAA+xTpFOkARfrBAAoAAAACAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQlfQ0MzMkU3NTMEX3N1YsAMAAwAAQ=="}
-00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":725,"source":"telegram.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1588779634762,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":61974,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":725,"source":"telegram.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1588779634762,"flow_last_seen":0,"flow_min_l4_payload_len":1350,"flow_max_l4_payload_len":1350,"flow_tot_l4_payload_len":1350,"flow_avg_l4_payload_len":1350,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":61974,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 02202{"flow_id":36,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":725,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779634,"pkt_ts_usec":762513,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"EBMx8Tl2KDc3AG3ICABFAAViWJsAAEARtXvAqAFN2DrNRPIWAbsFTgTHw1EwNDZQozVJE19KlwkAAAABdLDg+WGAhzOZu62GoAEEAENITE8ZAAAAUEFEAPUBAABTTkkAAwIAAFNUSwA5AgAAVkVSAD0CAABDQ1MATQIAAE5PTkNtAgAAQUVBRHECAABVQUlEoAIAAFNDSUSwAgAAVENJRLQCAABQRE1EuAIAAFNNSEy8AgAASUNTTMACAABOT05Q4AIAAFBVQlMAAwAATUlEUwQDAABTQ0xTCAMAAEtFWFMMAwAAWExDVBQDAABDU0NUFAMAAENPUFQUAwAAQ0NSVCQDAABJUlRUKAMAAENGQ1csAwAAU0ZDVzADAAAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS13d3cuZ29vZ2xlLmNvbfji0b2UKZEBPixRS8R5FV4DZD4i7T\/6B0Z4nKaYTElCcNQLL0+vajT\/QP9tp6wIGReVi8x7NFEwNDYB6IFgkpIa6H7tgIaiFYKRXrLacjAwMDAwMDAwAuVjx2eeSNkn+AhDtSgQn3BeW8lDQzIwYmV0YSBDaHJvbWUvODMuMC40MTAzLjM0IEludGVsIE1hYyBPUyBYIDEwXzEzXzYriYKzggSKpsC6slaoCl0fAAAAAFg1MDkBAAAAHgAAAAuXQLYHE9JIhKrGV8rvXoOxMjFuf2JfKTHXlSKWC8+sAyENtsO94X6K9sux59v7JM7rsrjePubGsEAWqYL7e1xkAAAAAQAAAEMyNTXvR+qpngpSje9H6qmeClKNYDLLkqBBTd8GdwAAAADwAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
-00643{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":725,"source":"telegram.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1588779634762,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":61974,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Google","breed":"Tracker\/Ads","category":"Web"},"quic": {"client_requested_server_name":"www.google.com","user_agent":"beta Chrome\/83.0.4103.34 Intel Mac OS X 10_13_6"}}
-00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":726,"source":"telegram.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1588779634764,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":50822,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00655{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":725,"source":"telegram.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1588779634762,"flow_last_seen":0,"flow_min_l4_payload_len":1350,"flow_max_l4_payload_len":1350,"flow_tot_l4_payload_len":1350,"flow_avg_l4_payload_len":1350,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":61974,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Google","breed":"Tracker\/Ads","category":"Web"},"quic": {"client_requested_server_name":"www.google.com","user_agent":"beta Chrome\/83.0.4103.34 Intel Mac OS X 10_13_6"}}
+00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":726,"source":"telegram.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1588779634764,"flow_last_seen":0,"flow_min_l4_payload_len":1350,"flow_max_l4_payload_len":1350,"flow_tot_l4_payload_len":1350,"flow_avg_l4_payload_len":1350,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":50822,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 02202{"flow_id":37,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":726,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779634,"pkt_ts_usec":764481,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"EBMx8Tl2KDc3AG3ICABFAAViUS0AAEARvOnAqAFN2DrNRMaGAbsFTkE+w1EwNDZQdSQ0JxgV+\/AAAAABpTtWGWoI4a2O5woGoAEEAENITE8ZAAAAUEFEAPUBAABTTkkAAwIAAFNUSwA5AgAAVkVSAD0CAABDQ1MATQIAAE5PTkNtAgAAQUVBRHECAABVQUlEoAIAAFNDSUSwAgAAVENJRLQCAABQRE1EuAIAAFNNSEy8AgAASUNTTMACAABOT05Q4AIAAFBVQlMAAwAATUlEUwQDAABTQ0xTCAMAAEtFWFMMAwAAWExDVBQDAABDU0NUFAMAAENPUFQUAwAAQ0NSVCQDAABJUlRUKAMAAENGQ1csAwAAU0ZDVzADAAAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS13d3cuZ29vZ2xlLmNvbapsx9TSQuPwh8YeJs33Nmze8URvGPZoGeJQWhFImAF+FKGJcZ5Gv+AWggZjhNIH2DzcOgKswVEwNDYB6IFgkpIa6H7tgIaiFYKRXrLacjAwMDAwMDAwTrr3TE8EhubDtCHdJzdVC1d+PPBDQzIwYmV0YSBDaHJvbWUvODMuMC40MTAzLjM0IEludGVsIE1hYyBPUyBYIDEwXzEzXzYriYKzggSKpsC6slaoCl0fAAAAAFg1MDkBAAAAHgAAAIbXL08ZJ3aJ+3OQ3+Rsvbic8DCd31+92QlBmAfJ4ZcgyovDvfnINbPNV9UIgMSv\/oTfYVDM1unv0Eg0xlJTYVZkAAAAAQAAAEMyNTXvR+qpngpSje9H6qmeClKNYDLLkqBBTd8GdwAAAADwAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
-00643{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":726,"source":"telegram.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1588779634764,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":50822,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Google","breed":"Tracker\/Ads","category":"Web"},"quic": {"client_requested_server_name":"www.google.com","user_agent":"beta Chrome\/83.0.4103.34 Intel Mac OS X 10_13_6"}}
+00655{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":726,"source":"telegram.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1588779634764,"flow_last_seen":0,"flow_min_l4_payload_len":1350,"flow_max_l4_payload_len":1350,"flow_tot_l4_payload_len":1350,"flow_avg_l4_payload_len":1350,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":50822,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Google","breed":"Tracker\/Ads","category":"Web"},"quic": {"client_requested_server_name":"www.google.com","user_agent":"beta Chrome\/83.0.4103.34 Intel Mac OS X 10_13_6"}}
 02222{"flow_id":36,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":727,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779634,"pkt_ts_usec":794508,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"KDc3AG3IEBMx8Tl2CABFAAViAABAADcR1xbYOs1EwKgBTQG78hYFTlCg01EwNDYFozVJE19KlwkAAAABlFnOyl1IE6Kl9p2lJqJe20wr+YJJK3OQaQI+K1yyeZR9yLW3lS\/Tdnt9xcKqAlOjTi1OwA2w6a7+tRtr3KAKpiTPSke9Qgxq9RZuUGOobpscabZyRsqHgng7hPe2XFawQxldFDSjxKnYQdE5FFv9BpDrnq\/TTXf9TFvgw\/QnXVAz5Cyt9UqBUF1hH0e8eHxu6vo8lxkhnIhe5h6hLOoAm1BnioEr9hnRo4ORCSZRNuTGnhroEuVGyj5HhhPz45sTADcZH\/aRhJy7qwSQPpjxKMRjwHfkXW+yFpSOG3Hp5CsHedxutEJhnZDI+4BG1I6mpoDE8Zvk+SOrrxTdABEKpyABqDKs78QbQi9n46y46LF2JTAo36T9cjW0OkfnS1dX8RBGe5tpl\/GX8HAEOsAa\/z+6O4B5WSOIZhf34xGOy\/N3OFC+u9lN+ttVyLf++3WOzpd57ZzPwtC+yE\/BNwbA4eO5JHsp6kPUffzjzL5K4L4obRfRfmFzgUJr2AvlNCCKETOUv9FcgCj+O3Ce2J+FzvWWvPIvOKN37xrUN\/mjFcjn6vrnzc3WHSBHZUUQPgLL9gdUFNa8\/yQjJhbGLlt8bvQA1SJaoWXDVmYJjnjFSJJFF8RWpizfJP35dxquwrjEwUged8l6McoK7qHu4Ld19f6o8UJyTgkxjnhmujMkW40UK64Bo1F6vaXjIzepbsvzrfPs4buhFyCPcm2wLFZq5nMbYvmNgbBAMNYgQ7+Y4Zo47U6dIvcnsHay4b8rdIZC\/Ra4RUg2MEAVMY04nZVwsS9kMvxjw7tWpuLXdlQCjlvuGOf6dZ6k9rHdaI3URstXL6UuWo0Gdj\/NtiaGySmIHVV6i7EbmaJp3uFyYDnUvrIMjfc6ghlolVGsZni+GAZQbXnpWH5ualh+GQk\/IS2IEz0uyBJ6dsYticBr8EFAQR7hHY\/3OyEr27WwpwoLmUJn9UQqUUNET0+qTxL027bZTqGeTGLe2rH0z4qd78Ue12s\/mmitdGeaTOEIB+kN9Oz976ydi7i+SoMBr\/+hKLj5gjHsfiNqAK8opkFFxqyBh0nqOBdwUSl8gZVmShAcuOo649XW2Yut5pCeSZfn3ZoRq+lWx89wdySCjOMW8exEEWunv6bjn3slpy7AmRkw+sPRuDmUtrstSTMggBfN+zYz4kU9msu81pr+IK0y7aQh4mmTipBI3toWvtKGgxtFFCU+90ZF+2e26g7ax+JPhJWCf1aeqV2qjVTswyDUe+X8YVqx5YC7ACn0pIzEQj12x8eSFM60TkG8kXSrR+cBcSE4aaYhrAy3pypcCtMV26Co80JeaaDwDMCwmVAzo0E\/BwpqMknzmJBeyZjvON\/562D3ZU9nDxApe4H14sNeh3KyKanbNvTWcgxWJPs+wQ9X1d9egrD3CNpHov7eGsS9E5PTryqkw6dcr07anAdXKz39OKneC7uTIi2xMN4pi9HDUne9kKxezY6JaiaaEds0Egs5TrKu5MlMzp7QSr1MmDFu7VQLrafQLtQSQLw0f+CkdiOkRSoewADHR7WnRu3Pw\/1y7ALeor+7d7v\/xVkXtV0+u1JaX2B1bUYYuBQruUl0bp5QCHut4tI5G7u+9P1dYnUX\/rSklohEaFv70M62kLeKCl4bX8BdPalaH0yKRZF9q2iCLDdluLwx+pd3G8lRNNpU8gMggNTI9z\/7Pxs0oOqfN32KINp0rOMXmr0ZD6E5U7SeSuShxUVrIQgXkF5QTsc4zAeYQXZrfPFcKANcrPTz3MqQYdpM"}
 00436{"flow_id":36,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":728,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779634,"pkt_ts_usec":795180,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA4emwAAEARmNTAqAFN2DrNRPIWAbsAJN5oQKM1SRNfSpcJAg\/VJy\/hU5JXfMk208XyiTI7oA=="}
 02232{"flow_id":37,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":729,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779634,"pkt_ts_usec":797116,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"KDc3AG3IEBMx8Tl2CABFAAViAABAADgR1hbYOs1EwKgBTQG7xoYFTqbf01EwNDYFdSQ0JxgV+\/AAAAAB\/upOH6rH2BIyQSeP5oglrVNRjLzUPYUddHT9m6BsmcKmApdlysrOkxHuxx9vijlyM8wYkq7JvX19IQMhKJZA0U6a8sLp7rHlGFo5nqmm0jMnW7WPHt\/LNpmp9sMej9LIYl7HVWlYuGONw23gJgIuAlpWAO6yh+eVnrhPvfDTj31c6\/L1ooPLrq5NV7Gc7jNhPXAjTc4ZaIElGMpTUieuhBDEobdC\/yRUwhIJac7BNwvPjcF+IDwdoZlLRJw3R5oXAi2b\/NF4EAf1KMRYvNmplcTy11GLuiSvRAmihe5Rh\/orc2nsZbWj+vVmUmzCiWHVssa5KLzmBbkyMh6lJPB3gwNR9L\/Fq9yeGKy0+1JnwE4BdYx5u8HLnX2wgYVFT\/rFfn1Oc62CdMeazmAG7K4pybekkUnanBSVSlDsTtacnk6lBahTKCPl4BKZo41FpeNyrCv6CdLYcTHgeBE4YGrMXUeFT\/ilVEPrTMzFe5kzHIStA3AKnuB\/P+S0D02eLWMotPjv93++mmxST6HP114UWR5QNEIWRxUS8RL0hQeu4zY97Ng6cw4CKN+Csj\/ZvkP4kxD\/Zq7tP6yj9mYvYIO9zExfP9oeGiwS\/4f+6unIp0FdFoZmq8bqYOIOw8QtYVOoNnStryjcigG\/awK2ZaMXV+46Pnbc7phNOyTwsLBxxc\/12QJJ45cSQCeX9fI3HOGC6Lef+EyN3wVq9oB+wBoxI5umm0icT\/zZ2yvFo6UFJ2uDstyecW1AqbCfnn6WWrQLz6eMr+vL\/JleVbbatuBYa5gdk2Yt+67fkdck3Dk3mkph8oGaf+SDkR7Tf9p8ulHM4RwOnQJFlNf4xkSWeQGBLD6wjBE4rkLONEpat+rbynMjiBPAofixsPnISwVDLf0nq9DMrjUvdWlIIMyhGej2e24qnTkMu6p7FC\/huIoB0mRmYhHnBPlCQn\/LUzArFEcNys29X1cxw25iplZFvHkHdOc24AY5G54G00MdsxNdaE\/paJZz93dfFlaEUpxXdsPnTzUS4pfi+tXdLdZlCDSCbcoeLXsZ10o3zvR7bkNwPdSYObv6FtEohnNHd5N8A7GThnHg9zUXltLPSF3xHvq8673iVUYgBtPyG5IX44udpmQI7jeus04VvFTz2gu4npRTD34iJ0hoN0ntT0nFkqcX5\/lL09qWjNDuFP\/S1ls4UAok+2ha5s3PvhtAKIlco7aoWYLrSj95gTSsEvt+vv6BHLLnycSfEmJgy7LNVNyoUK4C4+9WgT1JfWOmVbGaY23xkwzP15QjiTTdKIEkJwiBmgJIruM0dA1J41jJPUcFpH8opFJyrh1InbMhpwrdsem5Er87sEkX0BhYPXkyvKucSZm6W1RMofNDgCdyw5TOBfDKdoqNmc54r82qBE2FvdTks67OsedSUGg\/xIKev6elshEbqcaKfcXRRyuerRJ9Na1ZC85buNS0\/0S8Uk1MnuNcWLIniDOgLmxDYioY8+6ffXPskGoeJ6mpsWIPFN\/ZXPivRS+0hFla3abk42RYHrYiht3fXvADKY3mvEEwWMSzU84L2ho8ij4vLNJYBjTvbpsEkPGMqANA85Spe5XJ9p4g9hQurfHWfSLDKdhStCgrn8jpcM\/\/FkUBZViwdPAW2JLOvsdSXQXeDGKI7nTEgI0kYpnr4frOKaPCHqb3HEqFHSRiARTSD0ufyxhTd6AYnG3WyBQ7hHD\/6lTnreRmZxISZ6q\/gFRJTubvR8\/BO8IvV1XaeMgD55oE\/mi7ALMHyuc8OmMt"}
 00434{"flow_id":37,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":730,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779634,"pkt_ts_usec":797531,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA4M8YAAEAR33rAqAFN2DrNRMaGAbsAJKIhQHUkNCcYFfvwAo2OXEY+ceV4qFvU3oSjW1YxGw=="}
 00461{"flow_id":14,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":731,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779635,"pkt_ts_usec":327488,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"\/\/\/\/\/\/\/\/wJrQLWJ0CABFAABE\/3cAAEAR9qzAqAE1wKgB\/+EV4RUAMNBmU3BvdFVkcDClWtsnvt2XzwABAACyJIr8D\/N2Z9WO7tpCHKgrvJhaBg=="}
 00782{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":732,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779636,"pkt_ts_usec":450767,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJ1AAEARYHTAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGAMgSJqsAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
-00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":733,"source":"telegram.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1588779632305,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":733,"source":"telegram.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1588779632305,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00474{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":733,"source":"telegram.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1588779629079,"flow_last_seen":0,"flow_tot_l4_data_len":49,"flow_min_l4_data_len":49,"flow_max_l4_data_len":49,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":733,"source":"telegram.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1588779636498,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":733,"source":"telegram.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1588779632305,"flow_last_seen":0,"flow_min_l4_payload_len":464,"flow_max_l4_payload_len":464,"flow_tot_l4_payload_len":464,"flow_avg_l4_payload_len":464,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":733,"source":"telegram.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1588779632305,"flow_last_seen":0,"flow_min_l4_payload_len":464,"flow_max_l4_payload_len":464,"flow_tot_l4_payload_len":464,"flow_avg_l4_payload_len":464,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":733,"source":"telegram.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1588779629079,"flow_last_seen":0,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":41,"flow_tot_l4_payload_len":41,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":733,"source":"telegram.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1588779636498,"flow_last_seen":0,"flow_min_l4_payload_len":44,"flow_max_l4_payload_len":44,"flow_tot_l4_payload_len":44,"flow_avg_l4_payload_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00466{"flow_id":38,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":733,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779636,"pkt_ts_usec":498756,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"\/\/\/\/\/\/\/\/KDc3AG3ICABFAABIkKQAAEARZWTAqAFNwKgB\/+EV4RUANJmxU3BvdFVkcDBukus1wI\/JPgABAARIlcIDfp+BivWMmwGHLE6mtUd\/uj\/4zNc="}
-00511{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":733,"source":"telegram.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1588779636498,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","ndpi": {"proto":"Spotify","breed":"Acceptable","category":"Music"}}
-00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":734,"source":"telegram.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.8","src_port":28150,"dst_port":529,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00523{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":733,"source":"telegram.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1588779636498,"flow_last_seen":0,"flow_min_l4_payload_len":44,"flow_max_l4_payload_len":44,"flow_tot_l4_payload_len":44,"flow_avg_l4_payload_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","ndpi": {"proto":"Spotify","breed":"Acceptable","category":"Music"}}
+00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":734,"source":"telegram.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.8","src_port":28150,"dst_port":529,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00469{"flow_id":39,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":734,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":543816,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABETKwAAEARCJTAqAFNW2wICG32AhEAMEyhL+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/8Sf7Krq21RXQ=="}
-00506{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":734,"source":"telegram.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.8","src_port":28150,"dst_port":529,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
-00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":735,"source":"telegram.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.1","src_port":28150,"dst_port":529,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00518{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":734,"source":"telegram.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.8","src_port":28150,"dst_port":529,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
+00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":735,"source":"telegram.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.1","src_port":28150,"dst_port":529,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00470{"flow_id":40,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":735,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":543822,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABEp8EAAEARpYXAqAFNW2wQAW32AhEAMJ\/zL+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/9gDcREEDsyHQ=="}
-00507{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":735,"source":"telegram.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.1","src_port":28150,"dst_port":529,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
-00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":736,"source":"telegram.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.3","src_port":28150,"dst_port":530,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00519{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":735,"source":"telegram.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.1","src_port":28150,"dst_port":529,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
+00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":736,"source":"telegram.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.3","src_port":28150,"dst_port":530,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00469{"flow_id":41,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":736,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":543824,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABE6yEAAEARZiPAqAFNW2wMA232AhIAMCHWL+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/+2+xugMe3kOw=="}
-00507{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":736,"source":"telegram.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.3","src_port":28150,"dst_port":530,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
-00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":737,"source":"telegram.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.1","src_port":28150,"dst_port":533,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00519{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":736,"source":"telegram.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.3","src_port":28150,"dst_port":530,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
+00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":737,"source":"telegram.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.1","src_port":28150,"dst_port":533,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00469{"flow_id":42,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":737,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":543824,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABEy+YAAEARiWDAqAFNW2wIAW32AhUAMEz1L+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/+LrTXW6BYYCg=="}
-00506{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":737,"source":"telegram.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.1","src_port":28150,"dst_port":533,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
-00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":738,"source":"telegram.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.5","src_port":28150,"dst_port":537,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00518{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":737,"source":"telegram.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.1","src_port":28150,"dst_port":533,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
+00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":738,"source":"telegram.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.5","src_port":28150,"dst_port":537,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00469{"flow_id":43,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":738,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":543825,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABEayUAAEAR5h3AqAFNW2wMBW32AhkAMN01L+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/+U8S0SsiW5Mg=="}
-00507{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":738,"source":"telegram.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.5","src_port":28150,"dst_port":537,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
-00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":739,"source":"telegram.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.3","src_port":28150,"dst_port":537,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00519{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":738,"source":"telegram.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.5","src_port":28150,"dst_port":537,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
+00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":739,"source":"telegram.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.3","src_port":28150,"dst_port":537,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00470{"flow_id":44,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":739,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":543827,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABEEQsAAEARPDrAqAFNW2wQA232AhkAMF6eL+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/\/Ppp3gSInx5A=="}
-00507{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":739,"source":"telegram.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.3","src_port":28150,"dst_port":537,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
-00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":740,"source":"telegram.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1588779637560,"flow_last_seen":0,"flow_tot_l4_data_len":49,"flow_min_l4_data_len":49,"flow_max_l4_data_len":49,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00519{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":739,"source":"telegram.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1588779637543,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.3","src_port":28150,"dst_port":537,"l4_proto":"udp","ndpi": {"proto":"Telegram","breed":"Acceptable","category":"Chat"}}
+00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":740,"source":"telegram.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1588779637560,"flow_last_seen":0,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":41,"flow_tot_l4_payload_len":41,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00450{"flow_id":45,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":740,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":560983,"pkt_caplen":83,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":83,"pkt_l4_len":49,"pkt":"EBMx8Tl2KDc3AG3ICABFAABF+GQAAP8RP6TAqAFNwKgBAdVDADUAMZzqakQBAAABAAAAAAAAAWIHX2Rucy1zZARfdWRwBG50b3ADb3JnAAAMAAE="}
-00643{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":740,"source":"telegram.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1588779637560,"flow_last_seen":0,"flow_tot_l4_data_len":49,"flow_min_l4_data_len":49,"flow_max_l4_data_len":49,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.ntop","breed":"Safe","category":"Network"},"dns": {"query":"b._dns-sd._udp.ntop.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":12,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
+00655{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":740,"source":"telegram.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1588779637560,"flow_last_seen":0,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":41,"flow_tot_l4_payload_len":41,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.ntop","breed":"Safe","category":"Network"},"dns": {"query":"b._dns-sd._udp.ntop.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":12,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
 00527{"flow_id":45,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":741,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":572601,"pkt_caplen":136,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":136,"pkt_l4_len":102,"pkt":"KDc3AG3IEBMx8Tl2CABFAAB67hUAAEARCL\/AqAEBwKgBTQA11UMAZgAAakSBgwABAAAAAQAAAWIHX2Rucy1zZARfdWRwBG50b3ADb3JnAAAMAAHAGwAGAAEAAAA0ACkFZG5zZG\/AGwpwb3N0bWFzdGVywBt4ZvNkAACowAAAHCAAJOoAAAACWA=="}
-00665{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":741,"source":"telegram.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1588779637560,"flow_last_seen":1588779637572,"flow_tot_l4_data_len":151,"flow_min_l4_data_len":49,"flow_max_l4_data_len":102,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.ntop","breed":"Safe","category":"Network"},"dns": {"query":"b._dns-sd._udp.ntop.org","num_queries":1,"num_answers":1,"reply_code":3,"query_type":12,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
+00676{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":741,"source":"telegram.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1588779637560,"flow_last_seen":1588779637572,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":94,"flow_tot_l4_payload_len":135,"flow_avg_l4_payload_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.ntop","breed":"Safe","category":"Network"},"dns": {"query":"b._dns-sd._udp.ntop.org","num_queries":1,"num_answers":1,"reply_code":3,"query_type":12,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
 00501{"flow_id":42,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":742,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":577920,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"KDc3AG3IEBMx8Tl2CABFAABcg6JAADMRnoxbbAgBwKgBTQIVbfYASNOVL+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/8dyFcB12rJei6011ugWGAoAAAAAAAAAAAAA\/\/9XC83DTfQAAA=="}
 00501{"flow_id":39,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":743,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":582520,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"KDc3AG3IEBMx8Tl2CABFAABc3cdAADMRRGBbbAgIwKgBTQIRbfYASNNBL+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/8dyFcB12rJeEn+yq6ttUV0AAAAAAAAAAAAA\/\/9XC83DTfQAAA=="}
 00501{"flow_id":41,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":744,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":681763,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"KDc3AG3IEBMx8Tl2CABFAABcuRdAADQRZBVbbAwDwKgBTQISbfYASKh2L+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/8dyFcB12rJetvsboDHt5DsAAAAAAAAAAAAA\/\/9XC83DTfQAAA=="}
 00501{"flow_id":43,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":745,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":682180,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"KDc3AG3IEBMx8Tl2CABFAABcJ6tAADQR9X9bbAwFwKgBTQIZbfYASGPWL+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/8dyFcB12rJelPEtErIluTIAAAAAAAAAAAAA\/\/9XC83DTfQAAA=="}
 00501{"flow_id":44,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":746,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":712776,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"KDc3AG3IEBMx8Tl2CABFAABcTfZAADYRyTZbbBADwKgBTQIZbfYASOU+L+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/8dyFcB12rJez6ad4EiJ8eQAAAAAAAAAAAAA\/\/9XC83DTfQAAA=="}
 00501{"flow_id":40,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":747,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":715269,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"KDc3AG3IEBMx8Tl2CABFAABcdalAADYRoYVbbBABwKgBTQIRbfYASCaUL+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/8dyFcB12rJeYA3ERBA7Mh0AAAAAAAAAAAAA\/\/9XC83DTfQAAA=="}
-00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":748,"source":"telegram.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_first_seen":1588779637830,"flow_last_seen":0,"flow_tot_l4_data_len":182,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"239.255.255.250","src_port":52127,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00495{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":748,"source":"telegram.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_first_seen":1588779637830,"flow_last_seen":0,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"239.255.255.250","src_port":52127,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00634{"flow_id":46,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":748,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779637,"pkt_ts_usec":830278,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"pkt":"AQBef\/\/6KDc3AG3ICABFAADKg14AAAERg9XAqAFN7\/\/\/+sufB2wAtsJkTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogR29vZ2xlIENocm9tZS84My4wLjQxMDMuMzQgTWFjIE9TIFgNCg0K"}
-00514{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":748,"source":"telegram.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_first_seen":1588779637830,"flow_last_seen":0,"flow_tot_l4_data_len":182,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"239.255.255.250","src_port":52127,"dst_port":1900,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":748,"source":"telegram.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_first_seen":1588779637830,"flow_last_seen":0,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"239.255.255.250","src_port":52127,"dst_port":1900,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00468{"flow_id":39,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":749,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779638,"pkt_ts_usec":48488,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABEsZEAAEARo67AqAFNW2wICG32AhEAMJEzL+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/9ywagRVgIMjg=="}
 00471{"flow_id":40,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":750,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779638,"pkt_ts_usec":48579,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABEUI8AAEAR\/LfAqAFNW2wQAW32AhEAMO1PL+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/\/cV+9m8\/VZmQ=="}
 00469{"flow_id":41,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":751,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779638,"pkt_ts_usec":48692,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"EBMx8Tl2KDc3AG3ICABFAABEfdIAAEAR03LAqAFNW2wMA232AhIAMLZjL+Sfp2xOtDPLzYKhu+piHv\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/7\/\/\/\/DysMOlAk5VA=="}
@@ -408,7 +408,7 @@
 00529{"flow_id":41,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":849,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779639,"pkt_ts_usec":102810,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"EBMx8Tl2KDc3AG3ICABFAAB8l\/0AAEARuQ\/AqAFNW2wMA232AhIAaBYjL+Sfp2xOtDPLzYKhu+piHsUUdzWSq1JnQgHuwL5ZzFMZZUBkOgRAnQ06mV54nHJajHrw7JhJwP3pu854HgpQ8PBvE4mqy42\/yBfG6DvXpdhYfDWpcRMy5Iccl3fM9+eE"}
 00528{"flow_id":43,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":851,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779639,"pkt_ts_usec":102917,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"EBMx8Tl2KDc3AG3ICABFAAB8soYAAEARnoTAqAFNW2wMBW32AhkAaK6EL+Sfp2xOtDPLzYKhu+piHpNqf0EGr3ouAM5o5Ho9IqKddcI\/Z\/b49j1yM7XDT90BJismgiRZXHF2EATHEoy8Lfiy7GCHIU14gsQujHjWVVo1d9xKDk2YVJGvI62nEIlc"}
 00526{"flow_id":44,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":852,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779639,"pkt_ts_usec":102958,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"EBMx8Tl2KDc3AG3ICABFAAB87a4AAEARX17AqAFNW2wQA232AhkAaI81L+Sfp2xOtDPLzYKhu+piHgzmMNcDOZ2PoiHjW2yYnS6ePj1BGRdJoM8nFXnzaBh75yJzDzYLzBbUH1ZxWuxSCc8tLVzq402LbPVjqpmjcVElk5pqYd5uYnj2wmDnoeHG"}
-00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":853,"source":"telegram.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_first_seen":1588779639103,"flow_last_seen":0,"flow_tot_l4_data_len":88,"flow_min_l4_data_len":88,"flow_max_l4_data_len":88,"flow_avg_l4_data_len":88,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":28150,"dst_port":59772,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":853,"source":"telegram.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_first_seen":1588779639103,"flow_last_seen":0,"flow_min_l4_payload_len":80,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":80,"flow_avg_l4_payload_len":80,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":28150,"dst_port":59772,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00505{"flow_id":47,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":853,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779639,"pkt_ts_usec":103009,"pkt_caplen":122,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":122,"pkt_l4_len":88,"pkt":"EBMx8Tl2KDc3AG3ICABFAABsKQMAAEARarrAqAFNVwvNw2326XwAWFNj2ajstQcU9VmrWsN2RmlsiodFzsmW0mXr5Gv8o0f2aR9YWQKIE34PAz\/0T4VwEA0DXBRrws2ycCoPovMV6p5YsfJULcJS2cwqBKkU3Xys+SQ="}
 00528{"flow_id":43,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":855,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779639,"pkt_ts_usec":152556,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"KDc3AG3IEBMx8Tl2CABFAAB8KINAADQR9IdbbAwFwKgBTQIZbfYAaHLEL+Sfp2xOtDPLzYKhu+piHuRszQ41FbqXYbZZXAVFrGnz5aD6BIy2wA8WvWucaYHtk\/B8UWoe98wisy7vNTjdhvmyB6Y3Dlp4+tSorsm+9d+JCobletUdU3L\/e04ZzdCo"}
 00528{"flow_id":41,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":857,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779639,"pkt_ts_usec":166296,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"KDc3AG3IEBMx8Tl2CABFAAB8ugZAADQRYwZbbAwDwKgBTQISbfYAaKtUL+Sfp2xOtDPLzYKhu+piHrTHFdAFs\/SBIX5Iprv7doYCM0HACNVv0QlFf11rJbUDaIETC76BFd1FamkhtAFe0ooVzY\/LfUHdb+DFFh5kJjNqEmRDzDoNYGDvpKOPyWnW"}
@@ -422,31 +422,31 @@
 00533{"flow_id":3,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1043,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779643,"pkt_ts_usec":386239,"pkt_caplen":142,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":142,"pkt_l4_len":108,"pkt":"AQBeAAD7wJrQLWJ0CABFAACAWI0AAP8RwAbAqAE14AAA+xTpFOkAbI7lAAAAAAABAAEAAAABDF9zbGVlcC1wcm94eQRfdWRwBWxvY2FsAAAMAAHADAAMAAEAABFtABIPNTAtMzUtMTAtNzAuMSAxwAwAACkFoAAAEZQAEgAEAA4AMeKa0C1idMCa0C1idA=="}
 00562{"flow_id":11,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1044,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779643,"pkt_ts_usec":386383,"pkt_caplen":162,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":162,"pkt_l4_len":108,"pkt":"MzMAAAD7wJrQLWJ0ht1gBqDxAGwR\/\/6AAAAAAAAAGKCkEok1wBv\/AgAAAAAAAAAAAAAAAAD7FOkU6QBsLTwAAAAAAAEAAQAAAAEMX3NsZWVwLXByb3h5BF91ZHAFbG9jYWwAAAwAAcAMAAwAAQAAEW0AEg81MC0zNS0xMC03MC4xIDHADAAAKQWgAAARlAASAAQADgAx4prQLWJ0wJrQLWJ0"}
 00454{"flow_id":3,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1128,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779645,"pkt_ts_usec":374887,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"pkt":"AQBeAAD7wJrQLWJ0CABFAABJNSEAAAER4arAqAE14AAA+xTpFOkANQuaAAAAAAABAAAAAAAAEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAAADAAB"}
-00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1129,"source":"telegram.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1588779645375,"flow_last_seen":0,"flow_tot_l4_data_len":319,"flow_min_l4_data_len":319,"flow_max_l4_data_len":319,"flow_avg_l4_data_len":319,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1129,"source":"telegram.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1588779645375,"flow_last_seen":0,"flow_min_l4_payload_len":311,"flow_max_l4_payload_len":311,"flow_tot_l4_payload_len":311,"flow_avg_l4_payload_len":311,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00814{"flow_id":48,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1129,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779645,"pkt_ts_usec":375046,"pkt_caplen":353,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":353,"pkt_l4_len":319,"pkt":"AQBeAAD7eCjKBfrMCABFAAFTiPpAAAERTLfAqAFF4AAA+xTpFOkBP9DmAACEAAAAAAEAAAADEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAAADAABAAAAeAAvEXNvbm9zNzgyOENBMDVGQUNDEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAARc29ub3M3ODI4Q0EwNUZBQ0MQX3Nwb3RpZnktY29ubmVjdARfdGNwBWxvY2FsAAAQgAEAABGUAB0LVkVSU0lPTj0xLjAQQ1BhdGg9L3Nwb3RpZnl6YxFzb25vczc4MjhDQTA1RkFDQxBfc3BvdGlmeS1jb25uZWN0BF90Y3AFbG9jYWwAACGAAQAAAHgAHwAAAAAFeBFzb25vczc4MjhDQTA1RkFDQwVsb2NhbAARc29ub3M3ODI4Q0EwNUZBQ0MFbG9jYWwAAAGAAQAAAHgABMCoAUU="}
-00560{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1129,"source":"telegram.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1588779645375,"flow_last_seen":0,"flow_tot_l4_data_len":319,"flow_min_l4_data_len":319,"flow_max_l4_data_len":319,"flow_avg_l4_data_len":319,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_spotify-connect._tcp.local"}}
+00572{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1129,"source":"telegram.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1588779645375,"flow_last_seen":0,"flow_min_l4_payload_len":311,"flow_max_l4_payload_len":311,"flow_tot_l4_payload_len":311,"flow_avg_l4_payload_len":311,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_spotify-connect._tcp.local"}}
 00461{"flow_id":14,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1130,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779645,"pkt_ts_usec":381398,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"\/\/\/\/\/\/\/\/wJrQLWJ0CABFAABEsxIAAEARQxLAqAE1wKgB\/+EV4RUAMB\/7U3BvdFVkcDCyd4qJW50BwwABAABMUeIxMdBB4jsY0JrM5ZhQFz1Lqg=="}
-00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1131,"source":"telegram.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1588779645381,"flow_last_seen":0,"flow_tot_l4_data_len":134,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":50698,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1131,"source":"telegram.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1588779645381,"flow_last_seen":0,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":126,"flow_tot_l4_payload_len":126,"flow_avg_l4_payload_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":50698,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00571{"flow_id":49,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1131,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779645,"pkt_ts_usec":381544,"pkt_caplen":168,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":168,"pkt_l4_len":134,"pkt":"AQBef\/\/6wJrQLWJ0CABFAACa3qgAAAERKNPAqAE17\/\/\/+sYKB2wAhlIKTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KDQoA"}
-00515{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1131,"source":"telegram.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1588779645381,"flow_last_seen":0,"flow_tot_l4_data_len":134,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":50698,"dst_port":1900,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1131,"source":"telegram.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1588779645381,"flow_last_seen":0,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":126,"flow_tot_l4_payload_len":126,"flow_avg_l4_payload_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":50698,"dst_port":1900,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00481{"flow_id":3,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1147,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779645,"pkt_ts_usec":854328,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"AQBeAAD7wJrQLWJ0CABFAABZEhgAAAIRA6TAqAE14AAA+xTpFOkARfrKAAEAAAACAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQlfQ0MzMkU3NTMEX3N1YsAMAAwAAQ=="}
 00770{"flow_id":7,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1174,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779646,"pkt_ts_usec":451654,"pkt_caplen":320,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":320,"pkt_l4_len":286,"pkt":"jP5XIzfkKDc3AG3ICABFAAEyaYkAAP8RzUjAqAFNwKgBSxTpFOkBHhkOAACEAAAAAAEAAAAED19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMAAEAABGUABANTHVjYeKAmXMgaU1hY8AMwDIAIYABAAAAeAATAAAAAMAFCkx1Y2FzLWlNYWPAIcAyABCAAQAAEZQAWBZycEJBPTM5OjJBOjg4OkFDOjQxOkFCCnJwVnI9MTUyLjERcnBIST1mOWM0NmM2ZGQwN2QRcnBITj0zYzVkYzVjZTk1NzgRcnBIQT04Y2E4Y2I3MzFjMWMNTHVjYeKAmXMgaU1hYwxfZGV2aWNlLWluZm\/AHAAQAAEAABGUABoObW9kZWw9aU1hYzExLDMKb3N4dmVycz0xN8BUAAGAAQAAAHgABMCoAU0="}
-00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1177,"source":"telegram.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1588779645375,"flow_last_seen":0,"flow_tot_l4_data_len":319,"flow_min_l4_data_len":319,"flow_max_l4_data_len":319,"flow_avg_l4_data_len":319,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1177,"source":"telegram.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1588779636498,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1177,"source":"telegram.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1588779645381,"flow_last_seen":0,"flow_tot_l4_data_len":134,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":50698,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1177,"source":"telegram.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1588779645375,"flow_last_seen":0,"flow_min_l4_payload_len":311,"flow_max_l4_payload_len":311,"flow_tot_l4_payload_len":311,"flow_avg_l4_payload_len":311,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1177,"source":"telegram.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1588779636498,"flow_last_seen":0,"flow_min_l4_payload_len":44,"flow_max_l4_payload_len":44,"flow_tot_l4_payload_len":44,"flow_avg_l4_payload_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1177,"source":"telegram.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1588779645381,"flow_last_seen":0,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":126,"flow_tot_l4_payload_len":126,"flow_avg_l4_payload_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":50698,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00784{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1179,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779646,"pkt_ts_usec":560083,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJ9AAEARYHLAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGAHA28acAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
 00482{"flow_id":3,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1196,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779646,"pkt_ts_usec":913796,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"AQBeAAD7wJrQLWJ0CABFAABZib4AAAIRi\/3AqAE14AAA+xTpFOkARfrKAAEAAAACAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQlfQ0MzMkU3NTMEX3N1YsAMAAwAAQ=="}
 00461{"flow_id":14,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1213,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779647,"pkt_ts_usec":270006,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"\/\/\/\/\/\/\/\/wJrQLWJ0CABFAABExqMAAEARL4HAqAE1wKgB\/+EV4RUAMB\/7U3BvdFVkcDCyd4qJW50BwwABAABMUeIxMdBB4jsY0JrM5ZhQFz1Lqg=="}
-00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1218,"source":"telegram.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1588779647380,"flow_last_seen":0,"flow_tot_l4_data_len":134,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":50698,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1218,"source":"telegram.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1588779647380,"flow_last_seen":0,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":126,"flow_tot_l4_payload_len":126,"flow_avg_l4_payload_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":50698,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00571{"flow_id":50,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1218,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779647,"pkt_ts_usec":380255,"pkt_caplen":168,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":168,"pkt_l4_len":134,"pkt":"AQBef\/\/6wJrQLWJ0CABFAACaUgcAAAERtXTAqAE17\/\/\/+sYKB2wAhlIKTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KDQoA"}
-00515{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1218,"source":"telegram.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1588779647380,"flow_last_seen":0,"flow_tot_l4_data_len":134,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":50698,"dst_port":1900,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1218,"source":"telegram.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1588779647380,"flow_last_seen":0,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":126,"flow_tot_l4_payload_len":126,"flow_avg_l4_payload_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":50698,"dst_port":1900,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00456{"flow_id":3,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1219,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779647,"pkt_ts_usec":380279,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"pkt":"AQBeAAD7wJrQLWJ0CABFAABJgtEAAAERk\/rAqAE14AAA+xTpFOkANQuaAAAAAAABAAAAAAAAEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAAADAAB"}
-00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1220,"source":"telegram.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1588779647380,"flow_last_seen":0,"flow_tot_l4_data_len":319,"flow_min_l4_data_len":319,"flow_max_l4_data_len":319,"flow_avg_l4_data_len":319,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1220,"source":"telegram.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1588779647380,"flow_last_seen":0,"flow_min_l4_payload_len":311,"flow_max_l4_payload_len":311,"flow_tot_l4_payload_len":311,"flow_avg_l4_payload_len":311,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00814{"flow_id":51,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1220,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779647,"pkt_ts_usec":380573,"pkt_caplen":353,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":353,"pkt_l4_len":319,"pkt":"AQBeAAD7eCjKBfrMCABFAAFTigFAAAERS7DAqAFF4AAA+xTpFOkBP9DmAACEAAAAAAEAAAADEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAAADAABAAAAeAAvEXNvbm9zNzgyOENBMDVGQUNDEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAARc29ub3M3ODI4Q0EwNUZBQ0MQX3Nwb3RpZnktY29ubmVjdARfdGNwBWxvY2FsAAAQgAEAABGUAB0LVkVSU0lPTj0xLjAQQ1BhdGg9L3Nwb3RpZnl6YxFzb25vczc4MjhDQTA1RkFDQxBfc3BvdGlmeS1jb25uZWN0BF90Y3AFbG9jYWwAACGAAQAAAHgAHwAAAAAFeBFzb25vczc4MjhDQTA1RkFDQwVsb2NhbAARc29ub3M3ODI4Q0EwNUZBQ0MFbG9jYWwAAAGAAQAAAHgABMCoAUU="}
-00560{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1220,"source":"telegram.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1588779647380,"flow_last_seen":0,"flow_tot_l4_data_len":319,"flow_min_l4_data_len":319,"flow_max_l4_data_len":319,"flow_avg_l4_data_len":319,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_spotify-connect._tcp.local"}}
-00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1281,"source":"telegram.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1588779648840,"flow_last_seen":0,"flow_tot_l4_data_len":134,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":56384,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00572{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1220,"source":"telegram.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1588779647380,"flow_last_seen":0,"flow_min_l4_payload_len":311,"flow_max_l4_payload_len":311,"flow_tot_l4_payload_len":311,"flow_avg_l4_payload_len":311,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_spotify-connect._tcp.local"}}
+00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1281,"source":"telegram.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1588779648840,"flow_last_seen":0,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":126,"flow_tot_l4_payload_len":126,"flow_avg_l4_payload_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":56384,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00572{"flow_id":52,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1281,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779648,"pkt_ts_usec":840484,"pkt_caplen":168,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":168,"pkt_l4_len":134,"pkt":"AQBef\/\/6wJrQLWJ0CABFAACaCVUAAAER\/ibAqAE17\/\/\/+txAB2wAhjvUTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KDQoA"}
-00515{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1281,"source":"telegram.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1588779648840,"flow_last_seen":0,"flow_tot_l4_data_len":134,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":56384,"dst_port":1900,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}}
+00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1281,"source":"telegram.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1588779648840,"flow_last_seen":0,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":126,"flow_tot_l4_payload_len":126,"flow_avg_l4_payload_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":56384,"dst_port":1900,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}}
 00455{"flow_id":3,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1282,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779648,"pkt_ts_usec":840510,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"pkt":"AQBeAAD7wJrQLWJ0CABFAABJAsIAAAERFArAqAE14AAA+xTpFOkANQuaAAAAAAABAAAAAAAAEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAAADAAB"}
 00814{"flow_id":51,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1283,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779648,"pkt_ts_usec":840835,"pkt_caplen":353,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":353,"pkt_l4_len":319,"pkt":"AQBeAAD7eCjKBfrMCABFAAFTiqZAAAERSwvAqAFF4AAA+xTpFOkBP9DmAACEAAAAAAEAAAADEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAAADAABAAAAeAAvEXNvbm9zNzgyOENBMDVGQUNDEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAARc29ub3M3ODI4Q0EwNUZBQ0MQX3Nwb3RpZnktY29ubmVjdARfdGNwBWxvY2FsAAAQgAEAABGUAB0LVkVSU0lPTj0xLjAQQ1BhdGg9L3Nwb3RpZnl6YxFzb25vczc4MjhDQTA1RkFDQxBfc3BvdGlmeS1jb25uZWN0BF90Y3AFbG9jYWwAACGAAQAAAHgAHwAAAAAFeBFzb25vczc4MjhDQTA1RkFDQwVsb2NhbAARc29ub3M3ODI4Q0EwNUZBQ0MFbG9jYWwAAAGAAQAAAHgABMCoAUU="}
 00460{"flow_id":14,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1290,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779649,"pkt_ts_usec":19702,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"\/\/\/\/\/\/\/\/wJrQLWJ0CABFAABElPEAAEARYTPAqAE1wKgB\/+EV4RUAMJohU3BvdFVkcDD0Jfgh9tR1aAABAAC\/vOrzE8GBHXmaYexmJHVX5sZgYw=="}
@@ -454,16 +454,16 @@
 00770{"flow_id":7,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1330,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779649,"pkt_ts_usec":979794,"pkt_caplen":320,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":320,"pkt_l4_len":286,"pkt":"jP5XIzfkKDc3AG3ICABFAAEycgkAAP8RxMjAqAFNwKgBSxTpFOkBHhkOAACEAAAAAAEAAAAED19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMAAEAABGUABANTHVjYeKAmXMgaU1hY8AMwDIAIYABAAAAeAATAAAAAMAFCkx1Y2FzLWlNYWPAIcAyABCAAQAAEZQAWBZycEJBPTM5OjJBOjg4OkFDOjQxOkFCCnJwVnI9MTUyLjERcnBIST1mOWM0NmM2ZGQwN2QRcnBITj0zYzVkYzVjZTk1NzgRcnBIQT04Y2E4Y2I3MzFjMWMNTHVjYeKAmXMgaU1hYwxfZGV2aWNlLWluZm\/AHAAQAAEAABGUABoObW9kZWw9aU1hYzExLDMKb3N4dmVycz0xN8BUAAGAAQAAAHgABMCoAU0="}
 00459{"flow_id":47,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1341,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779650,"pkt_ts_usec":102979,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"EBMx8Tl2KDc3AG3ICABFAABM8zMAAEARoKnAqAFNVwvNw2326XwAOBQNt7NLZEiPyb9nJ25aFShQjjbK9tSAqF2RZJuCl4MIgiF4TeaDrkRovC99CpyADzRp"}
 00481{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1352,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779650,"pkt_ts_usec":283367,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"AQBeAAD7wJrQLWJ0CABFAABZgjsAAAIRk4DAqAE14AAA+xTpFOkARfrKAAEAAAACAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQlfQ0MzMkU3NTMEX3N1YsAMAAwAAQ=="}
-00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1373,"source":"telegram.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1588779650651,"flow_last_seen":0,"flow_tot_l4_data_len":47,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":58615,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1373,"source":"telegram.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1588779650651,"flow_last_seen":0,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":58615,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00447{"flow_id":53,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1373,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779650,"pkt_ts_usec":651135,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"EBMx8Tl2KDc3AG3ICABFAABD6GYAAP8RT6TAqAFNwKgBAeT3ADUAL99XO7EBAAABAAAAAAAACXRlbGVtZXRyeQdkcm9wYm94A2NvbQAAAQAB"}
-00648{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1373,"source":"telegram.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1588779650651,"flow_last_seen":0,"flow_tot_l4_data_len":47,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":58615,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Dropbox","breed":"Acceptable","category":"Cloud"},"dns": {"query":"telemetry.dropbox.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
-00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1374,"source":"telegram.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1588779650652,"flow_last_seen":0,"flow_tot_l4_data_len":51,"flow_min_l4_data_len":51,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49533,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00660{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1373,"source":"telegram.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1588779650651,"flow_last_seen":0,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":58615,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Dropbox","breed":"Acceptable","category":"Cloud"},"dns": {"query":"telemetry.dropbox.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
+00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1374,"source":"telegram.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1588779650652,"flow_last_seen":0,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49533,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00455{"flow_id":54,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1374,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779650,"pkt_ts_usec":652266,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"pkt":"EBMx8Tl2KDc3AG3ICABFAABHeaUAAP8RvmHAqAFNwKgBAcF9ADUAM+X9HKUBAAABAAAAAAAABWU0NTE4BGRzY3gKYWthbWFpZWRnZQNuZXQAAAEAAQ=="}
-00646{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1374,"source":"telegram.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1588779650652,"flow_last_seen":0,"flow_tot_l4_data_len":51,"flow_min_l4_data_len":51,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49533,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"e4518.dscx.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
+00658{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1374,"source":"telegram.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1588779650652,"flow_last_seen":0,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49533,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"e4518.dscx.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
 00477{"flow_id":54,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1376,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779650,"pkt_ts_usec":666077,"pkt_caplen":101,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":101,"pkt_l4_len":67,"pkt":"KDc3AG3IEBMx8Tl2CABFAABXLE1AADkRkarAqAEBwKgBTQA1wX0AQwAAHKWBgAABAAEAAAAABWU0NTE4BGRzY3gKYWthbWFpZWRnZQNuZXQAAAEAAcAMAAEAAQAAAAcABFx69t8="}
-00674{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1376,"source":"telegram.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":2,"flow_first_seen":1588779650652,"flow_last_seen":1588779650666,"flow_tot_l4_data_len":118,"flow_min_l4_data_len":51,"flow_max_l4_data_len":67,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49533,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"e4518.dscx.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"92.122.246.223"}}
+00686{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1376,"source":"telegram.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":2,"flow_first_seen":1588779650652,"flow_last_seen":1588779650666,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49533,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"e4518.dscx.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"92.122.246.223"}}
 00505{"flow_id":53,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1378,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779650,"pkt_ts_usec":681877,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"pkt":"KDc3AG3IEBMx8Tl2CABFAABtxO5AADkR+PLAqAEBwKgBTQA15PcAWQAAO7GBgAABAAIAAAAACXRlbGVtZXRyeQdkcm9wYm94A2NvbQAAAQABwAwABQABAAAAcAAOCXRlbGVtZXRyeQF2wBbAMwABAAEAAAA8AASifRMJ"}
-00674{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1378,"source":"telegram.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":2,"flow_first_seen":1588779650651,"flow_last_seen":1588779650681,"flow_tot_l4_data_len":136,"flow_min_l4_data_len":47,"flow_max_l4_data_len":89,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":58615,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Dropbox","breed":"Acceptable","category":"Cloud"},"dns": {"query":"telemetry.dropbox.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"162.125.19.9"}}
+00686{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1378,"source":"telegram.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":2,"flow_first_seen":1588779650651,"flow_last_seen":1588779650681,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":58615,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Dropbox","breed":"Acceptable","category":"Cloud"},"dns": {"query":"telemetry.dropbox.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"162.125.19.9"}}
 00571{"flow_id":52,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1389,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779650,"pkt_ts_usec":842623,"pkt_caplen":168,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":168,"pkt_l4_len":134,"pkt":"AQBef\/\/6wJrQLWJ0CABFAACaJ+EAAAER35rAqAE17\/\/\/+txAB2wAhjvUTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KDQoA"}
 00815{"flow_id":51,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1390,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779650,"pkt_ts_usec":842643,"pkt_caplen":353,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":353,"pkt_l4_len":319,"pkt":"AQBeAAD7eCjKBfrMCABFAAFTivJAAAERSr\/AqAFF4AAA+xTpFOkBP9DmAACEAAAAAAEAAAADEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAAADAABAAAAeAAvEXNvbm9zNzgyOENBMDVGQUNDEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAARc29ub3M3ODI4Q0EwNUZBQ0MQX3Nwb3RpZnktY29ubmVjdARfdGNwBWxvY2FsAAAQgAEAABGUAB0LVkVSU0lPTj0xLjAQQ1BhdGg9L3Nwb3RpZnl6YxFzb25vczc4MjhDQTA1RkFDQxBfc3BvdGlmeS1jb25uZWN0BF90Y3AFbG9jYWwAACGAAQAAAHgAHwAAAAAFeBFzb25vczc4MjhDQTA1RkFDQwVsb2NhbAARc29ub3M3ODI4Q0EwNUZBQ0MFbG9jYWwAAAGAAQAAAHgABMCoAUU="}
 00784{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1418,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779651,"pkt_ts_usec":446598,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGKBAAEARYHHAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGAJsQpYUAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
@@ -472,45 +472,45 @@
 00771{"flow_id":7,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1512,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779653,"pkt_ts_usec":520455,"pkt_caplen":320,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":320,"pkt_l4_len":286,"pkt":"jP5XIzfkKDc3AG3ICABFAAEy5oIAAP8RUE\/AqAFNwKgBSxTpFOkBHhkOAACEAAAAAAEAAAAED19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMAAEAABGUABANTHVjYeKAmXMgaU1hY8AMwDIAIYABAAAAeAATAAAAAMAFCkx1Y2FzLWlNYWPAIcAyABCAAQAAEZQAWBZycEJBPTM5OjJBOjg4OkFDOjQxOkFCCnJwVnI9MTUyLjERcnBIST1mOWM0NmM2ZGQwN2QRcnBITj0zYzVkYzVjZTk1NzgRcnBIQT04Y2E4Y2I3MzFjMWMNTHVjYeKAmXMgaU1hYwxfZGV2aWNlLWluZm\/AHAAQAAEAABGUABoObW9kZWw9aU1hYzExLDMKb3N4dmVycz0xN8BUAAGAAQAAAHgABMCoAU0="}
 00571{"flow_id":52,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1563,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779654,"pkt_ts_usec":853807,"pkt_caplen":168,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":168,"pkt_l4_len":134,"pkt":"AQBef\/\/6wJrQLWJ0CABFAACa7R8AAAERGlzAqAE17\/\/\/+txAB2wAhjvUTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KDQoA"}
 00814{"flow_id":51,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1564,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779654,"pkt_ts_usec":853821,"pkt_caplen":353,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":353,"pkt_l4_len":319,"pkt":"AQBeAAD7eCjKBfrMCABFAAFTjhBAAAERR6HAqAFF4AAA+xTpFOkBP9DmAACEAAAAAAEAAAADEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAAADAABAAAAeAAvEXNvbm9zNzgyOENBMDVGQUNDEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAARc29ub3M3ODI4Q0EwNUZBQ0MQX3Nwb3RpZnktY29ubmVjdARfdGNwBWxvY2FsAAAQgAEAABGUAB0LVkVSU0lPTj0xLjAQQ1BhdGg9L3Nwb3RpZnl6YxFzb25vczc4MjhDQTA1RkFDQxBfc3BvdGlmeS1jb25uZWN0BF90Y3AFbG9jYWwAACGAAQAAAHgAHwAAAAAFeBFzb25vczc4MjhDQTA1RkFDQwVsb2NhbAARc29ub3M3ODI4Q0EwNUZBQ0MFbG9jYWwAAAGAAQAAAHgABMCoAUU="}
-00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1588779629044,"flow_last_seen":1588779629045,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":38,"flow_max_l4_data_len":54,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":5812,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1588779615019,"flow_last_seen":1588779615032,"flow_tot_l4_data_len":118,"flow_min_l4_data_len":51,"flow_max_l4_data_len":67,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61120,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":12,"flow_first_seen":1588779596451,"flow_last_seen":1588779651446,"flow_tot_l4_data_len":3444,"flow_min_l4_data_len":287,"flow_max_l4_data_len":287,"flow_avg_l4_data_len":287,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":123,"flow_first_seen":1588779616036,"flow_last_seen":1588779620617,"flow_tot_l4_data_len":22264,"flow_min_l4_data_len":40,"flow_max_l4_data_len":264,"flow_avg_l4_data_len":181,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.7","src_port":23174,"dst_port":521,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":21,"flow_first_seen":1588779616036,"flow_last_seen":1588779618928,"flow_tot_l4_data_len":1624,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":77,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.5","src_port":23174,"dst_port":523,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":20,"flow_first_seen":1588779616036,"flow_last_seen":1588779619034,"flow_tot_l4_data_len":1520,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.1","src_port":23174,"dst_port":527,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":21,"flow_first_seen":1588779616036,"flow_last_seen":1588779618946,"flow_tot_l4_data_len":1624,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":77,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.1","src_port":23174,"dst_port":536,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":20,"flow_first_seen":1588779616036,"flow_last_seen":1588779619007,"flow_tot_l4_data_len":1520,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.4","src_port":23174,"dst_port":538,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":20,"flow_first_seen":1588779616036,"flow_last_seen":1588779618748,"flow_tot_l4_data_len":1520,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.8","src_port":23174,"dst_port":538,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1588779619914,"flow_last_seen":1588779619916,"flow_tot_l4_data_len":118,"flow_min_l4_data_len":51,"flow_max_l4_data_len":67,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":47127,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":3,"flow_first_seen":1588779611355,"flow_last_seen":1588779611657,"flow_tot_l4_data_len":399,"flow_min_l4_data_len":133,"flow_max_l4_data_len":133,"flow_avg_l4_data_len":133,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.75","dst_ip":"239.255.255.250","src_port":57916,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1588779600828,"flow_last_seen":1588779600842,"flow_tot_l4_data_len":116,"flow_min_l4_data_len":50,"flow_max_l4_data_len":66,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61631,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":3,"flow_first_seen":1588779626394,"flow_last_seen":1588779626394,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":2,"flow_first_seen":1588779650652,"flow_last_seen":1588779650666,"flow_tot_l4_data_len":118,"flow_min_l4_data_len":51,"flow_max_l4_data_len":67,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49533,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":9,"flow_first_seen":1588779597291,"flow_last_seen":1588779653520,"flow_tot_l4_data_len":2574,"flow_min_l4_data_len":286,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":286,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.75","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":5,"flow_first_seen":1588779647380,"flow_last_seen":1588779654853,"flow_tot_l4_data_len":1595,"flow_min_l4_data_len":319,"flow_max_l4_data_len":319,"flow_avg_l4_data_len":319,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":120,"flow_first_seen":1588779596708,"flow_last_seen":1588779655297,"flow_tot_l4_data_len":20763,"flow_min_l4_data_len":108,"flow_max_l4_data_len":435,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.75","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":18,"flow_first_seen":1588779596464,"flow_last_seen":1588779654853,"flow_tot_l4_data_len":1460,"flow_min_l4_data_len":53,"flow_max_l4_data_len":204,"flow_avg_l4_data_len":81,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00507{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":3,"flow_first_seen":1588779639103,"flow_last_seen":1588779650102,"flow_tot_l4_data_len":200,"flow_min_l4_data_len":56,"flow_max_l4_data_len":88,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":28150,"dst_port":59772,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
-00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":3,"flow_first_seen":1588779639103,"flow_last_seen":1588779650102,"flow_tot_l4_data_len":200,"flow_min_l4_data_len":56,"flow_max_l4_data_len":88,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":28150,"dst_port":59772,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":8,"flow_first_seen":1588779608134,"flow_last_seen":1588779649019,"flow_tot_l4_data_len":384,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":4,"flow_first_seen":1588779637830,"flow_last_seen":1588779640832,"flow_tot_l4_data_len":728,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"239.255.255.250","src_port":52127,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1588779617174,"flow_last_seen":1588779618677,"flow_tot_l4_data_len":144,"flow_min_l4_data_len":56,"flow_max_l4_data_len":88,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":23174,"dst_port":60723,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":3,"flow_first_seen":1588779634764,"flow_last_seen":1588779634797,"flow_tot_l4_data_len":2752,"flow_min_l4_data_len":36,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":917,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":50822,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1588779628757,"flow_last_seen":1588779628804,"flow_tot_l4_data_len":126,"flow_min_l4_data_len":39,"flow_max_l4_data_len":87,"flow_avg_l4_data_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49764,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1588779596464,"flow_last_seen":1588779598465,"flow_tot_l4_data_len":268,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":54306,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":4,"flow_first_seen":1588779648840,"flow_last_seen":1588779654853,"flow_tot_l4_data_len":536,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":56384,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":24,"flow_first_seen":1588779637543,"flow_last_seen":1588779651686,"flow_tot_l4_data_len":1840,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.1","src_port":28150,"dst_port":529,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":298,"flow_first_seen":1588779637543,"flow_last_seen":1588779654458,"flow_tot_l4_data_len":57280,"flow_min_l4_data_len":40,"flow_max_l4_data_len":280,"flow_avg_l4_data_len":192,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.8","src_port":28150,"dst_port":529,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":24,"flow_first_seen":1588779637543,"flow_last_seen":1588779651659,"flow_tot_l4_data_len":1840,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.3","src_port":28150,"dst_port":530,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":288,"flow_first_seen":1588779637543,"flow_last_seen":1588779654458,"flow_tot_l4_data_len":59616,"flow_min_l4_data_len":40,"flow_max_l4_data_len":296,"flow_avg_l4_data_len":207,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.1","src_port":28150,"dst_port":533,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":25,"flow_first_seen":1588779637543,"flow_last_seen":1588779651680,"flow_tot_l4_data_len":1944,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":77,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.3","src_port":28150,"dst_port":537,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":24,"flow_first_seen":1588779637543,"flow_last_seen":1588779651645,"flow_tot_l4_data_len":1840,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.5","src_port":28150,"dst_port":537,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1588779607374,"flow_last_seen":1588779607388,"flow_tot_l4_data_len":216,"flow_min_l4_data_len":41,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":108,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":52118,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":5,"flow_first_seen":1588779603292,"flow_last_seen":1588779643386,"flow_tot_l4_data_len":675,"flow_min_l4_data_len":108,"flow_max_l4_data_len":204,"flow_avg_l4_data_len":135,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::18a0:a412:8935:c01b","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1588779647380,"flow_last_seen":0,"flow_tot_l4_data_len":134,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":50698,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":2,"flow_first_seen":1588779650651,"flow_last_seen":1588779650681,"flow_tot_l4_data_len":136,"flow_min_l4_data_len":47,"flow_max_l4_data_len":89,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":58615,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1588779637560,"flow_last_seen":1588779637572,"flow_tot_l4_data_len":151,"flow_min_l4_data_len":49,"flow_max_l4_data_len":102,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":301,"flow_first_seen":1588779617174,"flow_last_seen":1588779629315,"flow_tot_l4_data_len":61960,"flow_min_l4_data_len":56,"flow_max_l4_data_len":280,"flow_avg_l4_data_len":205,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.52","src_port":23174,"dst_port":31480,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":3,"flow_first_seen":1588779634762,"flow_last_seen":1588779634795,"flow_tot_l4_data_len":2752,"flow_min_l4_data_len":36,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":917,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":61974,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":120,"flow_first_seen":1588779596708,"flow_last_seen":1588779655298,"flow_tot_l4_data_len":20763,"flow_min_l4_data_len":108,"flow_max_l4_data_len":435,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4ba:91a:7817:e318","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1588779629044,"flow_last_seen":1588779629045,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":76,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":5812,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1588779615019,"flow_last_seen":1588779615032,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61120,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":12,"flow_first_seen":1588779596451,"flow_last_seen":1588779651446,"flow_min_l4_payload_len":279,"flow_max_l4_payload_len":279,"flow_tot_l4_payload_len":3348,"flow_avg_l4_payload_len":279,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":123,"flow_first_seen":1588779616036,"flow_last_seen":1588779620617,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":256,"flow_tot_l4_payload_len":21280,"flow_avg_l4_payload_len":173,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.7","src_port":23174,"dst_port":521,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":21,"flow_first_seen":1588779616036,"flow_last_seen":1588779618928,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":1456,"flow_avg_l4_payload_len":69,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.5","src_port":23174,"dst_port":523,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":20,"flow_first_seen":1588779616036,"flow_last_seen":1588779619034,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":1360,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.1","src_port":23174,"dst_port":527,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":21,"flow_first_seen":1588779616036,"flow_last_seen":1588779618946,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":1456,"flow_avg_l4_payload_len":69,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.1","src_port":23174,"dst_port":536,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":20,"flow_first_seen":1588779616036,"flow_last_seen":1588779619007,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":1360,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.4","src_port":23174,"dst_port":538,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":20,"flow_first_seen":1588779616036,"flow_last_seen":1588779618748,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":1360,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.8","src_port":23174,"dst_port":538,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1588779619914,"flow_last_seen":1588779619916,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":47127,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":3,"flow_first_seen":1588779611355,"flow_last_seen":1588779611657,"flow_min_l4_payload_len":125,"flow_max_l4_payload_len":125,"flow_tot_l4_payload_len":375,"flow_avg_l4_payload_len":125,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.75","dst_ip":"239.255.255.250","src_port":57916,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1588779600828,"flow_last_seen":1588779600842,"flow_min_l4_payload_len":42,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":100,"flow_avg_l4_payload_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61631,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":3,"flow_first_seen":1588779626394,"flow_last_seen":1588779626394,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":50,"flow_tot_l4_payload_len":150,"flow_avg_l4_payload_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":2,"flow_first_seen":1588779650652,"flow_last_seen":1588779650666,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49533,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":9,"flow_first_seen":1588779597291,"flow_last_seen":1588779653520,"flow_min_l4_payload_len":278,"flow_max_l4_payload_len":278,"flow_tot_l4_payload_len":2502,"flow_avg_l4_payload_len":278,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.75","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":5,"flow_first_seen":1588779647380,"flow_last_seen":1588779654853,"flow_min_l4_payload_len":311,"flow_max_l4_payload_len":311,"flow_tot_l4_payload_len":1555,"flow_avg_l4_payload_len":311,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":120,"flow_first_seen":1588779596708,"flow_last_seen":1588779655297,"flow_min_l4_payload_len":100,"flow_max_l4_payload_len":427,"flow_tot_l4_payload_len":19803,"flow_avg_l4_payload_len":165,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.75","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":18,"flow_first_seen":1588779596464,"flow_last_seen":1588779654853,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":196,"flow_tot_l4_payload_len":1316,"flow_avg_l4_payload_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00519{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":3,"flow_first_seen":1588779639103,"flow_last_seen":1588779650102,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":176,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":28150,"dst_port":59772,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
+00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":3,"flow_first_seen":1588779639103,"flow_last_seen":1588779650102,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":176,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":28150,"dst_port":59772,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":8,"flow_first_seen":1588779608134,"flow_last_seen":1588779649019,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":320,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":4,"flow_first_seen":1588779637830,"flow_last_seen":1588779640832,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"239.255.255.250","src_port":52127,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1588779617174,"flow_last_seen":1588779618677,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":128,"flow_avg_l4_payload_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":23174,"dst_port":60723,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":3,"flow_first_seen":1588779634764,"flow_last_seen":1588779634797,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":1350,"flow_tot_l4_payload_len":2728,"flow_avg_l4_payload_len":909,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":50822,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1588779628757,"flow_last_seen":1588779628804,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":110,"flow_avg_l4_payload_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49764,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1588779596464,"flow_last_seen":1588779598465,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":126,"flow_tot_l4_payload_len":252,"flow_avg_l4_payload_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":54306,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":4,"flow_first_seen":1588779648840,"flow_last_seen":1588779654853,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":126,"flow_tot_l4_payload_len":504,"flow_avg_l4_payload_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":56384,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":24,"flow_first_seen":1588779637543,"flow_last_seen":1588779651686,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":1648,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.1","src_port":28150,"dst_port":529,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":298,"flow_first_seen":1588779637543,"flow_last_seen":1588779654458,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":272,"flow_tot_l4_payload_len":54896,"flow_avg_l4_payload_len":184,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.8","src_port":28150,"dst_port":529,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":24,"flow_first_seen":1588779637543,"flow_last_seen":1588779651659,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":1648,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.3","src_port":28150,"dst_port":530,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":288,"flow_first_seen":1588779637543,"flow_last_seen":1588779654458,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":288,"flow_tot_l4_payload_len":57312,"flow_avg_l4_payload_len":199,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.1","src_port":28150,"dst_port":533,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":25,"flow_first_seen":1588779637543,"flow_last_seen":1588779651680,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":1744,"flow_avg_l4_payload_len":69,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.3","src_port":28150,"dst_port":537,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":24,"flow_first_seen":1588779637543,"flow_last_seen":1588779651645,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":1648,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.5","src_port":28150,"dst_port":537,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1588779607374,"flow_last_seen":1588779607388,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":167,"flow_tot_l4_payload_len":200,"flow_avg_l4_payload_len":100,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":52118,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":5,"flow_first_seen":1588779603292,"flow_last_seen":1588779643386,"flow_min_l4_payload_len":100,"flow_max_l4_payload_len":196,"flow_tot_l4_payload_len":635,"flow_avg_l4_payload_len":127,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::18a0:a412:8935:c01b","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1588779647380,"flow_last_seen":0,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":126,"flow_tot_l4_payload_len":126,"flow_avg_l4_payload_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":50698,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":2,"flow_first_seen":1588779650651,"flow_last_seen":1588779650681,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":58615,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1588779637560,"flow_last_seen":1588779637572,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":94,"flow_tot_l4_payload_len":135,"flow_avg_l4_payload_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":301,"flow_first_seen":1588779617174,"flow_last_seen":1588779629315,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":272,"flow_tot_l4_payload_len":59552,"flow_avg_l4_payload_len":197,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.52","src_port":23174,"dst_port":31480,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":3,"flow_first_seen":1588779634762,"flow_last_seen":1588779634795,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":1350,"flow_tot_l4_payload_len":2728,"flow_avg_l4_payload_len":909,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":61974,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00515{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":120,"flow_first_seen":1588779596708,"flow_last_seen":1588779655298,"flow_min_l4_payload_len":100,"flow_max_l4_payload_len":427,"flow_tot_l4_payload_len":19803,"flow_avg_l4_payload_len":165,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4ba:91a:7817:e318","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test"}