nDPId-test: mimic full nDPId lifecycle

 * generate DAEMON_EVENT_INIT as well as DAEMON_EVENT_SHUTDOWN
 * process remaining flows before shutdown (and generate events)

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 46 insertions, 0 deletions

diff --git a/test/results/waze.pcap.out b/test/results/waze.pcap.out
index 897a0d4ba..382805cb8 100644
--- a/test/results/waze.pcap.out
+++ b/test/results/waze.pcap.out
@@ -1,3 +1,4 @@
+00381{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"waze.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
 00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"waze.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1435587866603,"flow_last_seen":0,"flow_tot_l4_data_len":57,"flow_min_l4_data_len":57,"flow_max_l4_data_len":57,"flow_avg_l4_data_len":57,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"174.37.231.81","src_port":42256,"dst_port":5222,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00456{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"waze.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1435587866,"pkt_ts_usec":603221,"pkt_caplen":91,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":91,"pkt_l4_len":57,"pkt":"ABoRAAACABoRAAABCABFAABNMsFAAEAGQsYKECWdriXnUaUQFGaA18okWhY9doAYAVcoQwAAAQEICgAIazhBJdw4gAAWBXL2KZLscQ7\/r4Q3YR6R6YsREWIs0w=="}
 00456{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"waze.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1435587867,"pkt_ts_usec":103902,"pkt_caplen":91,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":91,"pkt_l4_len":57,"pkt":"ABoRAAACABoRAAABCABFAABNMsJAAEAGQsUKECWdriXnUaUQFGaA18okWhY9doAYAVcoEAAAAQEICgAIa2tBJdw4gAAWBXL2KZLscQ7\/r4Q3YR6R6YsREWIs0w=="}
@@ -446,3 +447,48 @@
 00409{"flow_id":33,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":587,"source":"waze.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1435587906,"pkt_ts_usec":206886,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo2ilAAEAGerQKCAABLjOtto0pAbvwXaIcD6JtFlAQ\/\/8rywAA"}
 00612{"flow_id":33,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":588,"source":"waze.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1435587906,"pkt_ts_usec":207621,"pkt_caplen":203,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":203,"pkt_l4_len":169,"pkt":"ABoRAAACABoRAAABCABFAAC92ipAAEAGeh4KCAABLjOtto0pAbvwXaIcD6JtFlAY\/\/+rHQAAFwMBAJDkrrD9SA4+LmKzspcHnXowhPBblCCla204NgqPS0UbDvi3FwMZblBmNtY0jKhmQuQORsNfhK8al25NMwXFLKNdn+z1CtsyYB43HL9wyLLSMNK7nC1Zky+WYPvMpkuwuyJ0+McaUzeUsX5ul4pcc5NuTj8ADh7sJcVgm+9jWgCOQ9KUX5vGtnm3baGraIAVagc="}
 00409{"flow_id":33,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":589,"source":"waze.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1435587906,"pkt_ts_usec":208378,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAodYxAABAGD1IuM622CggAAQG7jSkPom0W8F2isVAQ\/\/8rNgAA"}
+00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":4,"flow_first_seen":1435587880580,"flow_last_seen":1435587880589,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":52953,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
+00482{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":4,"flow_first_seen":1435587880580,"flow_last_seen":1435587880589,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":52953,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":17,"flow_first_seen":1435587868632,"flow_last_seen":1435587869162,"flow_tot_l4_data_len":3437,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1644,"flow_avg_l4_data_len":202,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.230.227.172","src_port":45529,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00482{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":15,"flow_first_seen":1435587869162,"flow_last_seen":1435587869302,"flow_tot_l4_data_len":855,"flow_min_l4_data_len":20,"flow_max_l4_data_len":413,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.230.227.172","src_port":45536,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00482{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":14,"flow_first_seen":1435587871656,"flow_last_seen":1435587871946,"flow_tot_l4_data_len":850,"flow_min_l4_data_len":20,"flow_max_l4_data_len":413,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.230.227.172","src_port":45538,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":14,"flow_first_seen":1435587871658,"flow_last_seen":1435587871945,"flow_tot_l4_data_len":810,"flow_min_l4_data_len":20,"flow_max_l4_data_len":375,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.230.227.172","src_port":45540,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":14,"flow_first_seen":1435587871941,"flow_last_seen":1435587872478,"flow_tot_l4_data_len":852,"flow_min_l4_data_len":20,"flow_max_l4_data_len":413,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.230.227.172","src_port":45546,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":14,"flow_first_seen":1435587872476,"flow_last_seen":1435587872705,"flow_tot_l4_data_len":847,"flow_min_l4_data_len":20,"flow_max_l4_data_len":413,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.230.227.172","src_port":45552,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":14,"flow_first_seen":1435587872702,"flow_last_seen":1435587872838,"flow_tot_l4_data_len":843,"flow_min_l4_data_len":20,"flow_max_l4_data_len":411,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.230.227.172","src_port":45554,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00521{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":15,"flow_first_seen":1435587898822,"flow_last_seen":1435587899372,"flow_tot_l4_data_len":831,"flow_min_l4_data_len":20,"flow_max_l4_data_len":211,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"108.168.176.228","src_port":50828,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WhatsApp","breed":"Acceptable","category":"Chat"}}
+00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":15,"flow_first_seen":1435587898822,"flow_last_seen":1435587899372,"flow_tot_l4_data_len":831,"flow_min_l4_data_len":20,"flow_max_l4_data_len":211,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"108.168.176.228","src_port":50828,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00517{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":4,"flow_first_seen":1435587880579,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.198","src_port":45169,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
+00479{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":4,"flow_first_seen":1435587880579,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.198","src_port":45169,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":107,"flow_first_seen":1435587868634,"flow_last_seen":1435587888318,"flow_tot_l4_data_len":82074,"flow_min_l4_data_len":20,"flow_max_l4_data_len":17224,"flow_avg_l4_data_len":767,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"46.51.173.182","src_port":36100,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":37,"flow_first_seen":1435587868635,"flow_last_seen":1435587884546,"flow_tot_l4_data_len":10726,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3626,"flow_avg_l4_data_len":289,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"46.51.173.182","src_port":36102,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":24,"flow_first_seen":1435587894241,"flow_last_seen":1435587901093,"flow_tot_l4_data_len":5769,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3167,"flow_avg_l4_data_len":240,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"46.51.173.182","src_port":36134,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":23,"flow_first_seen":1435587905035,"flow_last_seen":1435587907392,"flow_tot_l4_data_len":4960,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2155,"flow_avg_l4_data_len":215,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"46.51.173.182","src_port":36137,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":32,"flow_first_seen":1435587878606,"flow_last_seen":1435587882306,"flow_tot_l4_data_len":43531,"flow_min_l4_data_len":20,"flow_max_l4_data_len":11152,"flow_avg_l4_data_len":1360,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"176.34.186.180","src_port":36312,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":20,"flow_first_seen":1435587879018,"flow_last_seen":1435587882336,"flow_tot_l4_data_len":4993,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2499,"flow_avg_l4_data_len":249,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"176.34.186.180","src_port":36314,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":28,"flow_first_seen":1435587879850,"flow_last_seen":1435587883075,"flow_tot_l4_data_len":26934,"flow_min_l4_data_len":20,"flow_max_l4_data_len":8116,"flow_avg_l4_data_len":961,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"176.34.186.180","src_port":36316,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":4,"flow_first_seen":1435587880587,"flow_last_seen":1435587880590,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.198","src_port":43089,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
+00480{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":4,"flow_first_seen":1435587880587,"flow_last_seen":1435587880590,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.198","src_port":43089,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":16,"flow_first_seen":1435587871939,"flow_last_seen":1435587873226,"flow_tot_l4_data_len":8641,"flow_min_l4_data_len":20,"flow_max_l4_data_len":4014,"flow_avg_l4_data_len":540,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"52.17.114.219","src_port":39010,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":13,"flow_first_seen":1435587868996,"flow_last_seen":1435587869400,"flow_tot_l4_data_len":1700,"flow_min_l4_data_len":20,"flow_max_l4_data_len":568,"flow_avg_l4_data_len":130,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.194.118.48","src_port":36585,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":33,"flow_first_seen":1435587878215,"flow_last_seen":1435587880857,"flow_tot_l4_data_len":57774,"flow_min_l4_data_len":20,"flow_max_l4_data_len":21908,"flow_avg_l4_data_len":1750,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"52.17.114.219","src_port":39021,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":23,"flow_first_seen":1435587871918,"flow_last_seen":1435587874945,"flow_tot_l4_data_len":7041,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1388,"flow_avg_l4_data_len":306,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"176.34.103.105","src_port":51049,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":18,"flow_first_seen":1435587871929,"flow_last_seen":1435587874378,"flow_tot_l4_data_len":4941,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2131,"flow_avg_l4_data_len":274,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"176.34.103.105","src_port":51050,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":21,"flow_first_seen":1435587871935,"flow_last_seen":1435587874495,"flow_tot_l4_data_len":7001,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2131,"flow_avg_l4_data_len":333,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"176.34.103.105","src_port":51051,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":4,"flow_first_seen":1435587880578,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":41823,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
+00482{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":4,"flow_first_seen":1435587880578,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":41823,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":4,"flow_first_seen":1435587880576,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.31","src_port":43991,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
+00482{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":4,"flow_first_seen":1435587880576,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.31","src_port":43991,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":4,"flow_first_seen":1435587880583,"flow_last_seen":1435587880590,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.49","src_port":60574,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
+00478{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":4,"flow_first_seen":1435587880583,"flow_last_seen":1435587880590,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.49","src_port":60574,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":37,"flow_first_seen":1435587867755,"flow_last_seen":1435587873026,"flow_tot_l4_data_len":61947,"flow_min_l4_data_len":20,"flow_max_l4_data_len":11799,"flow_avg_l4_data_len":1674,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"65.39.128.135","src_port":54915,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":4,"flow_first_seen":1435587880577,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":46473,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
+00482{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":4,"flow_first_seen":1435587880577,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":46473,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":4,"flow_first_seen":1435587880589,"flow_last_seen":1435587880590,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.49","src_port":60479,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
+00479{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":4,"flow_first_seen":1435587880589,"flow_last_seen":1435587880590,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.49","src_port":60479,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00481{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1435587867443,"flow_last_seen":1435587867753,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.89.75.198","src_port":46214,"dst_port":123,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":4,"flow_first_seen":1435587880581,"flow_last_seen":1435587880589,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":52746,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
+00482{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":4,"flow_first_seen":1435587880581,"flow_last_seen":1435587880589,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":52746,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00501{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":10,"flow_first_seen":1435587866603,"flow_last_seen":1435587898628,"flow_tot_l4_data_len":446,"flow_min_l4_data_len":20,"flow_max_l4_data_len":57,"flow_avg_l4_data_len":44,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"174.37.231.81","src_port":42256,"dst_port":5222,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
+00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":10,"flow_first_seen":1435587866603,"flow_last_seen":1435587898628,"flow_tot_l4_data_len":446,"flow_min_l4_data_len":20,"flow_max_l4_data_len":57,"flow_avg_l4_data_len":44,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"174.37.231.81","src_port":42256,"dst_port":5222,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test"}