Reworked layer 4 flow length naming/calculation.

 * nDPIsrvd services usually do not care about layer4 data length,
   payload length is quite more essential for further processing

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 208 insertions, 208 deletions

diff --git a/test/results/webex.pcap.out b/test/results/webex.pcap.out
index 3796f2b46..882a63a72 100644
--- a/test/results/webex.pcap.out
+++ b/test/results/webex.pcap.out
@@ -1,15 +1,15 @@
 00473{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"webex.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
-00466{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"webex.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1444570624853,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41346,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"webex.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1444570624853,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41346,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00433{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570624,"pkt_ts_usec":853841,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8OXNAAEAGTZUKCAABQERpZ6GCAbtPGIcMAAAAAKACOQgjFwAAAgQFtAQCCAoATL5\/AAAAAAEDAwY="}
 00406{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570624,"pkt_ts_usec":860347,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAQ5AABAGtg5ARGlnCggAAQG7oYKw53jzTxiHDVAS\/\/9Y4AAA"}
 00404{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570624,"pkt_ts_usec":860575,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoOXRAAEAGTagKCAABQERpZ6GCAbtPGIcNsOd49FAQOQgf2QAA"}
 00670{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570624,"pkt_ts_usec":860735,"pkt_caplen":249,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":249,"pkt_l4_len":215,"pkt":"ABoRAAACABoRAAABCABFAADrOXVAAEAGTOQKCAABQERpZ6GCAbtPGIcNsOd49FAYOQh62gAAFgMBAL4BAAC6AwNWGmYAecKEXHBKd9RHCMqE79SthA0OtjJysVWA+njuJAAAOMwUzBPMFcAUwAoAOQA4ADXAEsAIABYAEwAKwC\/AK8ATwAkAogCeADMAMgCcAC\/AEcAHAAUABAD\/AQAAWQAAABUAEwAAEHJhZGNvbS53ZWJleC5jb20ACwACAQAACgAIAAYAGQAYABcAIwAAAA0AIgAgBgEGAgYDBQEFAgUDBAEEAgQDAwEDAgMDAgECAgIDAQEzdAAA"}
-00753{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"webex.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1444570624853,"flow_last_seen":1444570624860,"flow_tot_l4_data_len":295,"flow_min_l4_data_len":20,"flow_max_l4_data_len":215,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41346,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00764{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"webex.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1444570624853,"flow_last_seen":1444570624860,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":195,"flow_tot_l4_payload_len":195,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41346,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00406{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570624,"pkt_ts_usec":860939,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAQ9AABAGtg1ARGlnCggAAQG7oYKw53j0TxiH0FAQ\/\/9YHgAA"}
 04075{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570625,"pkt_ts_usec":366647,"pkt_caplen":2774,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2774,"pkt_l4_len":2740,"pkt":"ABoRAAACABoRAAABCABFAArIARBAABAGq2xARGlnCggAAQG7oYKw53j0TxiH0FAY\/\/+niAAAFgMDD14CAABNAwNWGmYGrXlEL8KcmRJCmeb5vtKebzB1FTCh\/csGLpROsSCiEgrZvpHjzJYNIqBz8GV5Z5nEiB2\/9li16SQKz1NTSAAEAAAF\/wEAAQALAA8FAA8CAATpMIIE5TCCA82gAwIBAgIQKXSJqdQeSb5h94FpRuYh8zANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MB4XDTE1MDQxMDAwMDAwMFoXDTE4MDQxMDIzNTk1OVowdzELMAkGA1UEBhMCdXMxEzARBgNVBAgMCkNhbGlmb3JuaWExETAPBgNVBAcMCFNhbiBKb3NlMRwwGgYDVQQKDBNDaXNjbyBTeXN0ZW1zLCBJbmMuMQwwCgYDVQQLDANDU0cxFDASBgNVBAMMCyoud2ViZXguY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnXjIYUvDCGFnLF6CX7BhvJlmnmrg0KiZFcDP6TyJs2s+n7Hjqpb8O374x26knzLrTkrkpNBVvbi6eY8X6lmrWlqvlgEoyMmslNbZoAjUy1C9HNIMI2F1bLGI\/pKRUGbpk5wvAv6SKOf+cKi3mis7U2sccUb8cFxKTVpp62iK2uOzkFa4zF1i4hm\/NKjJWJVuj\/D8tQpd0PSuU5wWY7G1x\/5UpvvDV7KS7Tsmn3ib\/8gstBL+PLvKZHJ8YWc8u02oGZQoWD64APslwdmLLyDqq5USERl2bc761RHbBhnmKf3IpyvGqgfCFbQ7hfb+sniY0O+KQiBpaJI1bt4iiHQ1YQIDAQABo4IBZDCCAWAwFgYDVR0RBA8wDYILKi53ZWJleC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGUGA1UdIAReMFwwWgYKYIZIAYb4RQEHNjBMMCMGCCsGAQUFBwIBFhdodHRwczovL2Quc3ltY2IuY29tL2NwczAlBggrBgEFBQcCAjAZGhdodHRwczovL2Quc3ltY2IuY29tL3JwYTAfBgNVHSMEGDAWgBRfYM9hkFXfhEMUimAqsvV69EMY7zArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNybDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zcy5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9zcy5zeW1jYi5jb20vc3MuY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAU0XVgHR8KQTLFFzVVA7s1Rlqj4+dm5q+OB5OfJMqYeX\/hnGHVeD8z9\/9EdKsauBRbbFpJk38PC3aGoy0iL9v8CA4V6o0qYzEfedbF\/p\/UuvtChO8CktAaqN64hPdToCJEy3gqyB\/Hv7VVuKXUBogujzn1WBdIyBUlO\/hClSnOD8Qq1So\/AzCrw+\/ChOOV7DI631hsLE1M73UmQqxi7Cbu5R5TsXH6v6s\/7CAPBhVtuxTBBcBuPtA6Pd2Q8vOf6ByuErVmWAV\/tOLfjGuqPuM2JoxzR1iH82zcoIcxOzmtUIYsiTuUSCi\/AsNsm265BOW9oeh5kgZU+pE6LkGX9bECAAU8MIIFODCCBCCgAwIBAgIQUT+5dDhwtzRAQY0wkwaZ\/zANBgkqhkiG9w0BAQsFADCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwHhcNMTMxMDMxMDAwMDAwWhcNMjMxMDMwMjM1OTU5WjB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAstgFyhx0LbUXVjnFSlIJluhL2AzxaJ+aQihiw6UwU35VEYJbA3oNL+F5BMm0lncZgQGUWfm893qZJ4Itt4PdWid\/sgN6nFMl6UgfRk\/InSn4vnlW9vf92Tpo2otLgjNBEsPIPMzWlnqEIRoiBAMnF4scaGGTDw5RgDMdtLXO637QYqzus3sBdO9pNevK1T2p7peYyo2qRA4lmUoVlqTObQJUHypqJuIGOmNIrLRM0XWTUP8TL9ba4cYY9Z\/JJV3zADreJk20KQnNDz0jbxZKgRb78oMQw7jW2FUyPfG9D72MUpVKFpd6UiFjdS8W+cRmvvW1Cdj\/JwDNRHxvSz+w9wIDAQABo4IBYzCCAV8wEgYDVR0TAQH\/BAgwBgEB\/wIBADAwBgNVHR8EKTAnMCWgI6Ahhh9odHRwOi8vczEuc3ltY2IuY29tL3BjYTMtZzUuY3JsMA4GA1UdDwEB\/wQEAwIBBjAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zMi5zeW1jYi5jb20wawYDVR0gBGQwYjBgBgpghkgBhvhFAQc2MFIwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vY3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vcnBhMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFTeW1hbnRlY1BLSS0xLTUzNDAdBgNVHQ4EFgQUX2DPYZBV34RDFIpgKrL1evRDGO8wHwYDVR0jBBgwFoAUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwDQYJKoZIhvcNAQELBQADggEBAF6UVkndji1l9cE2UbYD49qecxnyH1mrWH5sJgUs+oHXXCMXIiw3k\/eG7IXmsKP9H+IyqEVv4dn7ua\/ScKAyQmW\/hP4WKo8\/xabWo5N9Q+l0IZE1KPRj6S7t9\/Vcf0uatSDpCr3gRRAMFJSaXaXjS5HoJJtGQGX0InLNmfiIEfXzf+YzguaoxX7+0AjiJVgIcWjmzaLmFN5OUiQt\/eV5E1PnXi8tTRttQBVSK\/eHiXgSgW7ZTaoteNTCLD0IX4eRnh8OsN4wUmSGiaqdZpwOdgyA8nTYKvi4Os7X1g8RvmurFPW9QaAiY4nxug9vKWNmLT+sjHLF+8fk1A\/yO0+MKccABNQwggTQMIIEOaADAgECAhAlDOjgMGE="}
 00404{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570625,"pkt_ts_usec":418062,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoOXZAAEAGTaYKCAABQERpZ6GCAbtPGIfQsOeDlFAQSmADHgAA"}
 02053{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570625,"pkt_ts_usec":424499,"pkt_caplen":1273,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1273,"pkt_l4_len":1239,"pkt":"ABoRAAACABoRAAABCABFAATrARFAABAGsUhARGlnCggAAQG7oYKw54OUTxiH0FAY\/\/8tYwAALp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ\/XxrcgxiV0i6CqqpkKzj\/i5Vbext0uz\/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6\/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn\/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4\/VBEnkjWNHiDxpg8v+R70rfk\/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10\/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH\/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB\/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW\/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3\/DgAAAA=="}
-01106{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":8,"source":"webex.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":8,"flow_first_seen":1444570624853,"flow_last_seen":1444570625424,"flow_tot_l4_data_len":4314,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2740,"flow_avg_l4_data_len":539,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41346,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","server_names":"*.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"c253ec3ad88e42f8da4032682892f9a0","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01117{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":8,"source":"webex.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":8,"flow_first_seen":1444570624853,"flow_last_seen":1444570625424,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2720,"flow_tot_l4_payload_len":4134,"flow_avg_l4_payload_len":516,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41346,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","server_names":"*.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"c253ec3ad88e42f8da4032682892f9a0","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00404{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570625,"pkt_ts_usec":478209,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoOXdAAEAGTaUKCAABQERpZ6GCAbtPGIfQsOeIV1AQVQDzugAA"}
 00833{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570625,"pkt_ts_usec":479114,"pkt_caplen":364,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":364,"pkt_l4_len":330,"pkt":"ABoRAAACABoRAAABCABFAAFeOXhAAEAGTG4KCAABQERpZ6GCAbtPGIfQsOeIV1AYVQCmoAAAFgMDAQYQAAECAQBaUJRMvDfnP91s4fLaSdu44xt7RFR+trnYQAsQZuxiv+VH3sH2YjpaVj+0amWHFiBxymsVXudQxps8\/5f1xDtVwG8a\/DnSLkvL1cihzvsCtgdF4uu98yJ277wUvmb2ADrv\/q4qNCFJheN\/tviU6E0p9sJD0tbw6UMAxbTbpfvHhmrNcSZ7gphi4YoWg\/4K8xa5CFlA9Bwr2cXgCUOqkETobyBCJoOdy3LvdLyGtJDLzvg3lKApkzr7cWH2Z5H4GoYK7ZrQQMBwoGfNCtEfEXMdQL8J5i6bQe\/G8tQ\/hKM0OV9AzcPKReXjJ659etvNkSFvYhXHHHcoPV8Xx8\/e+ceMFAMDAAEBFgMDACBs0R1B8r1wXdCDd995zf9rNLSN0DOD7DSUs+Nqz9hnAA=="}
 00408{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570625,"pkt_ts_usec":480124,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoARJAABAGtgpARGlnCggAAQG7oYKw54hXTxiJBlAQ\/\/9HhQAA"}
@@ -17,15 +17,15 @@
 00406{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570625,"pkt_ts_usec":788425,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoOXlAAEAGTaMKCAABQERpZ6GCAbtPGIkGsOeIglAQVQDyWQAA"}
 01135{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570625,"pkt_ts_usec":798477,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"ABoRAAACABoRAAABCABFAAJAOXpAAEAGS4oKCAABQERpZ6GCAbtPGIkGsOeIglAQVQA0zAAAFwMDAmeqqCMUx8c9iSNQiPKergAXiXKVeDDXEnFufJco20ynj8UmHyLA2Gq0yypm4O4M5k6jK\/Gbw6t6uftvgO2VFS+g01cGRRstYeMzT8\/Hv4nm9THYS9voNdEYzsJ98ZqAjA3jPiTvqcTqRq8tbz6JTLDwpZyrMTp3ORDu0dYyicoODxkI0c9QBdqJmCymc9FPHRIhh0HqsZYhtVO1uFbNMJ8w+rFwR83\/x5wHQCSUCu89CM+Fd9BsswnBqF3Kqps6nsem+Tbw9cH\/KN2yMAKQdN+uUsPs63edc\/s3Sdp6E97G2vP4yFhyQeKHoouACY5RvoB+MBp2SU5eOZnTY+Iai9heQofNjj2sn0l7TrwEmSwLVg1WyH5Bdhn9EYQtKNBZ12FOnufS1hyJNwRdDbUxD3zGxuFzvYXTNZ\/fnCqudf0ZmTXI3AdgcxGhOfl16FTOxG48h2XFwhhVQW0urpsR3O8IB8nI5rHhGU8pxxcgv1x0WdQv09IPQsn6cDIiYXmz6rg00Rq0IY9uXu\/I5kTEwfdFaCJHKe0YxoKClsPNITnj+BoIBp9w8tlfu\/yZQE3rc5CMF9EfrY\/hQ1GWW+se96TuUMTG9GXrtegBkzyJ\/wDwGmKaQXspeg6t1G01Qf6yH+FggJlIsWoOtIRyUy4US5sHsI52mtRgEx2e5un0aNCb6rM2Q4pIBzXe+tb4ql99+K6pnHQ="}
 00408{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570625,"pkt_ts_usec":799010,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoARRAABAGtghARGlnCggAAQG7oYKw54iCTxiLHlAQ\/\/9FQgAA"}
-00467{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":50,"source":"webex.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1444570627404,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41348,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":50,"source":"webex.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1444570627404,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41348,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00434{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":50,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570627,"pkt_ts_usec":404164,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8hnNAAEAGAJUKCAABQERpZ6GEAbuwMDkNAAAAAKACOQgO\/QAAAgQFtAQCCAoATL9+AAAAAAEDAwY="}
 00407{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":51,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570627,"pkt_ts_usec":409779,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoASZAABAGtfZARGlnCggAAQG7oYRPz8bysDA5DlAS\/\/9Y3gAA"}
 00406{"flow_id":2,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":52,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570627,"pkt_ts_usec":410952,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAohnRAAEAGAKgKCAABQERpZ6GEAbuwMDkOT8\/G81AQOQgf1wAA"}
 00716{"flow_id":2,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":53,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570627,"pkt_ts_usec":411108,"pkt_caplen":281,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":281,"pkt_l4_len":247,"pkt":"ABoRAAACABoRAAABCABFAAELhnVAAEAG\/8MKCAABQERpZ6GEAbuwMDkOT8\/G81AYOQi8XAAAFgMBAN4BAADaAwNWGmYD1bgajSKfLk8MBc\/KhqagawnHbCgQ2bA0JfR3iiCiEgrZvpHjzJYNIqBz8GV5Z5nEiB2\/9li16SQKz1NTSAA4zBTME8wVwBTACgA5ADgANcASwAgAFgATAArAL8ArwBPACQCiAJ4AMwAyAJwAL8ARwAcABQAEAP8BAABZAAAAFQATAAAQcmFkY29tLndlYmV4LmNvbQALAAIBAAAKAAgABgAZABgAFwAjAAAADQAiACAGAQYCBgMFAQUCBQMEAQQCBAMDAQMCAwMCAQICAgMBATN0AAA="}
-00754{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":53,"source":"webex.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":1444570627404,"flow_last_seen":1444570627411,"flow_tot_l4_data_len":327,"flow_min_l4_data_len":20,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":81,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41348,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00765{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":53,"source":"webex.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":1444570627404,"flow_last_seen":1444570627411,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":227,"flow_tot_l4_payload_len":227,"flow_avg_l4_payload_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41348,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00408{"flow_id":2,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":54,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570627,"pkt_ts_usec":411318,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoASdAABAGtfVARGlnCggAAQG7oYRPz8bzsDA58VAQ\/\/9X\/AAA"}
 00587{"flow_id":2,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":65,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570627,"pkt_ts_usec":815979,"pkt_caplen":183,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":183,"pkt_l4_len":149,"pkt":"ABoRAAACABoRAAABCABFAACpAS1AABAGtW5ARGlnCggAAQG7oYRPz8bzsDA58VAY\/\/\/Z6wAAFgMDAFECAABNAwNWGmYJvIxu30wG6\/QUZCmoAMbL6LdQC15hV8KtMY\/qdSCiEgrZvpHjzJYNIqBz8GV5Z5nEiB2\/9li16SQKz1NTSAAEAAAF\/wEAAQAUAwMAAQEWAwMAIKNCXdoHLE35gFWT8+ZDcTEszCphhanV0csUAVKKsy+J"}
-00795{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":65,"source":"webex.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":6,"flow_first_seen":1444570627404,"flow_last_seen":1444570627815,"flow_tot_l4_data_len":496,"flow_min_l4_data_len":20,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":82,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41348,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"c253ec3ad88e42f8da4032682892f9a0","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
+00806{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":65,"source":"webex.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":6,"flow_first_seen":1444570627404,"flow_last_seen":1444570627815,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":227,"flow_tot_l4_payload_len":356,"flow_avg_l4_payload_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41348,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"c253ec3ad88e42f8da4032682892f9a0","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
 00406{"flow_id":2,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":66,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570627,"pkt_ts_usec":866438,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAohnZAAEAGAKYKCAABQERpZ6GEAbuwMDnxT8\/HdFAQPLgawwAA"}
 00466{"flow_id":2,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":67,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570627,"pkt_ts_usec":867035,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":97,"pkt_l4_len":63,"pkt":"ABoRAAACABoRAAABCABFAABThndAAEAGAHoKCAABQERpZ6GEAbuwMDnxT8\/HdFAYPLjpWAAAFAMDAAEBFgMDACBXzEd1erS3V3J4BRCzEeJwOZFWWJv7nft2Y0meqHofKg=="}
 00407{"flow_id":2,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":68,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570627,"pkt_ts_usec":867279,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAS5AABAGte5ARGlnCggAAQG7oYRPz8d0sDA6HFAQ\/\/9XUAAA"}
@@ -33,27 +33,27 @@
 00408{"flow_id":2,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":78,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":113149,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoATNAABAGtelARGlnCggAAQG7oYRPz8d0sDA8NFAQ\/\/9VOAAA"}
 01062{"flow_id":2,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":79,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":113281,"pkt_caplen":533,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":533,"pkt_l4_len":499,"pkt":"ABoRAAACABoRAAABCABFAAIHhnlAAEAG\/sMKCAABQERpZ6GEAbuwMDw0T8\/HdFAYPLgltgAA4D86yWxOofraycd6q8+9111oxSs78SkXydJiKVK5NG9Ksa8JcplVFpGHi5NmCJQxfVk\/aCzkkddizbqROo4KmLRpMdS79VL6k3fOUp4msSvZdH9Gx4RHATuO9MdxbvwYimqsZZ5BDaPDRH7nYd8SRCmXz6zDU0\/N9anaVk\/Hdu30MRzEnQrC\/g+4JnnyuE5gi3bCCXU0sNz5FKNXx5wdx3lUkmPtV5rYkWXytJjPSHfDZA9kvmo4Df7Ji1\/iTxgIAMjepR\/QchGb+A4uZ2w7CLOHrT+4+dHN5a92ssVS3TM1gsuzDAxQQxYW7k4l0RfbrVAhqPnA\/KdR6XakGTwmpg59c881TJMyXE8K6ZgfW7jqWcvFO8PnFzcNYtcPnvu2DacXj4CouqwJme\/Op7\/7FJRM6n3C0rkfoJ0R12qYOnCDQjK+vtijEhwf7MDvCx1R0Y2U+CO1GO4kT6DLWyG2NZO0E4gjMLAheFp6jcj7A3P3V80KwTJFaM0rNGVgWpsXV+W8VN7K4jUjldIrSu\/F4qGsyJxgyUJcdxGiB498zEuf4bJ3kO+HqzRA7v+SHqROL8mYH+YuEboQd7Ns+OLs6GULghyX7MhTGrzgRS6\/6kqpZBFQcHJ7oU3kJLuEOQc="}
 00408{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":80,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":113456,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoATRAABAGtehARGlnCggAAQG7oYRPz8d0sDA+E1AQ\/\/9TWQAA"}
-00467{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":81,"source":"webex.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1444570628113,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41350,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":81,"source":"webex.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1444570628113,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41350,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00434{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":81,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":113579,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8CqVAAEAGfGMKCAABQERpZ6GGAbuTEbVkAAAAAKACOQivfwAAAgQFtAQCCAoATL\/BAAAAAAEDAwY="}
 00407{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":82,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":117515,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoATVAABAGtedARGlnCggAAQG7oYZs7kqbkxG1ZVAS\/\/9Y3AAA"}
-00467{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":83,"source":"webex.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1444570628117,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41351,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":83,"source":"webex.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1444570628117,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41351,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00434{"flow_id":4,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":83,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":117770,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8SvxAAEAGPAwKCAABQERpZ6GHAbtcKPU9AAAAAKACOQimjgAAAgQFtAQCCAoATL\/BAAAAAAEDAwY="}
 00407{"flow_id":4,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":84,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":121468,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoATZAABAGteZARGlnCggAAQG7oYej1wrCXCj1PlAS\/\/9Y2wAA"}
 00405{"flow_id":3,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":85,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":121847,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoCqZAAEAGfHYKCAABQERpZ6GGAbuTEbVlbO5KnFAQOQgf1QAA"}
 00715{"flow_id":3,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":86,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":121998,"pkt_caplen":281,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":281,"pkt_l4_len":247,"pkt":"ABoRAAACABoRAAABCABFAAELCqdAAEAGe5IKCAABQERpZ6GGAbuTEbVlbO5KnFAYOQgw\/QAAFgMBAN4BAADaAwNWGmYE7RhsRONG\/m1MT5VVrdjnvzP1znNlFG2+WauU5SCiEgrZvpHjzJYNIqBz8GV5Z5nEiB2\/9li16SQKz1NTSAA4zBTME8wVwBTACgA5ADgANcASwAgAFgATAArAL8ArwBPACQCiAJ4AMwAyAJwAL8ARwAcABQAEAP8BAABZAAAAFQATAAAQcmFkY29tLndlYmV4LmNvbQALAAIBAAAKAAgABgAZABgAFwAjAAAADQAiACAGAQYCBgMFAQUCBQMEAQQCBAMDAQMCAwMCAQICAgMBATN0AAA="}
-00754{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":86,"source":"webex.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_first_seen":1444570628113,"flow_last_seen":1444570628121,"flow_tot_l4_data_len":327,"flow_min_l4_data_len":20,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":81,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41350,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00765{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":86,"source":"webex.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_first_seen":1444570628113,"flow_last_seen":1444570628121,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":227,"flow_tot_l4_payload_len":227,"flow_avg_l4_payload_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41350,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00407{"flow_id":3,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":87,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":122193,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoATdAABAGteVARGlnCggAAQG7oYZs7kqckxG2SFAQ\/\/9X+gAA"}
 00405{"flow_id":4,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":88,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":122373,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoSv1AAEAGPB8KCAABQERpZ6GHAbtcKPU+o9cKw1AQOQgf1AAA"}
 00713{"flow_id":4,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":89,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":122668,"pkt_caplen":281,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":281,"pkt_l4_len":247,"pkt":"ABoRAAACABoRAAABCABFAAELSv5AAEAGOzsKCAABQERpZ6GHAbtcKPU+o9cKw1AYOQiciAAAFgMBAN4BAADaAwNWGmYEkvVIckj2nKXTHHhTgHLpDPs+ur2PFRE7SXTT+yCiEgrZvpHjzJYNIqBz8GV5Z5nEiB2\/9li16SQKz1NTSAA4zBTME8wVwBTACgA5ADgANcASwAgAFgATAArAL8ArwBPACQCiAJ4AMwAyAJwAL8ARwAcABQAEAP8BAABZAAAAFQATAAAQcmFkY29tLndlYmV4LmNvbQALAAIBAAAKAAgABgAZABgAFwAjAAAADQAiACAGAQYCBgMFAQUCBQMEAQQCBAMDAQMCAwMCAQICAgMBATN0AAA="}
-00754{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":89,"source":"webex.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":4,"flow_first_seen":1444570628117,"flow_last_seen":1444570628122,"flow_tot_l4_data_len":327,"flow_min_l4_data_len":20,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":81,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41351,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00765{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":89,"source":"webex.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":4,"flow_first_seen":1444570628117,"flow_last_seen":1444570628122,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":227,"flow_tot_l4_payload_len":227,"flow_avg_l4_payload_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41351,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00407{"flow_id":4,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":90,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":122955,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAThAABAGteRARGlnCggAAQG7oYej1wrDXCj2IVAQ\/\/9X+QAA"}
 02590{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":93,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":336752,"pkt_caplen":1658,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1658,"pkt_l4_len":1624,"pkt":"ABoRAAACABoRAAABCABFAAZsATpAABAGr55ARGlnCggAAQG7oYRPz8d0sDA+E1AY\/\/8oiAAAFwMDBj\/t\/uIrkeQDyGZjWp49yCokUxS9FJHYvfXcMyCQaPOCwkcDNmYuFZEDo\/AwFcNyVv3+05WHJJ9u3TkD2KauF1mgk0jI0of3UmdonsFWv\/JiNqjo4cXOMELy4x6zIJZLEgl3NOVFNEqCscqzuhbFk5Yi7SH091sPTQtHd7s6FBq8krpiCZCl\/bHltNo\/McejeSzraT9Jdz4cVrWOscxkLMvgMOCMEDi81Db80tJQoclIrfd9nyZN6s39OPaFfyWF\/N29yGtgdBQ0P6s0OuWMX6mu1EwOdwewMYStj3alPG89DAcQ7pvpiLESJW606r2uBDDWRUzcIygOAHa7\/MsD3sgMC4S2P+3A3XViDy40J8hZOleTUyyqOihy5uYucGtJvSJLcg4AOsMGXdsFOhyH\/02P3p6CMG1HuvLQDeGsoN4iYM47oyimizjecSAu1zJ7S0WBOmXbIAx3YDAAU9t22W\/54Fy5\/6CVu5HdBOdrmkrT3B1u\/\/deLHjqKPsJAl3fMe5XYOHmcga74KWvBl7iu759RuqGgFotJ81LhBPb71\/HOczfP5P8yosT5\/4l4IEnT6PKQjBiTAH+WAuEyWFMQyQA6GbwQ9oiJPujo5FGxZHQ2F6d35PjU+eD3vRwzl7+Wl5S0CPYhthTL30CgvX+hyQTb9EGTxGDn8eCdFlSKuNxNv+ulNNTwPQuoAGbtDCKEkrywvByIe3nErJf\/OSUKWT5zYRHcrJcdpVgtaacoCfYpJ4nYbRk1bWib4OBnnkkQyA6Q0WNg43VYIvxKHe45Th++Pn4qQlvN3mxpCQsAWTbYduEIgpcn2sWCa\/mUml\/m1ipOTNnbb162x2drd0lgBlC9v7feYgXAAcXLdB1AqgN7RCjNbOGBxHWtJpJvfVt+NZ8v56\/Ge9typCQPDrJl2\/b+jW+1i6iAChxn9R5t7eMNvRzQLirxssPTrkjLbnH9OVjWuv4GqCHrIaAON2I21f4jzCKSzc3nL14ZdfYx0svKweCv2B9Jok9xI64Iyd5JYgspuUyVRncg97uHQGBWi5+JRYxSppCt4t\/Stq5NgT\/0FQ0Ld19sE2VFjI6UMEopSEdYMJ41x+NoolbUndl7jwz9qtswoz8aloXgmG27DB9o3p3s6UdzBHtQwNp7fbNnJ9V7yAWZ3yz7dW8zSfb1YG\/eOCjMr1eGYo5YbbX2CLEvfDgkDf8S52R1ru0MDzSgRMMn3sedzpumMJYC6333Gn7iBWavTTHRsp+cY+3zHCuNTDuzSjT6jPVIhJy12peZFyPBOr1OVhYWEmD2k2xydOxdAznhyb7UOHXpSPY5Z0XY9U2P7lGPYE7iuEUR8op1K4882hvk0M4oE\/Gz5\/icSXEHgP8XbYVo9pDXtnQNbhmYqKPMkLjH8mNwUX5KFnCAVB6yb\/HcPF5VGqxI7UkQQFQr\/LiC35GAgRfd44EX5DG1\/3cYH27HOdNpExm93tlCclYm8UosyEATMOoN1HxGvUEWLAp+oKsPvzNgl8Pe\/xQkizA3CGOgaF8X0ld6dLdrCS40sZWUOXqLY9SNGWldNRRpMPGVefAbzNHLDZ+aj40zBYIijFDVniRi4G5KjdNarxznoNu8j7zM\/RFTHDAh824OKoihYBZEHNKxws8sznsYoEnwP0NMajIFLdibzlcElYboV0McwtqEFlYOHl2B2Yq8ffshJENkwKQlKcZ7KBa5cxjQr1FdoAObKAS2R5bYvqtU7oRAzqzTTWMyprI+6FlMqvAqv0ZXSA7AaHl5PcP5EUTMlDDIKp9fTrAzIVAD2G1NhaFtcxHdR5bP2fGPkJ8qc4IPoVPmHQ81o9ulM2YIIJqUenEIGiXX50pa6C4rFhu4ZrOWr+pJhQOi9EaXuH7ejRC8KkXqKY\/jVgnIu6lm1+kqD+dKO1BvzMAQL4bgaZx3A6hx\/Y3kuas7jn1d5dQkAUWK31l5XEJKs6YLJTOk8EueBKJf4WUM5M\/2R2JlGSm4hZ7xV89TvlYctx7+VeVBr\/cQPGqi07EYebk5WrhvXxzQ+R5ZZ9OJBVWFRUu9vc88B8wWcsODvu\/x7BEf7gHu8u6Mk1VmXxoDBe3sfbyXVkllkEkjWZ1t\/I96pKvryzYOp2+vwdvch9tE+WL6YA="}
 01140{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":96,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":388122,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"ABoRAAACABoRAAABCABFAAJAhnpAAEAG\/okKCAABQERpZ6GEAbuwMD4TT8\/NuFAQROwsYAAAFwMDA9T6+I822bcSE7LxlTUXSyoNCwtzH4RJSxf9333iQ\/XdBP07ym8b3A\/XVliHymMtZ\/OMaR2i40GdTUtEso5w+jXJ1bvU2e5foeo7BUfcqd1l3eHeZdMykJqIwZL6fRFExjyO5Tb9D4BKywmMBt2fDbTf6LPbrhpUIcmbnPGe7m\/o\/v74JuCWNSX6uweF1M+rt7PezIxzpY5zNIl3PuQJxwS8GNN3Grr8FtcanBZuLBRrRvThrYdWZjpaC4DeMnmPLR8t6nhljRnGUxcUP1KsOho3deuVPDOiZz01zYn4Tq7OpT0CKEEiZHR68dLdoSbXO\/itXzhuT5t8NZnuD7pzPaGFCz8FtqAlK92G\/iII8JRFJuZXrwEUFllzsDWcXvWcu976PKrjGJo+dP41Psy93ULHV28gwgRMGps1cWcXOpTLudobpW2EYTmIFvnMzXaMBdMPjZjjHPRBbJlHGGKZmwZwYlpS2i94mg4NH1G+\/LIhqsRclU88sfVkh2wijO6HbnuDHar5GjtL8sRsdRoTjl8+5KG\/1xKz3pMMRyg0qSGAJynHH+wQ8BFTH7QVLS1CHpDQbNHPgHzMt4wCcLt74bANBJEy+t7wt0zm0cY2Ix9Tvuli\/GYGCPS52OA2phRiDPbzhYH406S5cr7uHu6FSA+vWpiVCEvowiD0nUs4YqVUABVdkP\/1J\/Z7QKEQo5YhZD\/sT6U="}
 00537{"flow_id":3,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":104,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":514304,"pkt_caplen":146,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":146,"pkt_l4_len":112,"pkt":"ABoRAAACABoRAAABCABFAACEAUBAABAGtYBARGlnCggAAQG7oYZs7kqckxG2SFAY\/\/+ufAAAFgMDAFECAABNAwNWGmYKL2EFknJPvXFykCSHotly4la6oG496nIi7KRcKSCiEgrZvpHjzJYNIqBz8GV5Z5nEiB2\/9li16SQKz1NTSAAEAAAF\/wEAAQAUAwMAAQE="}
-00796{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":104,"source":"webex.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":6,"flow_first_seen":1444570628113,"flow_last_seen":1444570628514,"flow_tot_l4_data_len":459,"flow_min_l4_data_len":20,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41350,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"c253ec3ad88e42f8da4032682892f9a0","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
+00807{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":104,"source":"webex.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":6,"flow_first_seen":1444570628113,"flow_last_seen":1444570628514,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":227,"flow_tot_l4_payload_len":319,"flow_avg_l4_payload_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41350,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"c253ec3ad88e42f8da4032682892f9a0","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
 00406{"flow_id":3,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":105,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":564894,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoCqhAAEAGfHQKCAABQERpZ6GGAbuTEbZIbO5K+FAQOQgelgAA"}
 00585{"flow_id":4,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":106,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":565912,"pkt_caplen":183,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":183,"pkt_l4_len":149,"pkt":"ABoRAAACABoRAAABCABFAACpAUFAABAGtVpARGlnCggAAQG7oYej1wrDXCj2IVAY\/\/9V4wAAFgMDAFECAABNAwNWGmYKzk9E9QTUrFeH5Hw2eqdwlTnoxi20+pBaUP1saiCiEgrZvpHjzJYNIqBz8GV5Z5nEiB2\/9li16SQKz1NTSAAEAAAF\/wEAAQAUAwMAAQEWAwMAIFcfE72a+QYqy4KnB7ssdgEQPAH15UqMjQbvXvYfEwJV"}
-00796{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":106,"source":"webex.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":6,"flow_first_seen":1444570628117,"flow_last_seen":1444570628565,"flow_tot_l4_data_len":496,"flow_min_l4_data_len":20,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":82,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41351,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"c253ec3ad88e42f8da4032682892f9a0","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
+00807{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":106,"source":"webex.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":6,"flow_first_seen":1444570628117,"flow_last_seen":1444570628565,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":227,"flow_tot_l4_payload_len":356,"flow_avg_l4_payload_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41351,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"radcom.webex.com","ja3":"f9010d8c34749bdf7659b52227e6f91b","ja3s":"c253ec3ad88e42f8da4032682892f9a0","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
 00460{"flow_id":3,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":107,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":566905,"pkt_caplen":91,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":91,"pkt_l4_len":57,"pkt":"ABoRAAACABoRAAABCABFAABNAUJAABAGtbVARGlnCggAAQG7oYZs7kr4kxG2SFAY\/\/+PgAAAFgMDACAy73ppu2XOX3ICuy8hyAfMVby0BzvjSQkSvagk3Ak6Dg=="}
 00406{"flow_id":4,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":108,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":567184,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoSv9AAEAGPB0KCAABQERpZ6GHAbtcKPYho9cLRFAQPLgawAAA"}
 00406{"flow_id":3,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":109,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":567464,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoCqlAAEAGfHMKCAABQERpZ6GGAbuTEbZIbO5LHVAQOQgecQAA"}
@@ -61,38 +61,38 @@
 00408{"flow_id":4,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":111,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":568372,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAUNAABAGtdlARGlnCggAAQG7oYej1wtEXCj2TFAQ\/\/9XTQAA"}
 00467{"flow_id":3,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":112,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":618984,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":97,"pkt_l4_len":63,"pkt":"ABoRAAACABoRAAABCABFAABTCqpAAEAGfEcKCAABQERpZ6GGAbuTEbZIbO5LHVAYOQhTdwAAFAMDAAEBFgMDACDsrVn+klk2PAbR1UMB7W8XzTSyzCFQLnlG0me9k09RdA=="}
 00409{"flow_id":3,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":113,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570628,"pkt_ts_usec":619392,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAURAABAGtdhARGlnCggAAQG7oYZs7ksdkxG2c1AQ\/\/9XTgAA"}
-00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":167,"source":"webex.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1444570630272,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"185.63.147.10","src_port":54651,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":167,"source":"webex.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1444570630272,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"185.63.147.10","src_port":54651,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00422{"flow_id":5,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":167,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570630,"pkt_ts_usec":272557,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABoRAAACABoRAAABCABFAAA0ymtAAEAGS1oKhc4vuT+TCtV7Abs2TX647AAfvYARAZp5QwAAAQEICgBMwJ1XHSbf"}
 00409{"flow_id":5,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":168,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570630,"pkt_ts_usec":272755,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAWBAABAGRHK5P5MKCoXOLwG71XvsAB+9Nk1+uVAQ\/\/\/y2gAA"}
 00409{"flow_id":5,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":169,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570630,"pkt_ts_usec":272893,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAWFAABAGRHG5P5MKCoXOLwG71XvsAB+9Nk1+uVAR\/\/\/y2QAA"}
-00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":175,"source":"webex.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1444570631058,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"107.20.242.44","src_port":59447,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":175,"source":"webex.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1444570631058,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"107.20.242.44","src_port":59447,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00421{"flow_id":6,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":175,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570631,"pkt_ts_usec":58632,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABoRAAACABoRAAABCABFAAA0G+BAAEAG6O4Khc4vaxTyLOg3Abv3v7ExKrw8QIARAiEILgAAAQEICgBMwOxXHSRB"}
 00409{"flow_id":6,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":176,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570631,"pkt_ts_usec":58850,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAWRAABAGM3drFPIsCoXOLwG76DcqvDxA97+xMlAQ\/\/9\/\/QAA"}
 00409{"flow_id":6,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":177,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570631,"pkt_ts_usec":59010,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAWVAABAGM3ZrFPIsCoXOLwG76DcqvDxA97+xMlAR\/\/9\/\/AAA"}
-00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":178,"source":"webex.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1444570631722,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41354,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":178,"source":"webex.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1444570631722,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41354,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00434{"flow_id":7,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":178,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570631,"pkt_ts_usec":722722,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA87rhAAEAGmE8KCAABQERpZ6GKAbt6Ji+WAAAAAKACOQhMyAAAAgQFtAQCCAoATMEuAAAAAAEDAwY="}
 00408{"flow_id":7,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":179,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570631,"pkt_ts_usec":726320,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAWZAABAGtbZARGlnCggAAQG7oYqF2dBpeiYvl1AS\/\/9Y2AAA"}
 00406{"flow_id":7,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":180,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570631,"pkt_ts_usec":726629,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo7rlAAEAGmGIKCAABQERpZ6GKAbt6Ji+XhdnQalAQOQgf0QAA"}
 00492{"flow_id":7,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":181,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570631,"pkt_ts_usec":731449,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABn7rpAAEAGmCIKCAABQERpZ6GKAbt6Ji+XhdnQalAYOQgODwAAFgMBADoBAAA2AwHgmz2uanfCUjnykbM2Mv9FAODhfxJmAjR5YaebpjX1JgAABAA1AP8BAAAJACMAAAAPAAEB"}
-00730{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":181,"source":"webex.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":4,"flow_first_seen":1444570631722,"flow_last_seen":1444570631731,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41354,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00740{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":181,"source":"webex.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":4,"flow_first_seen":1444570631722,"flow_last_seen":1444570631731,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41354,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00408{"flow_id":7,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":182,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570631,"pkt_ts_usec":731733,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAWdAABAGtbVARGlnCggAAQG7oYqF2dBqeiYv1lAQ\/\/9YmgAA"}
 02247{"flow_id":7,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":183,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":200990,"pkt_caplen":1414,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1414,"pkt_l4_len":1380,"pkt":"ABoRAAACABoRAAABCABFAAV4AWhAABAGsGRARGlnCggAAQG7oYqF2dBqeiYv1lAY\/\/+6OgAAFgMBD14CAABNAwFWGmYNJvrCeyqJ+yGixMjFkysXvSP42V4YBYxn0xf6yiDu5C+q5u2enqRZq+rKCDeYalzIW6XI487FIwumfVZTSAA1AAAF\/wEAAQALAA8FAA8CAATpMIIE5TCCA82gAwIBAgIQKXSJqdQeSb5h94FpRuYh8zANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MB4XDTE1MDQxMDAwMDAwMFoXDTE4MDQxMDIzNTk1OVowdzELMAkGA1UEBhMCdXMxEzARBgNVBAgMCkNhbGlmb3JuaWExETAPBgNVBAcMCFNhbiBKb3NlMRwwGgYDVQQKDBNDaXNjbyBTeXN0ZW1zLCBJbmMuMQwwCgYDVQQLDANDU0cxFDASBgNVBAMMCyoud2ViZXguY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnXjIYUvDCGFnLF6CX7BhvJlmnmrg0KiZFcDP6TyJs2s+n7Hjqpb8O374x26knzLrTkrkpNBVvbi6eY8X6lmrWlqvlgEoyMmslNbZoAjUy1C9HNIMI2F1bLGI\/pKRUGbpk5wvAv6SKOf+cKi3mis7U2sccUb8cFxKTVpp62iK2uOzkFa4zF1i4hm\/NKjJWJVuj\/D8tQpd0PSuU5wWY7G1x\/5UpvvDV7KS7Tsmn3ib\/8gstBL+PLvKZHJ8YWc8u02oGZQoWD64APslwdmLLyDqq5USERl2bc761RHbBhnmKf3IpyvGqgfCFbQ7hfb+sniY0O+KQiBpaJI1bt4iiHQ1YQIDAQABo4IBZDCCAWAwFgYDVR0RBA8wDYILKi53ZWJleC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGUGA1UdIAReMFwwWgYKYIZIAYb4RQEHNjBMMCMGCCsGAQUFBwIBFhdodHRwczovL2Quc3ltY2IuY29tL2NwczAlBggrBgEFBQcCAjAZGhdodHRwczovL2Quc3ltY2IuY29tL3JwYTAfBgNVHSMEGDAWgBRfYM9hkFXfhEMUimAqsvV69EMY7zArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNybDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zcy5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9zcy5zeW1jYi5jb20vc3MuY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAU0XVgHR8KQTLFFzVVA7s1Rlqj4+dm5q+OB5OfJMqYeX\/hnGHVeD8z9\/9EdKsauBRbbFpJk38PC3aGoy0iL9v8CA4V6o0qYzEfedbF\/p\/UuvtChO8CktAaqN64hPdToCJEy3gqyB\/Hv7VVuKXUBogujzn1WBdIyBUlO\/hClSnOD8Qq1So\/AzCrw+\/ChOOV7DI631hsLE1M73UmQqxi7Cbu5R5TsXH6v6s\/7CAPBhVtuxTBBcBuPtA6Pd2Q8vOf6ByuErVmWAV\/tOLfjGuqPuM2JoxzR1iH82zcoIcxOzmtUIYsiTuUSCi\/AsNsm265BOW9oeh5kgZU+pE6LkGX9bECAAU8MIIFOA=="}
 00407{"flow_id":7,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":184,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":251291,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo7rtAAEAGmGAKCAABQERpZ6GKAbt6Ji\/WhdnVulAQP8ATigAA"}
 03883{"flow_id":7,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":185,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":251919,"pkt_caplen":2633,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2633,"pkt_l4_len":2599,"pkt":"ABoRAAACABoRAAABCABFAAo7AWlAABAGq6BARGlnCggAAQG7oYqF2dW6eiYv1lAY\/\/\/KqQAAMIIEIKADAgECAhBRP7l0OHC3NEBBjTCTBpn\/MA0GCSqGSIb3DQEBCwUAMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA2IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHNTAeFw0xMzEwMzEwMDAwMDBaFw0yMzEwMzAyMzU5NTlaMH4xCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEvMC0GA1UEAxMmU3ltYW50ZWMgQ2xhc3MgMyBTZWN1cmUgU2VydmVyIENBIC0gRzQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCy2AXKHHQttRdWOcVKUgmW6EvYDPFon5pCKGLDpTBTflURglsDeg0v4XkEybSWdxmBAZRZ+bz3epkngi23g91aJ3+yA3qcUyXpSB9GT8idKfi+eVb29\/3ZOmjai0uCM0ESw8g8zNaWeoQhGiIEAycXixxoYZMPDlGAMx20tc7rftBirO6zewF072k168rVPanul5jKjapEDiWZShWWpM5tAlQfKmom4gY6Y0istEzRdZNQ\/xMv1trhxhj1n8klXfMAOt4mTbQpCc0PPSNvFkqBFvvygxDDuNbYVTI98b0PvYxSlUoWl3pSIWN1Lxb5xGa+9bUJ2P8nAM1EfG9LP7D3AgMBAAGjggFjMIIBXzASBgNVHRMBAf8ECDAGAQH\/AgEAMDAGA1UdHwQpMCcwJaAjoCGGH2h0dHA6Ly9zMS5zeW1jYi5jb20vcGNhMy1nNS5jcmwwDgYDVR0PAQH\/BAQDAgEGMC8GCCsGAQUFBwEBBCMwITAfBggrBgEFBQcwAYYTaHR0cDovL3MyLnN5bWNiLmNvbTBrBgNVHSAEZDBiMGAGCmCGSAGG+EUBBzYwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM0MB0GA1UdDgQWBBRfYM9hkFXfhEMUimAqsvV69EMY7zAfBgNVHSMEGDAWgBR\/02Wnwt3su\/AwCfNDOfoCrzMxMzANBgkqhkiG9w0BAQsFAAOCAQEAXpRWSd2OLWX1wTZRtgPj2p5zGfIfWatYfmwmBSz6gddcIxciLDeT94bsheawo\/0f4jKoRW\/h2fu5r9JwoDJCZb+E\/hYqjz\/Fptajk31D6XQhkTUo9GPpLu339Vx\/S5q1IOkKveBFEAwUlJpdpeNLkegkm0ZAZfQics2Z+IgR9fN\/5jOC5qjFfv7QCOIlWAhxaObNouYU3k5SJC395XkTU+deLy1NG21AFVIr94eJeBKBbtlNqi141MIsPQhfh5GeHw6w3jBSZIaJqp1mnA52DIDydNgq+Lg6ztfWDxG+a6sU9b1BoCJjifG6D28pY2YtP6yMcsX7x+TUD\/I7T4wpxwAE1DCCBNAwggQ5oAMCAQICECUM6OAwYS6fK4n3BU18+P0wDQYJKoZIhvcNAQEFBQAwXzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA2MTEwODAwMDAwMFoXDTIxMTEwNzIzNTk1OVowgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAryQICCl6NZ5gDKrnSztO3Hy8PEUcuyvg\/ikC+VcIo2SFFSf18a3IMYldIugqqqZCs4\/4uVW3sbdLs\/6PfgdX7O9D22ZiFWHPYA2k2N744MNiCD1UE+tJyllUhSblK48bn+v1oZHCM0nYQ2NqUkvSj+hwUU3RiWl7x3D2s9wSdNt7XUtW05a\/FXehsPSiJfKvHJJnGOX0BgTvkLnkAOTdOrUZ\/wK69Dzu4IvrN4vs9Nes8vbwPa\/ddZEzGR0cQMt0JBkhk9kU\/qwqUseP1QRJ5I1jR4g8aYPL\/ke9K35PxZWuDp3U0UPAZ3PjFAh+5T+fc7gzCs9dPzSHloruU+glFQIDAQABo4IBmzCCAZcwDwYDVR0TAQH\/BAUwAwEB\/zAxBgNVHR8EKjAoMCagJKAihiBodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9wY2EzLmNybDAOBgNVHQ8BAf8EBAMCAQYwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9jcHMwHQYDVR0OBBYEFH\/TZafC3ey78DAJ80M5+gKvMzEzMG0GCCsGAQUFBwEMBGEwX6FdoFswWTBXMFUWCWltYWdlL2dpZjAhMB8wBwYFKw4DAhoEFI\/l0xqGrI2Oa8PPgGrUSBgsexkuMCUWI2h0dHA6Ly9sb2dvLnZlcmlzaWduLmNvbS92c2xvZ28uZ2lmMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AudmVyaXNpZ24uY29tMD4GA1UdJQQ3MDUGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCWCGSAGG+EIEAQYKYIZIAYb4RQEIATANBgkqhkiG9w0BAQUFAAOBgQATAt346IYA8lr4+CAMWYhiB87O9075u1mhmOXhON1OvGYY063rGPINyW0+SpQgwzy6vWVUxq9EsxCtLGs+q9cHtriBY8X5Xi7lKmfOzTMMKteJVgMjH7O+6DoIWbTsRTX3ilv\/Zs9Qr8ZtV40ZeLe5otFX6h+aS6+6yY4Sfsa9\/w4AAAA="}
-01110{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":185,"source":"webex.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":8,"flow_first_seen":1444570631722,"flow_last_seen":1444570632251,"flow_tot_l4_data_len":4182,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2599,"flow_avg_l4_data_len":522,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41354,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01121{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":185,"source":"webex.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":8,"flow_first_seen":1444570631722,"flow_last_seen":1444570632251,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2579,"flow_tot_l4_payload_len":4002,"flow_avg_l4_payload_len":500,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41354,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00407{"flow_id":7,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":186,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":302950,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo7rxAAEAGmF8KCAABQERpZ6GKAbt6Ji\/WhdnfzVAQUJj4ngAA"}
 00857{"flow_id":7,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":187,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":303117,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFu7r1AAEAGlxgKCAABQERpZ6GKAbt6Ji\/WhdnfzVAYUJjVPwAAFgMBAQYQAAECAQBzrrtuF9+KR1wUqM\/\/NKdN8XLh8LQAufDmYdAQr2kRZIkBiYk\/hpbt+Iw+GTsKw0MtqYlnE6k0JY9H5kPH6+3OvBZdfDr2Wzdb\/rVXoop9XeS3qxcoMcCtEPmKSw1YTu4ogI6viS3URet+1rFfs1NFOGBBeILYBuPxbyD0gsT6KS\/UiR0jsVBU2CV4D6dE771y9w173iAG+kgV+8uCpersHqxTFvH7nQS0EVVu6lAmO9h2KB+zo7A2OHw+3G5t5Bzfsbiv4mjcPd\/6\/jR7clclPVs0yNFWcHNf2oGZqRyddUHOhRIOGuMrPkMyBuqiDtCyTpZqh9l+796Gg1qXVIeKFAMBAAEBFgMBADBnxM9xD\/Xbyw5+1ZQ\/sLmg5Xk56Qv2zLjGfmg8K7fxP6VW2XGTw5fhz9YGWv\/TttY="}
 00410{"flow_id":7,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":188,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":303284,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAWpAABAGtbJARGlnCggAAQG7oYqF2d\/NeiYxHFAQ\/\/9H8QAA"}
-00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":189,"source":"webex.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1444570632436,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"23.44.253.243","src_port":49048,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":189,"source":"webex.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1444570632436,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"23.44.253.243","src_port":49048,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":8,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":189,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":436109,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8E6FAAEAGB\/MKCAABFyz987+YAbs3etLXAAAAAKACOQhiaAAAAgQFtAQCCAoATMF2AAAAAAEDAwY="}
 00409{"flow_id":8,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":190,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":439585,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAWtAABAGSj0XLP3zCggAAQG7v5jIhS0oN3rS2FAS\/\/\/PVQAA"}
 00406{"flow_id":8,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":191,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":470387,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoE6JAAEAGCAYKCAABFyz987+YAbs3etLYyIUtKVAQOQiWTgAA"}
 00492{"flow_id":8,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":192,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":470550,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnE6NAAEAGB8YKCAABFyz987+YAbs3etLYyIUtKVAYOQiFHgAAFgMBADoBAAA2AwGEmq+NZP+kc3ErHq1IRgxSv+RZnIPy+ZyIImU+XVBptwAABAA1AP8BAAAJACMAAAAPAAEB"}
-00717{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":192,"source":"webex.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":4,"flow_first_seen":1444570632436,"flow_last_seen":1444570632470,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"23.44.253.243","src_port":49048,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00727{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":192,"source":"webex.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":4,"flow_first_seen":1444570632436,"flow_last_seen":1444570632470,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"23.44.253.243","src_port":49048,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":8,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":193,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":470778,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAWxAABAGSjwXLP3zCggAAQG7v5jIhS0pN3rTF1AQ\/\/\/PFwAA"}
 00493{"flow_id":7,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":194,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":541070,"pkt_caplen":113,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":113,"pkt_l4_len":79,"pkt":"ABoRAAACABoRAAABCABFAABjAW1AABAGtXRARGlnCggAAQG7oYqF2d\/NeiYxHFAY\/\/92owAAFAMBAAEBFgMBADD9PmnvW3yJRGDCtXk88uGURezbwFFzyI2PxxOI3cMS57iKf8\/Uw3einH9SeqEXnkY="}
 04305{"flow_id":8,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":195,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":591660,"pkt_caplen":2957,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2957,"pkt_l4_len":2923,"pkt":"ABoRAAACABoRAAABCABFAAt\/AW5AABAGPuMXLP3zCggAAQG7v5jIhS0pN3rTF1AY\/\/8vQwAAFgMBADUCAAAxAwFWGmYO1rhEh3sKERRiLa6er7WS4Mc5yLLjZ\/vDnTpgjAAANQAACf8BAAEAACMAABYDAQsPCwALCwALCAAHJTCCByEwggYJoAMCAQICAwMLXjANBgkqhkiG9w0BAQUFADBAMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOR2VvVHJ1c3QsIEluYy4xGDAWBgNVBAMTD0dlb1RydXN0IFNTTCBDQTAeFw0xNDEyMTgwODI3NTlaFw0xNjAyMTkyMTMyMDZaMIGdMSkwJwYDVQQFEyA1MjhwYWlFTHVjZEpwRWtPanNxSDIzakJDREVvbVEzejELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExETAPBgNVBAcTCFNhbiBKb3NlMRYwFAYDVQQKEw1DaXNjbyBTeXN0ZW1zMQswCQYDVQQLEwJJVDEWMBQGA1UEAxMNd3d3LndlYmV4LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOBsgr08pWRdeldXJQh9ZVWm9nEGfXfgFv7SFWzq8rI+qi4OhNYD0cEyN04QMR15qcWRV6c2PFRpC8IEABY40l4ktzNkaSY2HcFNODzwxJ6O3kvYpx7G5niqPfMhDu6kdAVeIt4YDgYwygfMomu\/sRD32stB0z39Do7CqRCo16k8Pli9rjjhhm4nUy5KGCGQg2uPC8pEHfWBoqIU0xycUWnkpXXq3g+RDZpClE7YQWk1QQ7+En0FD0xicbTUHJl55mF0slM3Rh1+SuTWSoQQnQ\/+uPzY0nIjO2fGxXGbTzZkaCeIZreyw7A\/i6bPmJ7pSHACf2MovqwssuYVqn7kcaMCAwEAAaOCA8QwggPAMB8GA1UdIwQYMBaAFEJ5VBthzVUrPmPVPEhX9Z\/7Rc5KMA4GA1UdDwEB\/wQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwggJBBgNVHREEggI4MIICNIIQd3d3LndlYmV4LmNvbS5hdYIMd3d3LndlYmV4LmNhggx3d3cud2ViZXguZGWCEHd3dy53ZWJleC5jb20uaGuCD3d3dy53ZWJleC5jby5pboIPd3d3LndlYmV4LmNvLml0gg93d3cud2ViZXguY28uanCCEHd3dy53ZWJleC5jb20ubXiCD3d3dy53ZWJleC5jby51a4ILbS53ZWJleC5jb22CEHNpZ251cC53ZWJleC5jb22CEnNpZ251cC53ZWJleC5jby51a4IPc2lnbnVwLndlYmV4LmRlghFteXRyaWFsLndlYmV4LmNvbYIUbXl0cmlhbC53ZWJleC5jb20ubXiCE215dHJpYWwud2ViZXguY28uaW6CFG15dHJpYWwud2ViZXguY29tLmF1ghNteXRyaWFsLndlYmV4LmNvLmpwghFzdXBwb3J0LndlYmV4LmNvbYIQaG93ZG9pLndlYmV4LmNvbYIMa2Iud2ViZXguY29tghVteXJlc291cmNlcy53ZWJleC5jb22CEmludm9pY2VzLndlYmV4LmNvbYINdHJ5LndlYmV4LmNvbYITYnV5b25saW5lLndlYmV4LmNvbYISYnV5b25saW5lLndlYmV4LmRlghVidXlvbmxpbmUud2ViZXguY28udWuCEXRlbXBib2wud2ViZXguY29tghV0ZW1wc3VwcG9ydC53ZWJleC5jb22CDXd3dy53ZWJleC5jb22CCXdlYmV4LmNvbTA9BgNVHR8ENjA0MDKgMKAuhixodHRwOi8vZ3Rzc2wtY3JsLmdlb3RydXN0LmNvbS9jcmxzL2d0c3NsLmNybDAdBgNVHQ4EFgQUrzja2z769pN9I4b3r3d3lm17XYIwDAYDVR0TAQH\/BAIwADBvBggrBgEFBQcBAQRjMGEwKgYIKwYBBQUHMAGGHmh0dHA6Ly9ndHNzbC1vY3NwLmdlb3RydXN0LmNvbTAzBggrBgEFBQcwAoYnaHR0cDovL2d0c3NsLWFpYS5nZW90cnVzdC5jb20vZ3Rzc2wuY3J0MEwGA1UdIARFMEMwQQYKYIZIAYb4RQEHNjAzMDEGCCsGAQUFBwIBFiVodHRwOi8vd3d3Lmdlb3RydXN0LmNvbS9yZXNvdXJjZXMvY3BzMA0GCSqGSIb3DQEBBQUAA4IBAQAvuebUSYomJeazjVaUuaZEOu1eiO9NXlT0gAXaY+nBn9NplhbsHxSHjGcVFhTOlfQJQ7O2PIsniGT8njs\/8EOgAHMOQu7d0YAdoxHCL3Sm9N66NMEpVV2G4WgXygLs4kJh+yUBb1kIku9DiG38AU+r+99Jkqmyn3tMOTCvETWEYkl+blYjS5l0FssSr6KQmrm1sClsOKID4cShgc9IV3B50cL0ujDIZCufuPZyI0qR+lnHIN3+rLqfP\/7mDXbNVamMD49\/DJf7eLfwCr37T4WHDGz9KbKKastRcnHmH2Q518aObG0TJ\/l3+UreTIcQ2rThuXKkjXwSVbbpdWwNMHuUAAPdMIID2TCCAsGgAwIBAgIDAjbQMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTAwMjE5MjIzOTI2WhcNMjAwMjE4MjIzOTI2WjBAMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOR2VvVHJ1c3QsIEluYy4xGDAWBgNVBAMTD0dlb1RydXN0IFNTTCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJCzgMHk5UatcGA9uuUU3Z6KXot1WubKbUGlI+g5hSZ6p1V3mkihkn46HhrxJ6ujTDnMyz1Hr4GuFmpcN+9FQf37mpc8oEOdxt8XIdGKolbCA0mEEoE+yQpUYGa5jFTk+eb5lPHgX3UR8im55IaisYmtph6DKWOy8FQchQt65+EuDa+kvc3nsVrXjAVaDktzKIt1XTTYdwvhdGLicTBi2LyKBeUxY0pUiWozeKdOVSQdl+8a5BLGDzAYtDRN4dgjOyFbLTAZJQ5096QhS6CkIMlszZhWwPKoXz4mdaAN+DaIiixafWcwqQ\/RmXAueOFRJq9VeiS+jDkNd53eAsMMvR8CAwEAAaOB2TCB1jAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFEJ5VBthzVUrPmPVPEhX9Z\/7Rc5KMB8GA1UdIwQYMBaAFMB6mGiNifurBWQMEX2qfWW4ysxOMBIGA1UdEwEB\/wQIMAYBAf8CAQAwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5nZW90cnVzdC5jb20vY3Jscy9ndGdsb2JhbC5jcmwwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5nZW90cnVzdC5jb20wDQYJKoZIhvcNAQEFBQADggEBANTvU4ToGr2hiwTAqfVfoRB4RV2yV2pOJMtlTjGXkZrUJPjiJ2ZwMZzBYlQG55cdOprApClICq8kx6jEmlTBfEx4TCtoLF0XplR4TEbigMMfOHES0tdT41SFULgCy+5jOvhWiU1Vuy7AyBh3hjELC3DwfjWDpCoTZFZnNF0WX3OsewYk2k9QbSqr0E1TQcKOu3EDSSmGGM8hQkx0YlEVxW+o78Qn5Rsz3VqI138S0adhJR\/V4NwdzxoQ2KDLX4z6DOW\/cf\/lXUQdpj6HR\/oaToODEj+IZpWYeZqF6wJHzSXj8gYETpnKXKBuervdo5AaRTPvvz7SBMS24CqFZUE+ENQWAwEABA4AAAA="}
-01570{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":195,"source":"webex.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":6,"flow_first_seen":1444570632436,"flow_last_seen":1444570632591,"flow_tot_l4_data_len":3106,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2923,"flow_avg_l4_data_len":517,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"23.44.253.243","src_port":49048,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"www.webex.com.au,www.webex.ca,www.webex.de,www.webex.com.hk,www.webex.co.in,www.webex.co.it,www.webex.co.jp,www.webex.com.mx,www.webex.co.uk,m.webex.com,signup.webex.com,signup.webex.co.uk,signup.webex.de,mytrial.webex.com,mytrial.webex.com.mx,mytrial.webex.co.in,mytrial.webex.com.au,mytrial.webex.co.jp,support.webex.com,howdoi.webex.com,kb.webex.com,myresources.webex.com,invoices.webex.com,try.webex.com,buyonline.webex.com,buyonline.webex.de,buyonline.webex.co.uk,tempbol.webex.com,tempsupport.webex.com,www.webex.com,webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"714ac86d50db68420429ca897688f5f3","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=GeoTrust, Inc., CN=GeoTrust SSL CA","issuerDN":"C=US, ST=California, L=San Jose, O=Cisco Systems, OU=IT, CN=www.webex.com","fingerprint":"EE:CE:24:B7:67:4D:F0:3F:16:80:F8:DC:E3:53:45:5F:3E:41:25:CD"}}
+01581{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":195,"source":"webex.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":6,"flow_first_seen":1444570632436,"flow_last_seen":1444570632591,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2903,"flow_tot_l4_payload_len":2966,"flow_avg_l4_payload_len":494,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"23.44.253.243","src_port":49048,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"www.webex.com.au,www.webex.ca,www.webex.de,www.webex.com.hk,www.webex.co.in,www.webex.co.it,www.webex.co.jp,www.webex.com.mx,www.webex.co.uk,m.webex.com,signup.webex.com,signup.webex.co.uk,signup.webex.de,mytrial.webex.com,mytrial.webex.com.mx,mytrial.webex.co.in,mytrial.webex.com.au,mytrial.webex.co.jp,support.webex.com,howdoi.webex.com,kb.webex.com,myresources.webex.com,invoices.webex.com,try.webex.com,buyonline.webex.com,buyonline.webex.de,buyonline.webex.co.uk,tempbol.webex.com,tempsupport.webex.com,www.webex.com,webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"714ac86d50db68420429ca897688f5f3","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=GeoTrust, Inc., CN=GeoTrust SSL CA","issuerDN":"C=US, ST=California, L=San Jose, O=Cisco Systems, OU=IT, CN=www.webex.com","fingerprint":"EE:CE:24:B7:67:4D:F0:3F:16:80:F8:DC:E3:53:45:5F:3E:41:25:CD"}}
 01136{"flow_id":7,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":196,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":591823,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"ABoRAAACABoRAAABCABFAAJA7r5AAEAGlkUKCAABQERpZ6GKAbt6JjEchdngCFAQUJgT1wAAFwMBACBH\/1+4ssP5+r51KHoVlXmGpHPOXLNFe7ZVKdpfEkx8jxcDAQPghB7AHD4xu8ZetThKlFRnvqmplDEr11sv6gYnz9qjgq3dJjSM7RNpvbBrH0Nzfe67METwiZy0iTxD4QLgGHKmVAaddH6YdM5gElDiZD4SLJFZUuLjAKFacvU115VMsETKBJWkWaUd8sTg8686+hrMEqv1r65DGTFztVOdGNrfhbGwkRrF6j6hEVvedoU88QtrIwx1MobLlb0pj1qo\/Lbq1xUQ9hGY9l8wp4AM\/5KTsAhFGmm+9PSqM5t6J0VghK9SqBIC2PPVZdhjZWVTW\/0ZYb0K2exYkTCPtefugNGyls7zqQMrqi+OMLC+STkfN0Mf23LPHCIEagt6Od\/7TYM6TojeonOEZs5GjNftM4H8mvn0tPEbUUqTl0YhTCRHmnojAWsquYWV0CC3WbslLhBn87PKf1RIjhs6PEKo4TMsRKCEc6YzqyeaQ9x09FzuAosWemPanxyw0HR9fjfQ7L+A3OINGFNvoWE9p+5X5oSI0qCLmoHspcRmVjxM5xDYXze5XoFrJNuM6u3cYQimqJAqNTcVL\/wJh2tIbre42JJ2Rjp79tAaVQbzwrHJHG8pOma7icNf7k\/vOZaOpxo\/2rSuEg4FPyhv\/H8gu+JW8eWZz5hfYjNHYokY\/B3UJaAqnrNSSW9rrha+1xSpOBFUY0w="}
 00409{"flow_id":7,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":197,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":591949,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAW9AABAGta1ARGlnCggAAQG7oYqF2eAIeiYzNFAQ\/\/9FngAA"}
 01079{"flow_id":7,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":198,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":592020,"pkt_caplen":552,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":552,"pkt_l4_len":518,"pkt":"ABoRAAACABoRAAABCABFAAIa7r9AAEAGlmoKCAABQERpZ6GKAbt6JjM0hdngCFAYUJj3gwAAdTTP33MwkthbMd82fpGfgOpHvwaDOGy6Sk\/8Fk5XzjJZGf22ZbFlL3jYmDgAZ4bP3IPBxlr\/NWvNQ06vurmjjtRmSb9upUIgnYaIqqOa3THIU7rQsNMJ22Pmedl4tNLVnrXo1B6knUiXGp3dq7vntLeyIMEuijyYif9cvXdJJruDE9Re+TzlwAOr4qgBTWi18bDyRHzev002AePGC13x4PsucY2Qex1rN9Fc8cYDRYQaep1a3zQBAoaw1OOIqs4ftmq22T0mLwzQviqD1US0Nu7z1iYuOFdPgOA3SbZulf+0VVKqk5r2nBPCfG0ykFYzsc2FsceEm+XmQC5wYc9VL9y0mMwQipbEMvqAOTt2hCZDoGDj2FYOi9zjpyn0JD716pGEMCu30oiNFN8yynqLYWL5ejMB6mizwXoaX1EKQDZf7Y7lTCa4EAdNcgX8nBzKpWk5tzKbCPdWCsxFngzQgCGbDF3iF5r3M+G4M4xMupxMBO3faHFxx4Nai4tQUVusDiVaZ+t\/jBryBJj\/7kkueGKZVC17donrAZspaKCyKhQ2dWqakJiaZjJksazyIb7OJg+c2An+Wj1m4ldythC7QPEkMkCvicpse2E7PhJmlUPqlj33IGckrUPLVZxqpn0sgv\/3OWu1rgPVfAYVvKyuGXsC"}
@@ -104,17 +104,17 @@
 00410{"flow_id":8,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":205,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570632,"pkt_ts_usec":742559,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAXNAABAGSjUXLP3zCggAAQG7v5jIhTlqN3rV51AQ\/\/\/ABgAA"}
 01097{"flow_id":8,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":212,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570633,"pkt_ts_usec":137443,"pkt_caplen":560,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":560,"pkt_l4_len":526,"pkt":"ABoRAAACABoRAAABCABFAAIiAXdAABAGSDcXLP3zCggAAQG7v5jIhTlqN3rV51AY\/\/9sYwAAFwMBAdBr6rILLXSFfLg2xmcpp7IzjJDTPMXzdMKTosQVEQmd\/NFjPQ1znLompWH0SbWBVqguYeRqgYBlLJDr3tKAHftNbqlL1TEL7I5ZOaJboZ3flnha2DT2kZCvC40+JCvHZ96tdi4z7uHrb00aqlbZ2zCfdV2cmlPpxVzTjfMRLbdS6on04jNn\/ItcWbN0OEGtifIJ+tXSTg2GCfeyHT9p8mJv7osbIyon4jClJrZ\/qLYu2c5e6lKxDhQyetNN0IO\/tQ6GAnSpzUiUPMbb0\/rKdtDFoqgU1gB7IpWDe0iMGmFtFpoklWekWY3QllPKp1PNOP1edC0+GG9YeXTyBA\/03Oh8QBf4Y+PxScTe0HKoR0ivtezQkVoHn61lY+na6E092GzZVlfDp5XdmhUKToC9vcNKWuFOdILwYY1PQgXTNU4zkdW+\/8VSpxdux626mbKN23DPSjKheShbpaOotO0Ftm6rB6\/EALB2Q2kks0SK3KuoRYbRbqQauFGEvzX6V6k3YoRQ5EIZwW6UOBcmAqTJicciQWaA7f4XHbTqalPo97knYeYd26wFwPqRjQTH9Gd3EEqkG9i9uE1U4gze1BDS+uRRlo1SBbV137uDSdiTgOQUXBUDAQAgwS\/Rg9gFfgiFf+h0mxtWS3MfWKg4wYwBTN8NPs0oChM="}
 00407{"flow_id":8,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":217,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570633,"pkt_ts_usec":205058,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoE6dAAEAGCAEKCAABFyz987+YAbs3etXnyIU7ZFAUfL1BSwAA"}
-00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":218,"source":"webex.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1444570633357,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41358,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":218,"source":"webex.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1444570633357,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41358,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00434{"flow_id":9,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":218,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570633,"pkt_ts_usec":357298,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA87DBAAEAGmtcKCAABQERpZ6GOAbtaKC3iAAAAAKACOQht0gAAAgQFtAQCCAoATMHSAAAAAAEDAwY="}
 00408{"flow_id":9,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":219,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570633,"pkt_ts_usec":360351,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAXpAABAGtaJARGlnCggAAQG7oY6l19IdWigt41AS\/\/9Y1AAA"}
 00406{"flow_id":9,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":220,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570633,"pkt_ts_usec":360483,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo7DFAAEAGmuoKCAABQERpZ6GOAbtaKC3jpdfSHlAQOQgfzQAA"}
 00493{"flow_id":9,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":221,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570633,"pkt_ts_usec":362374,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABn7DJAAEAGmqoKCAABQERpZ6GOAbtaKC3jpdfSHlAYOQhBGAAAFgMBADoBAAA2AwHTw\/bn8phv0cUj5hxDCEb0N0sEPfC+Zz7P154TmGT2KQAABAA1AP8BAAAJACMAAAAPAAEB"}
-00730{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":221,"source":"webex.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":4,"flow_first_seen":1444570633357,"flow_last_seen":1444570633362,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41358,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00740{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":221,"source":"webex.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":4,"flow_first_seen":1444570633357,"flow_last_seen":1444570633362,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41358,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00408{"flow_id":9,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":222,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570633,"pkt_ts_usec":362543,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAXtAABAGtaFARGlnCggAAQG7oY6l19IeWiguIlAQ\/\/9YlgAA"}
 02247{"flow_id":9,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":223,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570633,"pkt_ts_usec":759559,"pkt_caplen":1414,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1414,"pkt_l4_len":1380,"pkt":"ABoRAAACABoRAAABCABFAAV4AXxAABAGsFBARGlnCggAAQG7oY6l19IeWiguIlAY\/\/98JgAAFgMBD14CAABNAwFWGmYPgnRc4iMnpQXjn7W1o8Eq0vfQyXO+n056EKcu0yDKqOB0ehPXzyt5zMr3ZHbaIAcaxRyOh0DvxOa9GFdTSAA1AAAF\/wEAAQALAA8FAA8CAATpMIIE5TCCA82gAwIBAgIQKXSJqdQeSb5h94FpRuYh8zANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MB4XDTE1MDQxMDAwMDAwMFoXDTE4MDQxMDIzNTk1OVowdzELMAkGA1UEBhMCdXMxEzARBgNVBAgMCkNhbGlmb3JuaWExETAPBgNVBAcMCFNhbiBKb3NlMRwwGgYDVQQKDBNDaXNjbyBTeXN0ZW1zLCBJbmMuMQwwCgYDVQQLDANDU0cxFDASBgNVBAMMCyoud2ViZXguY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnXjIYUvDCGFnLF6CX7BhvJlmnmrg0KiZFcDP6TyJs2s+n7Hjqpb8O374x26knzLrTkrkpNBVvbi6eY8X6lmrWlqvlgEoyMmslNbZoAjUy1C9HNIMI2F1bLGI\/pKRUGbpk5wvAv6SKOf+cKi3mis7U2sccUb8cFxKTVpp62iK2uOzkFa4zF1i4hm\/NKjJWJVuj\/D8tQpd0PSuU5wWY7G1x\/5UpvvDV7KS7Tsmn3ib\/8gstBL+PLvKZHJ8YWc8u02oGZQoWD64APslwdmLLyDqq5USERl2bc761RHbBhnmKf3IpyvGqgfCFbQ7hfb+sniY0O+KQiBpaJI1bt4iiHQ1YQIDAQABo4IBZDCCAWAwFgYDVR0RBA8wDYILKi53ZWJleC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGUGA1UdIAReMFwwWgYKYIZIAYb4RQEHNjBMMCMGCCsGAQUFBwIBFhdodHRwczovL2Quc3ltY2IuY29tL2NwczAlBggrBgEFBQcCAjAZGhdodHRwczovL2Quc3ltY2IuY29tL3JwYTAfBgNVHSMEGDAWgBRfYM9hkFXfhEMUimAqsvV69EMY7zArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNybDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zcy5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9zcy5zeW1jYi5jb20vc3MuY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAU0XVgHR8KQTLFFzVVA7s1Rlqj4+dm5q+OB5OfJMqYeX\/hnGHVeD8z9\/9EdKsauBRbbFpJk38PC3aGoy0iL9v8CA4V6o0qYzEfedbF\/p\/UuvtChO8CktAaqN64hPdToCJEy3gqyB\/Hv7VVuKXUBogujzn1WBdIyBUlO\/hClSnOD8Qq1So\/AzCrw+\/ChOOV7DI631hsLE1M73UmQqxi7Cbu5R5TsXH6v6s\/7CAPBhVtuxTBBcBuPtA6Pd2Q8vOf6ByuErVmWAV\/tOLfjGuqPuM2JoxzR1iH82zcoIcxOzmtUIYsiTuUSCi\/AsNsm265BOW9oeh5kgZU+pE6LkGX9bECAAU8MIIFOA=="}
 00406{"flow_id":9,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":224,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570633,"pkt_ts_usec":810470,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo7DNAAEAGmugKCAABQERpZ6GOAbtaKC4ipdfXblAQP8AThgAA"}
 03883{"flow_id":9,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":225,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570633,"pkt_ts_usec":811592,"pkt_caplen":2633,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2633,"pkt_l4_len":2599,"pkt":"ABoRAAACABoRAAABCABFAAo7AX1AABAGq4xARGlnCggAAQG7oY6l19duWiguIlAY\/\/\/KpQAAMIIEIKADAgECAhBRP7l0OHC3NEBBjTCTBpn\/MA0GCSqGSIb3DQEBCwUAMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA2IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHNTAeFw0xMzEwMzEwMDAwMDBaFw0yMzEwMzAyMzU5NTlaMH4xCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEvMC0GA1UEAxMmU3ltYW50ZWMgQ2xhc3MgMyBTZWN1cmUgU2VydmVyIENBIC0gRzQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCy2AXKHHQttRdWOcVKUgmW6EvYDPFon5pCKGLDpTBTflURglsDeg0v4XkEybSWdxmBAZRZ+bz3epkngi23g91aJ3+yA3qcUyXpSB9GT8idKfi+eVb29\/3ZOmjai0uCM0ESw8g8zNaWeoQhGiIEAycXixxoYZMPDlGAMx20tc7rftBirO6zewF072k168rVPanul5jKjapEDiWZShWWpM5tAlQfKmom4gY6Y0istEzRdZNQ\/xMv1trhxhj1n8klXfMAOt4mTbQpCc0PPSNvFkqBFvvygxDDuNbYVTI98b0PvYxSlUoWl3pSIWN1Lxb5xGa+9bUJ2P8nAM1EfG9LP7D3AgMBAAGjggFjMIIBXzASBgNVHRMBAf8ECDAGAQH\/AgEAMDAGA1UdHwQpMCcwJaAjoCGGH2h0dHA6Ly9zMS5zeW1jYi5jb20vcGNhMy1nNS5jcmwwDgYDVR0PAQH\/BAQDAgEGMC8GCCsGAQUFBwEBBCMwITAfBggrBgEFBQcwAYYTaHR0cDovL3MyLnN5bWNiLmNvbTBrBgNVHSAEZDBiMGAGCmCGSAGG+EUBBzYwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM0MB0GA1UdDgQWBBRfYM9hkFXfhEMUimAqsvV69EMY7zAfBgNVHSMEGDAWgBR\/02Wnwt3su\/AwCfNDOfoCrzMxMzANBgkqhkiG9w0BAQsFAAOCAQEAXpRWSd2OLWX1wTZRtgPj2p5zGfIfWatYfmwmBSz6gddcIxciLDeT94bsheawo\/0f4jKoRW\/h2fu5r9JwoDJCZb+E\/hYqjz\/Fptajk31D6XQhkTUo9GPpLu339Vx\/S5q1IOkKveBFEAwUlJpdpeNLkegkm0ZAZfQics2Z+IgR9fN\/5jOC5qjFfv7QCOIlWAhxaObNouYU3k5SJC395XkTU+deLy1NG21AFVIr94eJeBKBbtlNqi141MIsPQhfh5GeHw6w3jBSZIaJqp1mnA52DIDydNgq+Lg6ztfWDxG+a6sU9b1BoCJjifG6D28pY2YtP6yMcsX7x+TUD\/I7T4wpxwAE1DCCBNAwggQ5oAMCAQICECUM6OAwYS6fK4n3BU18+P0wDQYJKoZIhvcNAQEFBQAwXzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA2MTEwODAwMDAwMFoXDTIxMTEwNzIzNTk1OVowgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAryQICCl6NZ5gDKrnSztO3Hy8PEUcuyvg\/ikC+VcIo2SFFSf18a3IMYldIugqqqZCs4\/4uVW3sbdLs\/6PfgdX7O9D22ZiFWHPYA2k2N744MNiCD1UE+tJyllUhSblK48bn+v1oZHCM0nYQ2NqUkvSj+hwUU3RiWl7x3D2s9wSdNt7XUtW05a\/FXehsPSiJfKvHJJnGOX0BgTvkLnkAOTdOrUZ\/wK69Dzu4IvrN4vs9Nes8vbwPa\/ddZEzGR0cQMt0JBkhk9kU\/qwqUseP1QRJ5I1jR4g8aYPL\/ke9K35PxZWuDp3U0UPAZ3PjFAh+5T+fc7gzCs9dPzSHloruU+glFQIDAQABo4IBmzCCAZcwDwYDVR0TAQH\/BAUwAwEB\/zAxBgNVHR8EKjAoMCagJKAihiBodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9wY2EzLmNybDAOBgNVHQ8BAf8EBAMCAQYwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9jcHMwHQYDVR0OBBYEFH\/TZafC3ey78DAJ80M5+gKvMzEzMG0GCCsGAQUFBwEMBGEwX6FdoFswWTBXMFUWCWltYWdlL2dpZjAhMB8wBwYFKw4DAhoEFI\/l0xqGrI2Oa8PPgGrUSBgsexkuMCUWI2h0dHA6Ly9sb2dvLnZlcmlzaWduLmNvbS92c2xvZ28uZ2lmMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AudmVyaXNpZ24uY29tMD4GA1UdJQQ3MDUGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCWCGSAGG+EIEAQYKYIZIAYb4RQEIATANBgkqhkiG9w0BAQUFAAOBgQATAt346IYA8lr4+CAMWYhiB87O9075u1mhmOXhON1OvGYY063rGPINyW0+SpQgwzy6vWVUxq9EsxCtLGs+q9cHtriBY8X5Xi7lKmfOzTMMKteJVgMjH7O+6DoIWbTsRTX3ilv\/Zs9Qr8ZtV40ZeLe5otFX6h+aS6+6yY4Sfsa9\/w4AAAA="}
-01110{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":225,"source":"webex.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":8,"flow_first_seen":1444570633357,"flow_last_seen":1444570633811,"flow_tot_l4_data_len":4182,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2599,"flow_avg_l4_data_len":522,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41358,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01121{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":225,"source":"webex.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":8,"flow_first_seen":1444570633357,"flow_last_seen":1444570633811,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2579,"flow_tot_l4_payload_len":4002,"flow_avg_l4_payload_len":500,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41358,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00406{"flow_id":9,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":226,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570633,"pkt_ts_usec":862615,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo7DRAAEAGmucKCAABQERpZ6GOAbtaKC4ipdfhgVAQUJj4mgAA"}
 00857{"flow_id":9,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":227,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570633,"pkt_ts_usec":862998,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFu7DVAAEAGmaAKCAABQERpZ6GOAbtaKC4ipdfhgVAYUJgTNwAAFgMBAQYQAAECAQB9e7+NQHEVjddpWUvPW6gV6\/uT\/ulXG5JxuO2\/mzmtXH4zuQRw4iJCJPU3VPj6u38aPmB4Dsrc2Qs7ct0BxP7VNOFNHbm4pP4m\/3dz2Pjv9y\/W0h7QlT85w8QCL34iEAdymlHA5KlHcdrW+I+vmDbGdQmyygBMVJCS\/bCmSL7JoPdVIpFgDVVF+4lbc3He9yu65EhIhdjxOIS8ikJ9hxIMoSUUgeXpqoEMVJYMxCSBnDrePp9ACWlVgT9pI70aFkz+oJ9T\/isvSvlMITHn5IT78zWHA0bxvsyWLreoOZ9\/CzO5bs4+NWuoDSobztYVtDo3kFpJzWS5Vqe1lXyKfjipFAMBAAEBFgMBADCzHuR\/K+4uIP\/YCZDD3LbGmMwrUaEgFCaL0QLOypFC3IeRFhoJZMkn2m5kv4Bl\/K8="}
 00409{"flow_id":9,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":228,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570633,"pkt_ts_usec":863970,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAX5AABAGtZ5ARGlnCggAAQG7oY6l1+GBWigvaFAQ\/\/9H7QAA"}
@@ -122,108 +122,108 @@
 01143{"flow_id":9,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":230,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570634,"pkt_ts_usec":124821,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"ABoRAAACABoRAAABCABFAAJA7DZAAEAGmM0KCAABQERpZ6GOAbtaKC9opdfhvFAQUJix4QAAFwMBACC2Gf98Lp3bUwIlav73r8\/RI8c9Dn9LTEAK7H9AKpnY2hcDAQIQQu0+BOhGMCHr6u35CSjzcixsV7Gd1f+U7zb+kRVo\/VUdxUFXkCuvjf38HXZG0MCUGizOrUDSjMjEmJlwX\/YdPx3iJqrloL3xFqpC1\/mG6wsgfWsOC7O9Uhxu7fogAPGhGmU79Evgh4Sae4yBGszAUYTMtJOxgVWijoO32g2Soco8\/NB8XFRGVMkkaXy6vQ8kw1wfIX7BzZBf1N6ccMV\/FAMko\/a+1VvZEfQrjlcMNUDOw3OqHCJAyksuO8Va4jBI3k9DZTQ2FV\/YTiH+7ZMZFJww6cTNH9CEUVRpXJ4WpqfVvV7fOwbb0qDBgpJt+HLSOSN8sI2DUcBsYvXP8DvDxVZKsHRzSbH0+i2EpYHbd9KWGTktCDcoADim\/yzZvjqoCzKMkaZrCcRF+zcVI\/WMh7Ruj17CNaxZHdV0LQZnoiQT6hDC+gsxli3OnOfjuvgXxg5XDtlNKXQgvieOTTUrsu8pdXHmVJ28P2dOz2ANpVJONCUcqtRIwr2Zj0XSbIYiWDwtKcClS\/3iYfp5AbMbNdfxzmLKdYKuvcPE\/sHGbBqWMP0EbQbsipOM\/Q76ik\/J0t\/9NAQy0UNk0saRvWTKcC8ai93rl1oWKsiCHL8\/12BXybpctrzVVshMoML\/Rd009EnsSl+1yWVrmBFedfo="}
 00409{"flow_id":9,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":231,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570634,"pkt_ts_usec":125667,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAYBAABAGtZxARGlnCggAAQG7oY6l1+G8WigxgFAQ\/\/9FmgAA"}
 00456{"flow_id":9,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":232,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570634,"pkt_ts_usec":126109,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"ABoRAAACABoRAAABCABFAABK7DdAAEAGmsIKCAABQERpZ6GOAbtaKDGApdfhvFAYUJhLJQAA6M8TR5XszWO89LtX48bicE\/9oPFdvfJa9CRPtEy1N2EC0A=="}
-00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":256,"source":"webex.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1444570636151,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.213.212","src_port":41726,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":256,"source":"webex.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1444570636151,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.213.212","src_port":41726,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":10,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":256,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":151328,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8tbVAAEAGMwwKCAABch3V1KL+AbsYGndcAAAAAKACOQjFmAAAAgQFtAQCCAoATMLpAAAAAAEDAwY="}
 00409{"flow_id":10,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":257,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":154295,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAY1AABAGF0lyHdXUCggAAQG7ov7n5YijGBp3XVAS\/\/+5HQAA"}
 00407{"flow_id":10,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":258,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":154740,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAotbZAAEAGMx8KCAABch3V1KL+AbsYGndd5+WIpFAQOQiAFgAA"}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":259,"source":"webex.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1444570636155,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.204.49","src_port":51646,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":259,"source":"webex.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1444570636155,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.204.49","src_port":51646,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":11,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":259,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":155519,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8NxlAAEAGu0sKCAABch3MMcm+AbvkVPXwAAAAAKACOQhdrAAAAgQFtAQCCAoATMLpAAAAAAEDAwY="}
 00409{"flow_id":11,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":260,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":157830,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAY5AABAGIOtyHcwxCggAAQG7yb4bqwoP5FT18VAS\/\/+cAAAA"}
 00493{"flow_id":10,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":261,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":157950,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABntbdAAEAGMt8KCAABch3V1KL+AbsYGndd5+WIpFAYOQhDcwAAFgMBADoBAAA2AwEixpBV3K1aYKpnKzRaOLYWz3kxtW8gINw5Lf9cpQ2h2AAABAA1AP8BAAAJACMAAAAPAAEB"}
-00732{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":261,"source":"webex.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":4,"flow_first_seen":1444570636151,"flow_last_seen":1444570636157,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.213.212","src_port":41726,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00742{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":261,"source":"webex.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":4,"flow_first_seen":1444570636151,"flow_last_seen":1444570636157,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.213.212","src_port":41726,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":10,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":262,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":158232,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAY9AABAGF0dyHdXUCggAAQG7ov7n5YikGBp3nFAQ\/\/+43wAA"}
 00407{"flow_id":11,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":263,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":158443,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoNxpAAEAGu14KCAABch3MMcm+AbvkVPXxG6sKEFAQOQhi+QAA"}
 00493{"flow_id":11,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":264,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":159914,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnNxtAAEAGux4KCAABch3MMcm+AbvkVPXxG6sKEFAYOQjpBAAAFgMBADoBAAA2AwELSWRUw5u41GvWexySi8w7aRuG0UGhgcOkKRM8ZLYwuAAABAA1AP8BAAAJACMAAAAPAAEB"}
-00731{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":264,"source":"webex.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":4,"flow_first_seen":1444570636155,"flow_last_seen":1444570636159,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.204.49","src_port":51646,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00741{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":264,"source":"webex.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":4,"flow_first_seen":1444570636155,"flow_last_seen":1444570636159,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.204.49","src_port":51646,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":11,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":265,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":160142,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZBAABAGIOlyHcwxCggAAQG7yb4bqwoQ5FT2MFAQ\/\/+bwgAA"}
-00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":266,"source":"webex.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1444570636160,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"209.197.222.159","src_port":47498,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":266,"source":"webex.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1444570636160,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"209.197.222.159","src_port":47498,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":12,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":266,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":160380,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA80GxAAEAGr+EKCAAB0cXen7mKAbt7nBKGAAAAAKACOQhH7AAAAgQFtAQCCAoATMLqAAAAAAEDAwY="}
 00409{"flow_id":12,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":267,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":163417,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZFAABAGrtHRxd6fCggAAQG7uYqEY+15e5wSh1AS\/\/86HgAA"}
 00408{"flow_id":12,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":268,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":163735,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo0G1AAEAGr\/QKCAAB0cXen7mKAbt7nBKHhGPtelAQOQgBFwAA"}
 00494{"flow_id":12,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":269,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":164429,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABn0G5AAEAGr7QKCAAB0cXen7mKAbt7nBKHhGPtelAYOQh2yQAAFgMBADoBAAA2AwENSlEe7+NgWQr9TJ\/2WZpS5a6sUQSaq2ncdIKzDktEmAAABAA1AP8BAAAJACMAAAAPAAEB"}
-00733{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":269,"source":"webex.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":4,"flow_first_seen":1444570636160,"flow_last_seen":1444570636164,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"209.197.222.159","src_port":47498,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00743{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":269,"source":"webex.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":4,"flow_first_seen":1444570636160,"flow_last_seen":1444570636164,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"209.197.222.159","src_port":47498,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":12,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":270,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":164621,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZJAABAGrtDRxd6fCggAAQG7uYqEY+16e5wSxlAQ\/\/854AAA"}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":271,"source":"webex.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1444570636170,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.153","src_port":57647,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":271,"source":"webex.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1444570636170,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.153","src_port":57647,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":13,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":271,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":170439,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8c99AAEAGAvcKCAABQER5meEvAbvnI7E0AAAAAKACOQgMmAAAAgQFtAQCCAoATMLrAAAAAAEDAwY="}
 00409{"flow_id":13,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":272,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":175135,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZNAABAGpVdARHmZCggAAQG74S8Y3E7L5yOxNVAS\/\/8JAQAA"}
 00407{"flow_id":13,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":273,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":175390,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoc+BAAEAGAwoKCAABQER5meEvAbvnI7E1GNxOzFAQOQjP+QAA"}
 00495{"flow_id":13,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":274,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":176823,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnc+FAAEAGAsoKCAABQER5meEvAbvnI7E1GNxOzFAYOQg\/MQAAFgMBADoBAAA2AwHlQjeb\/eKZHKuppjWfos5yg+nhloBcE1OwdwWUSYyZagAABAA1AP8BAAAJACMAAAAPAAEB"}
-00731{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":274,"source":"webex.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":4,"flow_first_seen":1444570636170,"flow_last_seen":1444570636176,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.153","src_port":57647,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00741{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":274,"source":"webex.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":4,"flow_first_seen":1444570636170,"flow_last_seen":1444570636176,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.153","src_port":57647,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":13,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":275,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":177089,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZRAABAGpVZARHmZCggAAQG74S8Y3E7M5yOxdFAQ\/\/8IwwAA"}
-00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":276,"source":"webex.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1444570636180,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.231.3","src_port":45814,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":276,"source":"webex.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1444570636180,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.231.3","src_port":45814,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":14,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":276,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":180806,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8nw9AAEAGbDMKCAABPm3nA7L2AbufQl3jAAAAAKACOQhqbwAAAgQFtAQCCAoATMLsAAAAAAEDAwY="}
 00410{"flow_id":14,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":277,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":183521,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZVAABAGOcI+becDCggAAQG7svZgvaIcn0Jd5FAS\/\/\/LpgAA"}
 00407{"flow_id":14,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":278,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":183683,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAonxBAAEAGbEYKCAABPm3nA7L2AbufQl3kYL2iHVAQOQiSnwAA"}
 00494{"flow_id":14,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":279,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":185047,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnnxFAAEAGbAYKCAABPm3nA7L2AbufQl3kYL2iHVAYOQiqgAAAFgMBADoBAAA2AwG1npMJl\/ayeEKp148YQXJQu08Kp5pJKEAcdvXjyY7AEAAABAA1AP8BAAAJACMAAAAPAAEB"}
-00730{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":279,"source":"webex.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":4,"flow_first_seen":1444570636180,"flow_last_seen":1444570636185,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.231.3","src_port":45814,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00740{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":279,"source":"webex.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":4,"flow_first_seen":1444570636180,"flow_last_seen":1444570636185,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.231.3","src_port":45814,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00410{"flow_id":14,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":280,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":185321,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZZAABAGOcE+becDCggAAQG7svZgvaIdn0JeI1AQ\/\/\/LaAAA"}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":281,"source":"webex.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1444570636248,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.104.140","src_port":44492,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":281,"source":"webex.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1444570636248,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.104.140","src_port":44492,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":15,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":281,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":248727,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8NIdAAEAGU1wKCAABQERojK3MAbt5hvZ2AAAAAKACOQh5XQAAAgQFtAQCCAoATMLxAAAAAAEDAwY="}
 00409{"flow_id":15,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":282,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":252206,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZdAABAGtmBARGiMCggAAQG7rcyGeQmJeYb2d1AS\/\/9NcQAA"}
-00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":283,"source":"webex.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1444570636252,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.202.139","src_port":47116,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":283,"source":"webex.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1444570636252,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.202.139","src_port":47116,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":16,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":283,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":252483,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA80SxAAEAGIt4KCAABch3Ki7gMAbtSShPdAAAAAKACOQjlGgAAAgQFtAQCCAoATMLxAAAAAAEDAwY="}
 00409{"flow_id":16,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":284,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":255532,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZhAABAGIodyHcqLCggAAQG7uAyttewiUkoT3lAS\/\/+vWAAA"}
-00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":285,"source":"webex.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1444570636255,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.4.76","src_port":52730,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":285,"source":"webex.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1444570636255,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.4.76","src_port":52730,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":17,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":285,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":255758,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA870JAAEAGjzEKCAABrfMETM36AbsKei2zAAAAAKACOQiHkAAAAgQFtAQCCAoATMLxAAAAAAEDAwY="}
 00409{"flow_id":17,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":286,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":259424,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZlAABAGrO+t8wRMCggAAQG7zfr1hdJMCnottFAS\/\/8j1AAA"}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":287,"source":"webex.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1444570636259,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.100","src_port":52219,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":287,"source":"webex.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1444570636259,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.100","src_port":52219,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":18,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":287,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":259848,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8u9ZAAEAGuzQKCAABQER5ZMv7AbtwVXkkAAAAAKACOQjQ2AAAAgQFtAQCCAoATMLyAAAAAAEDAwY="}
 00410{"flow_id":18,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":288,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":263791,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZpAABAGpYVARHlkCggAAQG7y\/uPqobbcFV5JVAS\/\/8eagAA"}
-00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":289,"source":"webex.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1444570636264,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.99","src_port":55969,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":289,"source":"webex.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1444570636264,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.99","src_port":55969,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":19,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":289,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":264505,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8YelAAEAGFSMKCAABQER5Y9qhAbtb96MaAAAAAKACOQismgAAAgQFtAQCCAoATMLzAAAAAAEDAwY="}
 00410{"flow_id":19,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":290,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":268416,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZtAABAGpYVARHljCggAAQG72qGkCFzlW\/ejG1AS\/\/8PxQAA"}
 00407{"flow_id":15,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":291,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":268706,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoNIhAAEAGU28KCAABQERojK3MAbt5hvZ3hnkJilAQOQgUagAA"}
 00493{"flow_id":15,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":292,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":268852,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnNIlAAEAGUy8KCAABQERojK3MAbt5hvZ3hnkJilAYOQhZ6QAAFgMBADoBAAA2AwFZAOdrf318d9DQoA0D3C8cGGy1yScsdSsQfqgP8YHJWQAABAA1AP8BAAAJACMAAAAPAAEB"}
-00731{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":292,"source":"webex.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":4,"flow_first_seen":1444570636248,"flow_last_seen":1444570636268,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.104.140","src_port":44492,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00741{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":292,"source":"webex.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":4,"flow_first_seen":1444570636248,"flow_last_seen":1444570636268,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.104.140","src_port":44492,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":15,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":293,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":269047,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZxAABAGtltARGiMCggAAQG7rcyGeQmKeYb2tlAQ\/\/9NMwAA"}
 00407{"flow_id":16,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":294,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":269399,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo0S1AAEAGIvEKCAABch3Ki7gMAbtSShPerbXsI1AQOQh2UQAA"}
 00495{"flow_id":16,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":295,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":269543,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABn0S5AAEAGIrEKCAABch3Ki7gMAbtSShPerbXsI1AYOQjEKQAAFgMBADoBAAA2AwEgf\/e\/jgX0597KeqXA4hkOqtuJMPxy38wcZQGqQdMmagAABAA1AP8BAAAJACMAAAAPAAEB"}
-00732{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":295,"source":"webex.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":4,"flow_first_seen":1444570636252,"flow_last_seen":1444570636269,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.202.139","src_port":47116,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00742{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":295,"source":"webex.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":4,"flow_first_seen":1444570636252,"flow_last_seen":1444570636269,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.202.139","src_port":47116,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":16,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":296,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":269759,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZ1AABAGIoJyHcqLCggAAQG7uAyttewjUkoUHVAQ\/\/+vGgAA"}
 00407{"flow_id":17,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":297,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":269901,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo70NAAEAGj0QKCAABrfMETM36AbsKei209YXSTVAQOQjqzAAA"}
 00493{"flow_id":17,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":298,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":270105,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABn70RAAEAGjwQKCAABrfMETM36AbsKei209YXSTVAYOQhXBgAAFgMBADoBAAA2AwEbjnmamhrG0ilv8MM2B7NxSQPfoK5gN5dT14i2jCOS+AAABAA1AP8BAAAJACMAAAAPAAEB"}
-00730{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":298,"source":"webex.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":4,"flow_first_seen":1444570636255,"flow_last_seen":1444570636270,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.4.76","src_port":52730,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00740{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":298,"source":"webex.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":4,"flow_first_seen":1444570636255,"flow_last_seen":1444570636270,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.4.76","src_port":52730,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":17,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":299,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":270294,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZ5AABAGrOqt8wRMCggAAQG7zfr1hdJNCnot81AQ\/\/8jlgAA"}
 00407{"flow_id":18,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":300,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":270430,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAou9dAAEAGu0cKCAABQER5ZMv7AbtwVXklj6qG3FAQOQjlYgAA"}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":301,"source":"webex.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1444570636270,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.200.11","src_port":47841,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":301,"source":"webex.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1444570636270,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.200.11","src_port":47841,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":20,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":301,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":270568,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA879dAAEAGBrMKCAABch3IC7rhAbtuYS0jAAAAAKACOQivZQAAAgQFtAQCCAoATML0AAAAAAEDAwY="}
 00409{"flow_id":20,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":302,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":273711,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAZ9AABAGJQByHcgLCggAAQG7uuGRntLcbmEtJFAS\/\/+vAwAA"}
 00495{"flow_id":18,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":303,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":273982,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnu9hAAEAGuwcKCAABQER5ZMv7AbtwVXklj6qG3FAYOQirFAAAFgMBADoBAAA2AwHYELTmAdFk47j\/kG3RMIzBgWabbigjj\/WcrWQ+O8XfAwAABAA1AP8BAAAJACMAAAAPAAEB"}
-00731{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":303,"source":"webex.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":4,"flow_first_seen":1444570636259,"flow_last_seen":1444570636273,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.100","src_port":52219,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00741{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":303,"source":"webex.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":4,"flow_first_seen":1444570636259,"flow_last_seen":1444570636273,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.100","src_port":52219,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00410{"flow_id":18,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":304,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":274175,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAaBAABAGpX9ARHlkCggAAQG7y\/uPqobccFV5ZFAQ\/\/8eLAAA"}
 00407{"flow_id":19,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":305,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":274320,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoYepAAEAGFTYKCAABQER5Y9qhAbtb96MbpAhc5lAQOQjWvQAA"}
 00493{"flow_id":19,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":306,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":274819,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnYetAAEAGFPYKCAABQER5Y9qhAbtb96MbpAhc5lAYOQh9SQAAFgMBADoBAAA2AwFui4ALd8hCzC1Hn0XZp9IbNctVu8L5+XzvOp52wmP4PgAABAA1AP8BAAAJACMAAAAPAAEB"}
-00730{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":306,"source":"webex.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":4,"flow_first_seen":1444570636264,"flow_last_seen":1444570636274,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.99","src_port":55969,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00740{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":306,"source":"webex.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":4,"flow_first_seen":1444570636264,"flow_last_seen":1444570636274,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.99","src_port":55969,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00410{"flow_id":19,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":307,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":275494,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAaFAABAGpX9ARHljCggAAQG72qGkCFzmW\/ejWlAQ\/\/8PhwAA"}
 00408{"flow_id":20,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":308,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":275644,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo79hAAEAGBsYKCAABch3IC7rhAbtuYS0kkZ7S3VAQOQh1\/AAA"}
 00493{"flow_id":20,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":309,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":276432,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABn79lAAEAGBoYKCAABch3IC7rhAbtuYS0kkZ7S3VAYOQiWfgAAFgMBADoBAAA2AwGYeAXD1rCaFxll3KHQwiDcn3jmpgdAsGqZOECdkGYcowAABAA1AP8BAAAJACMAAAAPAAEB"}
-00731{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":309,"source":"webex.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":4,"flow_first_seen":1444570636270,"flow_last_seen":1444570636276,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.200.11","src_port":47841,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00741{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":309,"source":"webex.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":4,"flow_first_seen":1444570636270,"flow_last_seen":1444570636276,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.200.11","src_port":47841,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":20,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":310,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":276627,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAaJAABAGJP1yHcgLCggAAQG7uuGRntLdbmEtY1AQ\/\/+uxQAA"}
-00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":311,"source":"webex.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1444570636359,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.97","src_port":51370,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":311,"source":"webex.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1444570636359,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.97","src_port":51370,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":21,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":311,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":359207,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA86IFAAEAGnowKCAABQERpYciqAbsEZyp7AAAAAKACOQievAAAAgQFtAQCCAoATML6AAAAAAEDAwY="}
 00409{"flow_id":21,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":312,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":363606,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAaNAABAGtX9ARGlhCggAAQG7yKr7mNWEBGcqfFAS\/\/8xvgAA"}
-00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":313,"source":"webex.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1444570636364,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.98","src_port":37129,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":313,"source":"webex.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1444570636364,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.98","src_port":37129,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":22,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":313,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":364135,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8Y+FAAEAGIywKCAABQERpYpEJAbvtraEaAAAAAKACOQh2dQAAAgQFtAQCCAoATML7AAAAAAEDAwY="}
 00409{"flow_id":22,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":314,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":368157,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAaRAABAGtX1ARGliCggAAQG7kQkSUl7l7a2hG1AS\/\/9pXgAA"}
 00407{"flow_id":21,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":315,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":368456,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo6IJAAEAGnp8KCAABQERpYciqAbsEZyp8+5jVhVAQOQj4tgAA"}
 00493{"flow_id":21,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":316,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":368630,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABn6INAAEAGnl8KCAABQERpYciqAbsEZyp8+5jVhVAYOQiOAwAAFgMBADoBAAA2AwG0+nLinPAGG4t2PmApyj1cBSRGozWXopqiBuxsT+LyqQAABAA1AP8BAAAJACMAAAAPAAEB"}
-00730{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":316,"source":"webex.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":4,"flow_first_seen":1444570636359,"flow_last_seen":1444570636368,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.97","src_port":51370,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00740{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":316,"source":"webex.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":4,"flow_first_seen":1444570636359,"flow_last_seen":1444570636368,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.97","src_port":51370,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":21,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":317,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":369036,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAaVAABAGtX1ARGlhCggAAQG7yKr7mNWFBGcqu1AQ\/\/8xgAAA"}
 00407{"flow_id":22,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":318,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":369197,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoY+JAAEAGIz8KCAABQERpYpEJAbvtraEbElJe5lAQOQgwVwAA"}
 00494{"flow_id":22,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":319,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":369622,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnY+NAAEAGIv8KCAABQERpYpEJAbvtraEbElJe5lAYOQjiHgAAFgMBADoBAAA2AwF3tBEHB6guyNBNlJmUpeM5u9lxXWyFQhCvqu17Ld8y\/QAABAA1AP8BAAAJACMAAAAPAAEB"}
-00730{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":319,"source":"webex.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":4,"flow_first_seen":1444570636364,"flow_last_seen":1444570636369,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.98","src_port":37129,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00740{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":319,"source":"webex.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":4,"flow_first_seen":1444570636364,"flow_last_seen":1444570636369,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.98","src_port":37129,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":22,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":320,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":369848,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAaZAABAGtXtARGliCggAAQG7kQkSUl7m7a2hWlAQ\/\/9pIAAA"}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":321,"source":"webex.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1444570636387,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41386,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":321,"source":"webex.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1444570636387,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41386,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":23,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":321,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":387910,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA82lhAAEAGrK8KCAABQERpZ6GqAbsG3RlZAAAAAKACOQjUWwAAAgQFtAQCCAoATMMBAAAAAAEDAwY="}
 00409{"flow_id":23,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":322,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":395572,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAadAABAGtXVARGlnCggAAQG7oar5IuamBt0ZWlAS\/\/9YuAAA"}
 00407{"flow_id":23,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":323,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":395961,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo2llAAEAGrMIKCAABQERpZ6GqAbsG3Rla+SLmp1AQOQgfsQAA"}
 00495{"flow_id":23,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":324,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":397645,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABn2lpAAEAGrIIKCAABQERpZ6GqAbsG3Rla+SLmp1AYOQjTBwAAFgMBADoBAAA2AwHQxD6jP9mnXAR\/gJlsx5rnkfAjqPqPevvcaVvn\/9cADgAABAA1AP8BAAAJACMAAAAPAAEB"}
-00731{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":324,"source":"webex.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":4,"flow_first_seen":1444570636387,"flow_last_seen":1444570636397,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41386,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00741{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":324,"source":"webex.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":4,"flow_first_seen":1444570636387,"flow_last_seen":1444570636397,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41386,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":23,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":325,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":398289,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAahAABAGtXRARGlnCggAAQG7oar5IuanBt0ZmVAQ\/\/9YegAA"}
 02278{"flow_id":14,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":326,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":461571,"pkt_caplen":1434,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1434,"pkt_l4_len":1400,"pkt":"ABoRAAACABoRAAABCABFAAWMAalAABAGNEo+becDCggAAQG7svZgvaIdn0JeI1AY\/\/+fPgAAFgMBDz4CAAAtAwFWGmYRArDIcqLQ\/bRHkH\/nYeN2CQCCxM0AncO1AEsIWwAANQAABf8BAAEACwAPBQAPAgAE6TCCBOUwggPNoAMCAQICECl0ianUHkm+YfeBaUbmIfMwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDAeFw0xNTA0MTAwMDAwMDBaFw0xODA0MTAyMzU5NTlaMHcxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMREwDwYDVQQHDAhTYW4gSm9zZTEcMBoGA1UECgwTQ2lzY28gU3lzdGVtcywgSW5jLjEMMAoGA1UECwwDQ1NHMRQwEgYDVQQDDAsqLndlYmV4LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ14yGFLwwhhZyxegl+wYbyZZp5q4NComRXAz+k8ibNrPp+x46qW\/Dt++MdupJ8y605K5KTQVb24unmPF+pZq1par5YBKMjJrJTW2aAI1MtQvRzSDCNhdWyxiP6SkVBm6ZOcLwL+kijn\/nCot5orO1NrHHFG\/HBcSk1aaetoitrjs5BWuMxdYuIZvzSoyViVbo\/w\/LUKXdD0rlOcFmOxtcf+VKb7w1eyku07Jp94m\/\/ILLQS\/jy7ymRyfGFnPLtNqBmUKFg+uAD7JcHZiy8g6quVEhEZdm3O+tUR2wYZ5in9yKcrxqoHwhW0O4X2\/rJ4mNDvikIgaWiSNW7eIoh0NWECAwEAAaOCAWQwggFgMBYGA1UdEQQPMA2CCyoud2ViZXguY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH\/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYDVR0jBBgwFoAUX2DPYZBV34RDFIpgKrL1evRDGO8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Muc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAFNF1YB0fCkEyxRc1VQO7NUZao+PnZuavjgeTnyTKmHl\/4Zxh1Xg\/M\/f\/RHSrGrgUW2xaSZN\/Dwt2hqMtIi\/b\/AgOFeqNKmMxH3nWxf6f1Lr7QoTvApLQGqjeuIT3U6AiRMt4Ksgfx7+1Vbil1AaILo859VgXSMgVJTv4QpUpzg\/EKtUqPwMwq8PvwoTjlewyOt9YbCxNTO91JkKsYuwm7uUeU7Fx+r+rP+wgDwYVbbsUwQXAbj7QOj3dkPLzn+gcrhK1ZlgFf7Ti34xrqj7jNiaMc0dYh\/Ns3KCHMTs5rVCGLIk7lEgovwLDbJtuuQTlvaHoeZIGVPqROi5Bl\/WxAgAFPDCCBTgwggQgoAMCAQICEFE\/uXQ4cLc0QEGNMJMGmf8wDQYJKoZIhvcNAQELBQAwgcoxCzAJBgNV"}
 00407{"flow_id":14,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":327,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":462122,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAonxJAAEAGbEQKCAABPm3nA7L2AbufQl4jYL2ngVAQQLCFVAAA"}
 03814{"flow_id":14,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":328,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":471138,"pkt_caplen":2581,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2581,"pkt_l4_len":2547,"pkt":"ABoRAAACABoRAAABCABFAAoHAapAABAGL84+becDCggAAQG7svZgvaeBn0JeI1AY\/\/9AIAAABAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MB4XDTEzMTAzMTAwMDAwMFoXDTIzMTAzMDIzNTk1OVowfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLYBcocdC21F1Y5xUpSCZboS9gM8WifmkIoYsOlMFN+VRGCWwN6DS\/heQTJtJZ3GYEBlFn5vPd6mSeCLbeD3Vonf7IDepxTJelIH0ZPyJ0p+L55Vvb3\/dk6aNqLS4IzQRLDyDzM1pZ6hCEaIgQDJxeLHGhhkw8OUYAzHbS1zut+0GKs7rN7AXTvaTXrytU9qe6XmMqNqkQOJZlKFZakzm0CVB8qaibiBjpjSKy0TNF1k1D\/Ey\/W2uHGGPWfySVd8wA63iZNtCkJzQ89I28WSoEW+\/KDEMO41thVMj3xvQ+9jFKVShaXelIhY3UvFvnEZr71tQnY\/ycAzUR8b0s\/sPcCAwEAAaOCAWMwggFfMBIGA1UdEwEB\/wQIMAYBAf8CAQAwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNiLmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vczIuc3ltY2IuY29tMGsGA1UdIARkMGIwYAYKYIZIAYb4RQEHNjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMB8GA1UdIwQYMBaAFH\/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBCwUAA4IBAQBelFZJ3Y4tZfXBNlG2A+PannMZ8h9Zq1h+bCYFLPqB11wjFyIsN5P3huyF5rCj\/R\/iMqhFb+HZ+7mv0nCgMkJlv4T+FiqPP8Wm1qOTfUPpdCGRNSj0Y+ku7ff1XH9LmrUg6Qq94EUQDBSUml2l40uR6CSbRkBl9CJyzZn4iBH183\/mM4LmqMV+\/tAI4iVYCHFo5s2i5hTeTlIkLf3leRNT514vLU0bbUAVUiv3h4l4EoFu2U2qLXjUwiw9CF+HkZ4fDrDeMFJkhomqnWacDnYMgPJ02Cr4uDrO19YPEb5rqxT1vUGgImOJ8boPbyljZi0\/rIxyxfvH5NQP8jtPjCnHAATUMIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ\/XxrcgxiV0i6CqqpkKzj\/i5Vbext0uz\/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6\/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn\/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4\/VBEnkjWNHiDxpg8v+R70rfk\/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10\/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH\/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB\/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW\/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3\/DgAAAA=="}
-01110{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":328,"source":"webex.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":8,"flow_first_seen":1444570636180,"flow_last_seen":1444570636471,"flow_tot_l4_data_len":4150,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2547,"flow_avg_l4_data_len":518,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.231.3","src_port":45814,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01121{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":328,"source":"webex.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":8,"flow_first_seen":1444570636180,"flow_last_seen":1444570636471,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2527,"flow_tot_l4_payload_len":3970,"flow_avg_l4_payload_len":496,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.231.3","src_port":45814,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00407{"flow_id":14,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":329,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":522174,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAonxNAAEAGbEMKCAABPm3nA7L2AbufQl4jYL2xYFAQTvhtLQAA"}
 00854{"flow_id":14,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":330,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":522571,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFunxRAAEAGavwKCAABPm3nA7L2AbufQl4jYL2xYFAYTvhSuAAAFgMBAQYQAAECAQB+x8SRFL2Xl25V270B08YXmzYouk2YY7Sh\/JZqWhl4FAtkaXyk3Y9KixLFglwMo8snZosACNZ4mi2KAWt7xQOoUCJFw9A8VP36T2QysqLRz+1q0kYb5d\/10QCwqU3BwBjieuKr8pvMNhakG+LNQUb+GVGXP22+JcaSnx8acpHquVahAg7KoKG3tge9\/o9hdNRcmkUTbETYhUcsO7kERjHuJsF0qrOU57OEoNvti6\/1IS+igd4z+TosVT5AeT9dpZLzf3XRHLkdc5Nvoq1Osrjx\/sIi6S\/VVKZD06Ovl1vOLOWhBJRCY7hpB6GOLUIaDO7uCntgxqENsNjJnu\/IjQOVFAMBAAEBFgMBADDMSFBVAWePsR52e6bpBiy3sbZr48YDsbwKShZC0wc+zB5r5AmNyl574bcRRXY1Kmc="}
 00410{"flow_id":14,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":331,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":523151,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAatAABAGOaw+becDCggAAQG7svZgvbFgn0JfaVAQ\/\/+63wAA"}
@@ -231,22 +231,22 @@
 00407{"flow_id":15,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":333,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":698579,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoNIpAAEAGU20KCAABQERojK3MAbt5hva2hnkO2lAQP8AIIwAA"}
 00492{"flow_id":14,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":334,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":699386,"pkt_caplen":113,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":113,"pkt_l4_len":79,"pkt":"ABoRAAACABoRAAABCABFAABjAa1AABAGOW8+becDCggAAQG7svZgvbFgn0JfaVAY\/\/+8kAAAFAMBAAEBFgMBADABGZe8ehOSe7gK0FC8QxqAhYLDRh5yPtE2RphosONMTi0lAqbKlg87+MpJfR3JJIE="}
 05676{"flow_id":12,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":335,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":701917,"pkt_caplen":3961,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3961,"pkt_l4_len":3927,"pkt":"ABoRAAACABoRAAABCABFAA9rAa5AABAGn3HRxd6fCggAAQG7uYqEY+16e5wSxlAY\/\/\/gJgAAFgMBDz4CAAAtAwFWGmYSafQ2QQh1yhO3tQEaAendowKn9NoaYwQzVwrXvgAANQAABf8BAAEACwAPBQAPAgAE6TCCBOUwggPNoAMCAQICECl0ianUHkm+YfeBaUbmIfMwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDAeFw0xNTA0MTAwMDAwMDBaFw0xODA0MTAyMzU5NTlaMHcxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMREwDwYDVQQHDAhTYW4gSm9zZTEcMBoGA1UECgwTQ2lzY28gU3lzdGVtcywgSW5jLjEMMAoGA1UECwwDQ1NHMRQwEgYDVQQDDAsqLndlYmV4LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ14yGFLwwhhZyxegl+wYbyZZp5q4NComRXAz+k8ibNrPp+x46qW\/Dt++MdupJ8y605K5KTQVb24unmPF+pZq1par5YBKMjJrJTW2aAI1MtQvRzSDCNhdWyxiP6SkVBm6ZOcLwL+kijn\/nCot5orO1NrHHFG\/HBcSk1aaetoitrjs5BWuMxdYuIZvzSoyViVbo\/w\/LUKXdD0rlOcFmOxtcf+VKb7w1eyku07Jp94m\/\/ILLQS\/jy7ymRyfGFnPLtNqBmUKFg+uAD7JcHZiy8g6quVEhEZdm3O+tUR2wYZ5in9yKcrxqoHwhW0O4X2\/rJ4mNDvikIgaWiSNW7eIoh0NWECAwEAAaOCAWQwggFgMBYGA1UdEQQPMA2CCyoud2ViZXguY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH\/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYDVR0jBBgwFoAUX2DPYZBV34RDFIpgKrL1evRDGO8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Muc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAFNF1YB0fCkEyxRc1VQO7NUZao+PnZuavjgeTnyTKmHl\/4Zxh1Xg\/M\/f\/RHSrGrgUW2xaSZN\/Dwt2hqMtIi\/b\/AgOFeqNKmMxH3nWxf6f1Lr7QoTvApLQGqjeuIT3U6AiRMt4Ksgfx7+1Vbil1AaILo859VgXSMgVJTv4QpUpzg\/EKtUqPwMwq8PvwoTjlewyOt9YbCxNTO91JkKsYuwm7uUeU7Fx+r+rP+wgDwYVbbsUwQXAbj7QOj3dkPLzn+gcrhK1ZlgFf7Ti34xrqj7jNiaMc0dYh\/Ns3KCHMTs5rVCGLIk7lEgovwLDbJtuuQTlvaHoeZIGVPqROi5Bl\/WxAgAFPDCCBTgwggQgoAMCAQICEFE\/uXQ4cLc0QEGNMJMGmf8wDQYJKoZIhvcNAQELBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MB4XDTEzMTAzMTAwMDAwMFoXDTIzMTAzMDIzNTk1OVowfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLYBcocdC21F1Y5xUpSCZboS9gM8WifmkIoYsOlMFN+VRGCWwN6DS\/heQTJtJZ3GYEBlFn5vPd6mSeCLbeD3Vonf7IDepxTJelIH0ZPyJ0p+L55Vvb3\/dk6aNqLS4IzQRLDyDzM1pZ6hCEaIgQDJxeLHGhhkw8OUYAzHbS1zut+0GKs7rN7AXTvaTXrytU9qe6XmMqNqkQOJZlKFZakzm0CVB8qaibiBjpjSKy0TNF1k1D\/Ey\/W2uHGGPWfySVd8wA63iZNtCkJzQ89I28WSoEW+\/KDEMO41thVMj3xvQ+9jFKVShaXelIhY3UvFvnEZr71tQnY\/ycAzUR8b0s\/sPcCAwEAAaOCAWMwggFfMBIGA1UdEwEB\/wQIMAYBAf8CAQAwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNiLmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vczIuc3ltY2IuY29tMGsGA1UdIARkMGIwYAYKYIZIAYb4RQEHNjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMB8GA1UdIwQYMBaAFH\/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBCwUAA4IBAQBelFZJ3Y4tZfXBNlG2A+PannMZ8h9Zq1h+bCYFLPqB11wjFyIsN5P3huyF5rCj\/R\/iMqhFb+HZ+7mv0nCgMkJlv4T+FiqPP8Wm1qOTfUPpdCGRNSj0Y+ku7ff1XH9LmrUg6Qq94EUQDBSUml2l40uR6CSbRkBl9CJyzZn4iBH183\/mM4LmqMV+\/tAI4iVYCHFo5s2i5hTeTlIkLf3leRNT514vLU0bbUAVUiv3h4l4EoFu2U2qLXjUwiw9CF+HkZ4fDrDeMFJkhomqnWacDnYMgPJ02Cr4uDrO19YPEb5rqxT1vUGgImOJ8boPbyljZi0\/rIxyxfvH5NQP8jtPjCnHAATUMIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ\/XxrcgxiV0i6CqqpkKzj\/i5Vbext0uz\/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6\/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn\/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4\/VBEnkjWNHiDxpg8v+R70rfk\/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10\/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH\/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB\/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW\/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3\/DgAAAA=="}
-01113{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":335,"source":"webex.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":6,"flow_first_seen":1444570636160,"flow_last_seen":1444570636701,"flow_tot_l4_data_len":4110,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":685,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"209.197.222.159","src_port":47498,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01124{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":335,"source":"webex.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":6,"flow_first_seen":1444570636160,"flow_last_seen":1444570636701,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":3970,"flow_avg_l4_payload_len":661,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"209.197.222.159","src_port":47498,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 03884{"flow_id":15,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":336,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":703657,"pkt_caplen":2633,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2633,"pkt_l4_len":2599,"pkt":"ABoRAAACABoRAAABCABFAAo7Aa9AABAGrDVARGiMCggAAQG7rcyGeQ7aeYb2tlAY\/\/+\/QgAAMIIEIKADAgECAhBRP7l0OHC3NEBBjTCTBpn\/MA0GCSqGSIb3DQEBCwUAMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA2IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHNTAeFw0xMzEwMzEwMDAwMDBaFw0yMzEwMzAyMzU5NTlaMH4xCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEvMC0GA1UEAxMmU3ltYW50ZWMgQ2xhc3MgMyBTZWN1cmUgU2VydmVyIENBIC0gRzQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCy2AXKHHQttRdWOcVKUgmW6EvYDPFon5pCKGLDpTBTflURglsDeg0v4XkEybSWdxmBAZRZ+bz3epkngi23g91aJ3+yA3qcUyXpSB9GT8idKfi+eVb29\/3ZOmjai0uCM0ESw8g8zNaWeoQhGiIEAycXixxoYZMPDlGAMx20tc7rftBirO6zewF072k168rVPanul5jKjapEDiWZShWWpM5tAlQfKmom4gY6Y0istEzRdZNQ\/xMv1trhxhj1n8klXfMAOt4mTbQpCc0PPSNvFkqBFvvygxDDuNbYVTI98b0PvYxSlUoWl3pSIWN1Lxb5xGa+9bUJ2P8nAM1EfG9LP7D3AgMBAAGjggFjMIIBXzASBgNVHRMBAf8ECDAGAQH\/AgEAMDAGA1UdHwQpMCcwJaAjoCGGH2h0dHA6Ly9zMS5zeW1jYi5jb20vcGNhMy1nNS5jcmwwDgYDVR0PAQH\/BAQDAgEGMC8GCCsGAQUFBwEBBCMwITAfBggrBgEFBQcwAYYTaHR0cDovL3MyLnN5bWNiLmNvbTBrBgNVHSAEZDBiMGAGCmCGSAGG+EUBBzYwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM0MB0GA1UdDgQWBBRfYM9hkFXfhEMUimAqsvV69EMY7zAfBgNVHSMEGDAWgBR\/02Wnwt3su\/AwCfNDOfoCrzMxMzANBgkqhkiG9w0BAQsFAAOCAQEAXpRWSd2OLWX1wTZRtgPj2p5zGfIfWatYfmwmBSz6gddcIxciLDeT94bsheawo\/0f4jKoRW\/h2fu5r9JwoDJCZb+E\/hYqjz\/Fptajk31D6XQhkTUo9GPpLu339Vx\/S5q1IOkKveBFEAwUlJpdpeNLkegkm0ZAZfQics2Z+IgR9fN\/5jOC5qjFfv7QCOIlWAhxaObNouYU3k5SJC395XkTU+deLy1NG21AFVIr94eJeBKBbtlNqi141MIsPQhfh5GeHw6w3jBSZIaJqp1mnA52DIDydNgq+Lg6ztfWDxG+a6sU9b1BoCJjifG6D28pY2YtP6yMcsX7x+TUD\/I7T4wpxwAE1DCCBNAwggQ5oAMCAQICECUM6OAwYS6fK4n3BU18+P0wDQYJKoZIhvcNAQEFBQAwXzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA2MTEwODAwMDAwMFoXDTIxMTEwNzIzNTk1OVowgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAryQICCl6NZ5gDKrnSztO3Hy8PEUcuyvg\/ikC+VcIo2SFFSf18a3IMYldIugqqqZCs4\/4uVW3sbdLs\/6PfgdX7O9D22ZiFWHPYA2k2N744MNiCD1UE+tJyllUhSblK48bn+v1oZHCM0nYQ2NqUkvSj+hwUU3RiWl7x3D2s9wSdNt7XUtW05a\/FXehsPSiJfKvHJJnGOX0BgTvkLnkAOTdOrUZ\/wK69Dzu4IvrN4vs9Nes8vbwPa\/ddZEzGR0cQMt0JBkhk9kU\/qwqUseP1QRJ5I1jR4g8aYPL\/ke9K35PxZWuDp3U0UPAZ3PjFAh+5T+fc7gzCs9dPzSHloruU+glFQIDAQABo4IBmzCCAZcwDwYDVR0TAQH\/BAUwAwEB\/zAxBgNVHR8EKjAoMCagJKAihiBodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9wY2EzLmNybDAOBgNVHQ8BAf8EBAMCAQYwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9jcHMwHQYDVR0OBBYEFH\/TZafC3ey78DAJ80M5+gKvMzEzMG0GCCsGAQUFBwEMBGEwX6FdoFswWTBXMFUWCWltYWdlL2dpZjAhMB8wBwYFKw4DAhoEFI\/l0xqGrI2Oa8PPgGrUSBgsexkuMCUWI2h0dHA6Ly9sb2dvLnZlcmlzaWduLmNvbS92c2xvZ28uZ2lmMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AudmVyaXNpZ24uY29tMD4GA1UdJQQ3MDUGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCWCGSAGG+EIEAQYKYIZIAYb4RQEIATANBgkqhkiG9w0BAQUFAAOBgQATAt346IYA8lr4+CAMWYhiB87O9075u1mhmOXhON1OvGYY063rGPINyW0+SpQgwzy6vWVUxq9EsxCtLGs+q9cHtriBY8X5Xi7lKmfOzTMMKteJVgMjH7O+6DoIWbTsRTX3ilv\/Zs9Qr8ZtV40ZeLe5otFX6h+aS6+6yY4Sfsa9\/w4AAAA="}
-01111{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":336,"source":"webex.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":8,"flow_first_seen":1444570636248,"flow_last_seen":1444570636703,"flow_tot_l4_data_len":4182,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2599,"flow_avg_l4_data_len":522,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.104.140","src_port":44492,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01122{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":336,"source":"webex.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":8,"flow_first_seen":1444570636248,"flow_last_seen":1444570636703,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2579,"flow_tot_l4_payload_len":4002,"flow_avg_l4_payload_len":500,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.104.140","src_port":44492,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00409{"flow_id":12,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":337,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":704202,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo0G9AAEAGr\/IKCAAB0cXen7mKAbt7nBLGhGP8vVAQTE\/eTQAA"}
 04347{"flow_id":17,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":338,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":705030,"pkt_caplen":2974,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2974,"pkt_l4_len":2940,"pkt":"ABoRAAACABoRAAABCABFAAuQAbBAABAGoXCt8wRMCggAAQG7zfr1hdJNCnot81AY\/\/8g1gAAFgMBDz4CAAAtAwFWGf8rmqTEjYV3fKJgrv6xsqvAH8t8a+41N1gtskOvYQAANQAABf8BAAEACwAPBQAPAgAE6TCCBOUwggPNoAMCAQICECl0ianUHkm+YfeBaUbmIfMwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDAeFw0xNTA0MTAwMDAwMDBaFw0xODA0MTAyMzU5NTlaMHcxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMREwDwYDVQQHDAhTYW4gSm9zZTEcMBoGA1UECgwTQ2lzY28gU3lzdGVtcywgSW5jLjEMMAoGA1UECwwDQ1NHMRQwEgYDVQQDDAsqLndlYmV4LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ14yGFLwwhhZyxegl+wYbyZZp5q4NComRXAz+k8ibNrPp+x46qW\/Dt++MdupJ8y605K5KTQVb24unmPF+pZq1par5YBKMjJrJTW2aAI1MtQvRzSDCNhdWyxiP6SkVBm6ZOcLwL+kijn\/nCot5orO1NrHHFG\/HBcSk1aaetoitrjs5BWuMxdYuIZvzSoyViVbo\/w\/LUKXdD0rlOcFmOxtcf+VKb7w1eyku07Jp94m\/\/ILLQS\/jy7ymRyfGFnPLtNqBmUKFg+uAD7JcHZiy8g6quVEhEZdm3O+tUR2wYZ5in9yKcrxqoHwhW0O4X2\/rJ4mNDvikIgaWiSNW7eIoh0NWECAwEAAaOCAWQwggFgMBYGA1UdEQQPMA2CCyoud2ViZXguY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH\/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYDVR0jBBgwFoAUX2DPYZBV34RDFIpgKrL1evRDGO8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Muc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAFNF1YB0fCkEyxRc1VQO7NUZao+PnZuavjgeTnyTKmHl\/4Zxh1Xg\/M\/f\/RHSrGrgUW2xaSZN\/Dwt2hqMtIi\/b\/AgOFeqNKmMxH3nWxf6f1Lr7QoTvApLQGqjeuIT3U6AiRMt4Ksgfx7+1Vbil1AaILo859VgXSMgVJTv4QpUpzg\/EKtUqPwMwq8PvwoTjlewyOt9YbCxNTO91JkKsYuwm7uUeU7Fx+r+rP+wgDwYVbbsUwQXAbj7QOj3dkPLzn+gcrhK1ZlgFf7Ti34xrqj7jNiaMc0dYh\/Ns3KCHMTs5rVCGLIk7lEgovwLDbJtuuQTlvaHoeZIGVPqROi5Bl\/WxAgAFPDCCBTgwggQgoAMCAQICEFE\/uXQ4cLc0QEGNMJMGmf8wDQYJKoZIhvcNAQELBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MB4XDTEzMTAzMTAwMDAwMFoXDTIzMTAzMDIzNTk1OVowfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLYBcocdC21F1Y5xUpSCZboS9gM8WifmkIoYsOlMFN+VRGCWwN6DS\/heQTJtJZ3GYEBlFn5vPd6mSeCLbeD3Vonf7IDepxTJelIH0ZPyJ0p+L55Vvb3\/dk6aNqLS4IzQRLDyDzM1pZ6hCEaIgQDJxeLHGhhkw8OUYAzHbS1zut+0GKs7rN7AXTvaTXrytU9qe6XmMqNqkQOJZlKFZakzm0CVB8qaibiBjpjSKy0TNF1k1D\/Ey\/W2uHGGPWfySVd8wA63iZNtCkJzQ89I28WSoEW+\/KDEMO41thVMj3xvQ+9jFKVShaXelIhY3UvFvnEZr71tQnY\/ycAzUR8b0s\/sPcCAwEAAaOCAWMwggFfMBIGA1UdEwEB\/wQIMAYBAf8CAQAwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNiLmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vczIuc3ltY2IuY29tMGsGA1UdIARkMGIwYAYKYIZIAYb4RQEHNjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMB8GA1UdIwQYMBaAFH\/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBCwUAA4IBAQBelFZJ3Y4tZfXBNlG2A+PannMZ8h9Zq1h+bCYFLPqB11wjFyIsN5P3huyF5rCj\/R\/iMqhFb+HZ+7mv0nCgMkJlv4T+FiqPP8Wm1qOTfUPpdCGRNSj0Y+ku7ff1XH9LmrUg6Qq94EUQDBSUml2l40uR6CSbRkBl9CJyzZn4iBH183\/mM4LmqMV+\/tAI4iVYCHFo5s2i5hTeTlIkLf3leRNT514vLU0bbUAVUiv3h4l4EoFu2U2qLXjUwiw9CF+HkZ4fDrDeMFJkhomqnWacDnYMgPJ02Cr4uDrO19YPEb5rqxT1vUGgImOJ8boPbyljZi0\/rIxyxfvH5NQP8jtPjCnHAATUMIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOA=="}
 00407{"flow_id":15,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":339,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":705760,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoNItAAEAGU2wKCAABQERojK3MAbt5hva2hnkY7VAQUJjtNwAA"}
 00407{"flow_id":17,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":340,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":706197,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo70VAAEAGj0IKCAABrfMETM36AbsKei3z9YXdtVAQT9jIVQAA"}
 01741{"flow_id":17,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":341,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":706939,"pkt_caplen":1041,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1041,"pkt_l4_len":1007,"pkt":"ABoRAAACABoRAAABCABFAAQDAbFAABAGqPyt8wRMCggAAQG7zfr1hd21Cnot81AY\/\/+3iQAABgNVBAsTMShjKSAyMDA2IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8kCAgpejWeYAyq50s7Ttx8vDxFHLsr4P4pAvlXCKNkhRUn9fGtyDGJXSLoKqqmQrOP+LlVt7G3S7P+j34HV+zvQ9tmYhVhz2ANpNje+ODDYgg9VBPrScpZVIUm5SuPG5\/r9aGRwjNJ2ENjalJL0o\/ocFFN0Ylpe8dw9rPcEnTbe11LVtOWvxV3obD0oiXyrxySZxjl9AYE75C55ADk3Tq1Gf8CuvQ87uCL6zeL7PTXrPL28D2v3XWRMxkdHEDLdCQZIZPZFP6sKlLHj9UESeSNY0eIPGmDy\/5HvSt+T8WVrg6d1NFDwGdz4xQIfuU\/n3O4MwrPXT80h5aK7lPoJRUCAwEAAaOCAZswggGXMA8GA1UdEwEB\/wQFMAMBAf8wMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMy5jcmwwDgYDVR0PAQH\/BAQDAgEGMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vY3BzMB0GA1UdDgQWBBR\/02Wnwt3su\/AwCfNDOfoCrzMxMzBtBggrBgEFBQcBDARhMF+hXaBbMFkwVzBVFglpbWFnZS9naWYwITAfMAcGBSsOAwIaBBSP5dMahqyNjmvDz4Bq1EgYLHsZLjAlFiNodHRwOi8vbG9nby52ZXJpc2lnbi5jb20vdnNsb2dvLmdpZjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTA+BgNVHSUENzA1BggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBglghkgBhvhCBAEGCmCGSAGG+EUBCAEwDQYJKoZIhvcNAQEFBQADgYEAEwLd+OiGAPJa+PggDFmIYgfOzvdO+btZoZjl4TjdTrxmGNOt6xjyDcltPkqUIMM8ur1lVMavRLMQrSxrPqvXB7a4gWPF+V4u5Spnzs0zDCrXiVYDIx+zvug6CFm07EU194pb\/2bPUK\/GbVeNGXi3uaLRV+ofmkuvusmOEn7Gvf8OAAAA"}
-01110{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":341,"source":"webex.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":8,"flow_first_seen":1444570636255,"flow_last_seen":1444570636706,"flow_tot_l4_data_len":4150,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2940,"flow_avg_l4_data_len":518,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.4.76","src_port":52730,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01121{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":341,"source":"webex.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":8,"flow_first_seen":1444570636255,"flow_last_seen":1444570636706,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2920,"flow_tot_l4_payload_len":3970,"flow_avg_l4_payload_len":496,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.4.76","src_port":52730,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00407{"flow_id":17,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":342,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":707337,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo70ZAAEAGj0EKCAABrfMETM36AbsKei3z9YXhkFAQZqitqgAA"}
 01052{"flow_id":14,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":343,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":720192,"pkt_caplen":528,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":528,"pkt_l4_len":494,"pkt":"ABoRAAACABoRAAABCABFAAICnxVAAEAGamcKCAABPm3nA7L2AbufQl9pYL2xm1AYTvhkIAAAFwMBACB3C9lWLtSxCr74F+P7WC+tzib0fsc5+dwNBTzRkQ+jLBcDAQGwwSJTKS5td9FItkSmZW7S9M4+MdlGodmbw8B\/UmfU6mVq47gcpEXfv6lCsX3yLgGK351qzwEjOwh0r+GAA1s\/5ZmEAiDgvunOPbGg6XzdNUiAMroWTVuFaTw5IiGh0MMAEuqBFtHvmmmvIoSgqkgFSxefoiCIE\/SJm7V\/f5Xl2DhL\/sTUt4oLPfaQ9+y0+CqWYaUWlNtMG3zbhDk7VEZem+QOR\/86TBym1rBAzgActYZxmxAr4ZzRXVZ8mn8kZEyaup4JF\/khofRR8tRvk8sCL+e9jS27xVb7FSRMSa+a5ydzA1U+nZf4TcOU2QOumwjpo5KgClMy45902ObAorPnMYN4kUlcNAVWuVZHZsAM5Sl0WCwuYRWHnrd60P5IkMjFIgNmj7mjbJyQnb+4pzqZeq2GTxZXwZX+\/olfxcjjg84cDobM7I+Ux8oBcL4B\/ULghXfkxNRrFgPUXpC9UsbV21KIY3QulG7CeWi1aj6K3vEpeTJHb5pVYxj4Uys7gVr0VJxN5MNnAbHaWjNw0SK7St32Pqg5DmC7mt5Y+Qle4fgPQh5rLqk5AUVFrocorQ1P"}
 00410{"flow_id":14,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":344,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":720856,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAbJAABAGOaU+becDCggAAQG7svZgvbGbn0JhQ1AQ\/\/+4ygAA"}
 00852{"flow_id":12,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":345,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":772489,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFu0HBAAEAGrqsKCAAB0cXen7mKAbt7nBLGhGP8vVAYTE9m9wAAFgMBAQYQAAECAQBh6Iy9x2yr2m3xCdPZgNEdWjzbtsH2sPvYvNbtEMZmEUi3Vyw3BcED3uFDM2yCVMFHZc6N1UUEiCo9ZhNym\/qc8HGIV0wYsojyO62X3SvuITZcIJCPTGFtS+OURqXOoXomLux2q1+8brIHtkd2xeug0MRBTcwpvvKWy\/DTUhJQEnk2vcibEAvCyV7G\/ezNsHrddU0d\/TZOID\/yLw9ZRFpxDH7NweWg16f5lT7lvRKnmbeFiP0y0S85VqXzj5Nt6P2qIn+1cRcJlHovSBcrMHg2xbrkBddhfwcca8oJMbmRfXyiJNgU4LW9mTyL7XYEpFKfcR91vzNimh+l07SYSpVCFAMBAAEBFgMBADBcUhS76c+8eQPT3fB901S73VeGweczs1DsGD9TAdI0\/OBKBz8qREHhH3ROFJlUi8k="}
 00411{"flow_id":12,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":346,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":772793,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAbNAABAGrq\/Rxd6fCggAAQG7uYqEY\/y9e5wUDFAQ\/\/8pVwAA"}
 05676{"flow_id":13,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":347,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":773132,"pkt_caplen":3961,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3961,"pkt_l4_len":3927,"pkt":"ABoRAAACABoRAAABCABFAA9rAbRAABAGlfNARHmZCggAAQG74S8Y3E7M5yOxdFAY\/\/+LZAAAFgMBDz4CAAAtAwFWGmYROltx5TnOap9UIE\/2w1MWBK1my7lSyNNjjVz6WgAANQAABf8BAAEACwAPBQAPAgAE6TCCBOUwggPNoAMCAQICECl0ianUHkm+YfeBaUbmIfMwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDAeFw0xNTA0MTAwMDAwMDBaFw0xODA0MTAyMzU5NTlaMHcxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMREwDwYDVQQHDAhTYW4gSm9zZTEcMBoGA1UECgwTQ2lzY28gU3lzdGVtcywgSW5jLjEMMAoGA1UECwwDQ1NHMRQwEgYDVQQDDAsqLndlYmV4LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ14yGFLwwhhZyxegl+wYbyZZp5q4NComRXAz+k8ibNrPp+x46qW\/Dt++MdupJ8y605K5KTQVb24unmPF+pZq1par5YBKMjJrJTW2aAI1MtQvRzSDCNhdWyxiP6SkVBm6ZOcLwL+kijn\/nCot5orO1NrHHFG\/HBcSk1aaetoitrjs5BWuMxdYuIZvzSoyViVbo\/w\/LUKXdD0rlOcFmOxtcf+VKb7w1eyku07Jp94m\/\/ILLQS\/jy7ymRyfGFnPLtNqBmUKFg+uAD7JcHZiy8g6quVEhEZdm3O+tUR2wYZ5in9yKcrxqoHwhW0O4X2\/rJ4mNDvikIgaWiSNW7eIoh0NWECAwEAAaOCAWQwggFgMBYGA1UdEQQPMA2CCyoud2ViZXguY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH\/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYDVR0jBBgwFoAUX2DPYZBV34RDFIpgKrL1evRDGO8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Muc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAFNF1YB0fCkEyxRc1VQO7NUZao+PnZuavjgeTnyTKmHl\/4Zxh1Xg\/M\/f\/RHSrGrgUW2xaSZN\/Dwt2hqMtIi\/b\/AgOFeqNKmMxH3nWxf6f1Lr7QoTvApLQGqjeuIT3U6AiRMt4Ksgfx7+1Vbil1AaILo859VgXSMgVJTv4QpUpzg\/EKtUqPwMwq8PvwoTjlewyOt9YbCxNTO91JkKsYuwm7uUeU7Fx+r+rP+wgDwYVbbsUwQXAbj7QOj3dkPLzn+gcrhK1ZlgFf7Ti34xrqj7jNiaMc0dYh\/Ns3KCHMTs5rVCGLIk7lEgovwLDbJtuuQTlvaHoeZIGVPqROi5Bl\/WxAgAFPDCCBTgwggQgoAMCAQICEFE\/uXQ4cLc0QEGNMJMGmf8wDQYJKoZIhvcNAQELBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MB4XDTEzMTAzMTAwMDAwMFoXDTIzMTAzMDIzNTk1OVowfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLYBcocdC21F1Y5xUpSCZboS9gM8WifmkIoYsOlMFN+VRGCWwN6DS\/heQTJtJZ3GYEBlFn5vPd6mSeCLbeD3Vonf7IDepxTJelIH0ZPyJ0p+L55Vvb3\/dk6aNqLS4IzQRLDyDzM1pZ6hCEaIgQDJxeLHGhhkw8OUYAzHbS1zut+0GKs7rN7AXTvaTXrytU9qe6XmMqNqkQOJZlKFZakzm0CVB8qaibiBjpjSKy0TNF1k1D\/Ey\/W2uHGGPWfySVd8wA63iZNtCkJzQ89I28WSoEW+\/KDEMO41thVMj3xvQ+9jFKVShaXelIhY3UvFvnEZr71tQnY\/ycAzUR8b0s\/sPcCAwEAAaOCAWMwggFfMBIGA1UdEwEB\/wQIMAYBAf8CAQAwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNiLmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vczIuc3ltY2IuY29tMGsGA1UdIARkMGIwYAYKYIZIAYb4RQEHNjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMB8GA1UdIwQYMBaAFH\/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBCwUAA4IBAQBelFZJ3Y4tZfXBNlG2A+PannMZ8h9Zq1h+bCYFLPqB11wjFyIsN5P3huyF5rCj\/R\/iMqhFb+HZ+7mv0nCgMkJlv4T+FiqPP8Wm1qOTfUPpdCGRNSj0Y+ku7ff1XH9LmrUg6Qq94EUQDBSUml2l40uR6CSbRkBl9CJyzZn4iBH183\/mM4LmqMV+\/tAI4iVYCHFo5s2i5hTeTlIkLf3leRNT514vLU0bbUAVUiv3h4l4EoFu2U2qLXjUwiw9CF+HkZ4fDrDeMFJkhomqnWacDnYMgPJ02Cr4uDrO19YPEb5rqxT1vUGgImOJ8boPbyljZi0\/rIxyxfvH5NQP8jtPjCnHAATUMIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ\/XxrcgxiV0i6CqqpkKzj\/i5Vbext0uz\/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6\/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn\/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4\/VBEnkjWNHiDxpg8v+R70rfk\/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10\/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH\/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB\/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW\/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3\/DgAAAA=="}
-01111{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":347,"source":"webex.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":6,"flow_first_seen":1444570636170,"flow_last_seen":1444570636773,"flow_tot_l4_data_len":4110,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":685,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.153","src_port":57647,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01122{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":347,"source":"webex.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":6,"flow_first_seen":1444570636170,"flow_last_seen":1444570636773,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":3970,"flow_avg_l4_payload_len":661,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.153","src_port":57647,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00854{"flow_id":15,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":348,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":773401,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFuNIxAAEAGUiUKCAABQERojK3MAbt5hva2hnkY7VAYUJjxsAAAFgMBAQYQAAECAQCZ6rrS4j7mksPkLANY2EpSpokmY5Lee+lBKCPpOZHfXp1fFLLNPE035x828S0y1EQDc8njA4rf5c3IoOBYAkW4m7x696LVX0ih7Y9CqgDL1B6yna5cRmn4YKD6c4mm38UvSifo5Tbq3QqtilkVc\/cK33qCDjCCDXA+yVGIexfPvbK4k53WTVK8dLRuY0CANraDoA3h61IpLC\/B\/jk\/Rtn1wmsqHWabMvWg5D8GlA+L\/Cu7bVhuv8KWI1WKDYR2icRl9PPlwJXiloUSEnsZFI8uNeVW9rTd0c4rLhiMlN8qWEup34ROCZLfJTafKUhn3VVU\/xejWCs4ig95w71MCUcLFAMBAAEBFgMBADBtORReP+0N+C\/5qD8bapB7MJQN7MZ8HQW6AXEUh6YL1FDSZove7qK9Vb4bbl+fd1M="}
 00411{"flow_id":15,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":349,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":773617,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAbVAABAGtkJARGiMCggAAQG7rcyGeRjteYb3\/FAQ\/\/88igAA"}
 00855{"flow_id":17,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":350,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":773896,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFu70dAAEAGjfoKCAABrfMETM36AbsKei3z9YXhkFAYZqi3+AAAFgMBAQYQAAECAQCKYf+wQGVh16cvfGjmi+GjYexIJm3TjXJPQzGPzrUE\/rqhEkIr7YcPINyJlXOCyVqjuVdxcCJ9NitnLXN0JUMUOPpX1k\/+dR5lsOpXrw+iQEqYfMCKPIl51Avar9s6c0b\/ccBZc3E4Xk4W0JBzPouJSIh+s9tpjD3dDUTtfiDyNHb6jRPnnf\/JiQzulWVG1ivFkeLZJoMEcg3Bz5YXkgCst4aBDx\/i+f5wtPnes2p1TvMaH\/2l8EMcbjUPWkrxFuQ5v1XnY4iyKRCXogYzxL6831ZTV5a223WqO1DNFgnRfcEIzkfayoqcHiojx\/Y2TXv22pPHpvT7t457TCsOF\/twFAMBAAEBFgMBADCi6GXiKEfVocs4Smlug8p+Nv1D6I8BZ0cMreVLJb83ihj9gmorDGb0EK3FcaLV+bg="}
@@ -255,11 +255,11 @@
 02250{"flow_id":21,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":353,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":775737,"pkt_caplen":1414,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1414,"pkt_l4_len":1380,"pkt":"ABoRAAACABoRAAABCABFAAV4AbdAABAGsBtARGlhCggAAQG7yKr7mNWFBGcqu1AY\/\/8alwAAFgMBD14CAABNAwFWGmYSOq7AeK\/VHzv7nfWztvaQXy0YwTsZ5fll9syYzSDLAwedTzll\/9Nw9s31KtozYpSn8DlGZoSiw+AYRlhTSAA1AAAF\/wEAAQALAA8FAA8CAATpMIIE5TCCA82gAwIBAgIQKXSJqdQeSb5h94FpRuYh8zANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MB4XDTE1MDQxMDAwMDAwMFoXDTE4MDQxMDIzNTk1OVowdzELMAkGA1UEBhMCdXMxEzARBgNVBAgMCkNhbGlmb3JuaWExETAPBgNVBAcMCFNhbiBKb3NlMRwwGgYDVQQKDBNDaXNjbyBTeXN0ZW1zLCBJbmMuMQwwCgYDVQQLDANDU0cxFDASBgNVBAMMCyoud2ViZXguY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnXjIYUvDCGFnLF6CX7BhvJlmnmrg0KiZFcDP6TyJs2s+n7Hjqpb8O374x26knzLrTkrkpNBVvbi6eY8X6lmrWlqvlgEoyMmslNbZoAjUy1C9HNIMI2F1bLGI\/pKRUGbpk5wvAv6SKOf+cKi3mis7U2sccUb8cFxKTVpp62iK2uOzkFa4zF1i4hm\/NKjJWJVuj\/D8tQpd0PSuU5wWY7G1x\/5UpvvDV7KS7Tsmn3ib\/8gstBL+PLvKZHJ8YWc8u02oGZQoWD64APslwdmLLyDqq5USERl2bc761RHbBhnmKf3IpyvGqgfCFbQ7hfb+sniY0O+KQiBpaJI1bt4iiHQ1YQIDAQABo4IBZDCCAWAwFgYDVR0RBA8wDYILKi53ZWJleC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGUGA1UdIAReMFwwWgYKYIZIAYb4RQEHNjBMMCMGCCsGAQUFBwIBFhdodHRwczovL2Quc3ltY2IuY29tL2NwczAlBggrBgEFBQcCAjAZGhdodHRwczovL2Quc3ltY2IuY29tL3JwYTAfBgNVHSMEGDAWgBRfYM9hkFXfhEMUimAqsvV69EMY7zArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNybDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zcy5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9zcy5zeW1jYi5jb20vc3MuY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAU0XVgHR8KQTLFFzVVA7s1Rlqj4+dm5q+OB5OfJMqYeX\/hnGHVeD8z9\/9EdKsauBRbbFpJk38PC3aGoy0iL9v8CA4V6o0qYzEfedbF\/p\/UuvtChO8CktAaqN64hPdToCJEy3gqyB\/Hv7VVuKXUBogujzn1WBdIyBUlO\/hClSnOD8Qq1So\/AzCrw+\/ChOOV7DI631hsLE1M73UmQqxi7Cbu5R5TsXH6v6s\/7CAPBhVtuxTBBcBuPtA6Pd2Q8vOf6ByuErVmWAV\/tOLfjGuqPuM2JoxzR1iH82zcoIcxOzmtUIYsiTuUSCi\/AsNsm265BOW9oeh5kgZU+pE6LkGX9bECAAU8MIIFOA=="}
 00407{"flow_id":21,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":354,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":826252,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo6IRAAEAGnp0KCAABQERpYciqAbsEZyq7+5ja1VAQP8DsbwAA"}
 05710{"flow_id":22,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":355,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":827404,"pkt_caplen":3993,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3993,"pkt_l4_len":3959,"pkt":"ABoRAAACABoRAAABCABFAA+LAbhAABAGpgZARGliCggAAQG7kQkSUl7m7a2hWlAY\/\/9HlQAAFgMBD14CAABNAwFWGmYSAx+RVmmZg899fGqSm6Bka6ywB4RCQzstiNYepSBKYiYj9vBvO3nJiUtMhL1sij4kR4946TgIFLn6SVhTSAA1AAAF\/wEAAQALAA8FAA8CAATpMIIE5TCCA82gAwIBAgIQKXSJqdQeSb5h94FpRuYh8zANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MB4XDTE1MDQxMDAwMDAwMFoXDTE4MDQxMDIzNTk1OVowdzELMAkGA1UEBhMCdXMxEzARBgNVBAgMCkNhbGlmb3JuaWExETAPBgNVBAcMCFNhbiBKb3NlMRwwGgYDVQQKDBNDaXNjbyBTeXN0ZW1zLCBJbmMuMQwwCgYDVQQLDANDU0cxFDASBgNVBAMMCyoud2ViZXguY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnXjIYUvDCGFnLF6CX7BhvJlmnmrg0KiZFcDP6TyJs2s+n7Hjqpb8O374x26knzLrTkrkpNBVvbi6eY8X6lmrWlqvlgEoyMmslNbZoAjUy1C9HNIMI2F1bLGI\/pKRUGbpk5wvAv6SKOf+cKi3mis7U2sccUb8cFxKTVpp62iK2uOzkFa4zF1i4hm\/NKjJWJVuj\/D8tQpd0PSuU5wWY7G1x\/5UpvvDV7KS7Tsmn3ib\/8gstBL+PLvKZHJ8YWc8u02oGZQoWD64APslwdmLLyDqq5USERl2bc761RHbBhnmKf3IpyvGqgfCFbQ7hfb+sniY0O+KQiBpaJI1bt4iiHQ1YQIDAQABo4IBZDCCAWAwFgYDVR0RBA8wDYILKi53ZWJleC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGUGA1UdIAReMFwwWgYKYIZIAYb4RQEHNjBMMCMGCCsGAQUFBwIBFhdodHRwczovL2Quc3ltY2IuY29tL2NwczAlBggrBgEFBQcCAjAZGhdodHRwczovL2Quc3ltY2IuY29tL3JwYTAfBgNVHSMEGDAWgBRfYM9hkFXfhEMUimAqsvV69EMY7zArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNybDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zcy5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9zcy5zeW1jYi5jb20vc3MuY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAU0XVgHR8KQTLFFzVVA7s1Rlqj4+dm5q+OB5OfJMqYeX\/hnGHVeD8z9\/9EdKsauBRbbFpJk38PC3aGoy0iL9v8CA4V6o0qYzEfedbF\/p\/UuvtChO8CktAaqN64hPdToCJEy3gqyB\/Hv7VVuKXUBogujzn1WBdIyBUlO\/hClSnOD8Qq1So\/AzCrw+\/ChOOV7DI631hsLE1M73UmQqxi7Cbu5R5TsXH6v6s\/7CAPBhVtuxTBBcBuPtA6Pd2Q8vOf6ByuErVmWAV\/tOLfjGuqPuM2JoxzR1iH82zcoIcxOzmtUIYsiTuUSCi\/AsNsm265BOW9oeh5kgZU+pE6LkGX9bECAAU8MIIFODCCBCCgAwIBAgIQUT+5dDhwtzRAQY0wkwaZ\/zANBgkqhkiG9w0BAQsFADCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwHhcNMTMxMDMxMDAwMDAwWhcNMjMxMDMwMjM1OTU5WjB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAstgFyhx0LbUXVjnFSlIJluhL2AzxaJ+aQihiw6UwU35VEYJbA3oNL+F5BMm0lncZgQGUWfm893qZJ4Itt4PdWid\/sgN6nFMl6UgfRk\/InSn4vnlW9vf92Tpo2otLgjNBEsPIPMzWlnqEIRoiBAMnF4scaGGTDw5RgDMdtLXO637QYqzus3sBdO9pNevK1T2p7peYyo2qRA4lmUoVlqTObQJUHypqJuIGOmNIrLRM0XWTUP8TL9ba4cYY9Z\/JJV3zADreJk20KQnNDz0jbxZKgRb78oMQw7jW2FUyPfG9D72MUpVKFpd6UiFjdS8W+cRmvvW1Cdj\/JwDNRHxvSz+w9wIDAQABo4IBYzCCAV8wEgYDVR0TAQH\/BAgwBgEB\/wIBADAwBgNVHR8EKTAnMCWgI6Ahhh9odHRwOi8vczEuc3ltY2IuY29tL3BjYTMtZzUuY3JsMA4GA1UdDwEB\/wQEAwIBBjAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zMi5zeW1jYi5jb20wawYDVR0gBGQwYjBgBgpghkgBhvhFAQc2MFIwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vY3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vcnBhMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFTeW1hbnRlY1BLSS0xLTUzNDAdBgNVHQ4EFgQUX2DPYZBV34RDFIpgKrL1evRDGO8wHwYDVR0jBBgwFoAUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwDQYJKoZIhvcNAQELBQADggEBAF6UVkndji1l9cE2UbYD49qecxnyH1mrWH5sJgUs+oHXXCMXIiw3k\/eG7IXmsKP9H+IyqEVv4dn7ua\/ScKAyQmW\/hP4WKo8\/xabWo5N9Q+l0IZE1KPRj6S7t9\/Vcf0uatSDpCr3gRRAMFJSaXaXjS5HoJJtGQGX0InLNmfiIEfXzf+YzguaoxX7+0AjiJVgIcWjmzaLmFN5OUiQt\/eV5E1PnXi8tTRttQBVSK\/eHiXgSgW7ZTaoteNTCLD0IX4eRnh8OsN4wUmSGiaqdZpwOdgyA8nTYKvi4Os7X1g8RvmurFPW9QaAiY4nxug9vKWNmLT+sjHLF+8fk1A\/yO0+MKccABNQwggTQMIIEOaADAgECAhAlDOjgMGEunyuJ9wVNfPj9MA0GCSqGSIb3DQEBBQUAMF8xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjExMDgwMDAwMDBaFw0yMTExMDcyMzU5NTlaMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA2IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8kCAgpejWeYAyq50s7Ttx8vDxFHLsr4P4pAvlXCKNkhRUn9fGtyDGJXSLoKqqmQrOP+LlVt7G3S7P+j34HV+zvQ9tmYhVhz2ANpNje+ODDYgg9VBPrScpZVIUm5SuPG5\/r9aGRwjNJ2ENjalJL0o\/ocFFN0Ylpe8dw9rPcEnTbe11LVtOWvxV3obD0oiXyrxySZxjl9AYE75C55ADk3Tq1Gf8CuvQ87uCL6zeL7PTXrPL28D2v3XWRMxkdHEDLdCQZIZPZFP6sKlLHj9UESeSNY0eIPGmDy\/5HvSt+T8WVrg6d1NFDwGdz4xQIfuU\/n3O4MwrPXT80h5aK7lPoJRUCAwEAAaOCAZswggGXMA8GA1UdEwEB\/wQFMAMBAf8wMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMy5jcmwwDgYDVR0PAQH\/BAQDAgEGMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vY3BzMB0GA1UdDgQWBBR\/02Wnwt3su\/AwCfNDOfoCrzMxMzBtBggrBgEFBQcBDARhMF+hXaBbMFkwVzBVFglpbWFnZS9naWYwITAfMAcGBSsOAwIaBBSP5dMahqyNjmvDz4Bq1EgYLHsZLjAlFiNodHRwOi8vbG9nby52ZXJpc2lnbi5jb20vdnNsb2dvLmdpZjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTA+BgNVHSUENzA1BggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBglghkgBhvhCBAEGCmCGSAGG+EUBCAEwDQYJKoZIhvcNAQEFBQADgYEAEwLd+OiGAPJa+PggDFmIYgfOzvdO+btZoZjl4TjdTrxmGNOt6xjyDcltPkqUIMM8ur1lVMavRLMQrSxrPqvXB7a4gWPF+V4u5Spnzs0zDCrXiVYDIx+zvug6CFm07EU194pb\/2bPUK\/GbVeNGXi3uaLRV+ofmkuvusmOEn7Gvf8OAAAA"}
-01110{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":355,"source":"webex.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":6,"flow_first_seen":1444570636364,"flow_last_seen":1444570636827,"flow_tot_l4_data_len":4142,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3959,"flow_avg_l4_data_len":690,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.98","src_port":37129,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01121{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":355,"source":"webex.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":6,"flow_first_seen":1444570636364,"flow_last_seen":1444570636827,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3939,"flow_tot_l4_payload_len":4002,"flow_avg_l4_payload_len":667,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.98","src_port":37129,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 05711{"flow_id":23,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":356,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":828477,"pkt_caplen":3993,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3993,"pkt_l4_len":3959,"pkt":"ABoRAAACABoRAAABCABFAA+LAblAABAGpgBARGlnCggAAQG7oar5IuanBt0ZmVAY\/\/9Y1gAAFgMBD14CAABNAwFWGmYSnSyrvrtGFwtam\/nzusEr0jYvjfdu6uqr5P0OECCWvxpTLsqrLpjanZKIiqyuPBYNJWtzLd4kspwBSVhTSAA1AAAF\/wEAAQALAA8FAA8CAATpMIIE5TCCA82gAwIBAgIQKXSJqdQeSb5h94FpRuYh8zANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MB4XDTE1MDQxMDAwMDAwMFoXDTE4MDQxMDIzNTk1OVowdzELMAkGA1UEBhMCdXMxEzARBgNVBAgMCkNhbGlmb3JuaWExETAPBgNVBAcMCFNhbiBKb3NlMRwwGgYDVQQKDBNDaXNjbyBTeXN0ZW1zLCBJbmMuMQwwCgYDVQQLDANDU0cxFDASBgNVBAMMCyoud2ViZXguY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnXjIYUvDCGFnLF6CX7BhvJlmnmrg0KiZFcDP6TyJs2s+n7Hjqpb8O374x26knzLrTkrkpNBVvbi6eY8X6lmrWlqvlgEoyMmslNbZoAjUy1C9HNIMI2F1bLGI\/pKRUGbpk5wvAv6SKOf+cKi3mis7U2sccUb8cFxKTVpp62iK2uOzkFa4zF1i4hm\/NKjJWJVuj\/D8tQpd0PSuU5wWY7G1x\/5UpvvDV7KS7Tsmn3ib\/8gstBL+PLvKZHJ8YWc8u02oGZQoWD64APslwdmLLyDqq5USERl2bc761RHbBhnmKf3IpyvGqgfCFbQ7hfb+sniY0O+KQiBpaJI1bt4iiHQ1YQIDAQABo4IBZDCCAWAwFgYDVR0RBA8wDYILKi53ZWJleC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGUGA1UdIAReMFwwWgYKYIZIAYb4RQEHNjBMMCMGCCsGAQUFBwIBFhdodHRwczovL2Quc3ltY2IuY29tL2NwczAlBggrBgEFBQcCAjAZGhdodHRwczovL2Quc3ltY2IuY29tL3JwYTAfBgNVHSMEGDAWgBRfYM9hkFXfhEMUimAqsvV69EMY7zArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNybDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zcy5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9zcy5zeW1jYi5jb20vc3MuY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAU0XVgHR8KQTLFFzVVA7s1Rlqj4+dm5q+OB5OfJMqYeX\/hnGHVeD8z9\/9EdKsauBRbbFpJk38PC3aGoy0iL9v8CA4V6o0qYzEfedbF\/p\/UuvtChO8CktAaqN64hPdToCJEy3gqyB\/Hv7VVuKXUBogujzn1WBdIyBUlO\/hClSnOD8Qq1So\/AzCrw+\/ChOOV7DI631hsLE1M73UmQqxi7Cbu5R5TsXH6v6s\/7CAPBhVtuxTBBcBuPtA6Pd2Q8vOf6ByuErVmWAV\/tOLfjGuqPuM2JoxzR1iH82zcoIcxOzmtUIYsiTuUSCi\/AsNsm265BOW9oeh5kgZU+pE6LkGX9bECAAU8MIIFODCCBCCgAwIBAgIQUT+5dDhwtzRAQY0wkwaZ\/zANBgkqhkiG9w0BAQsFADCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwHhcNMTMxMDMxMDAwMDAwWhcNMjMxMDMwMjM1OTU5WjB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAstgFyhx0LbUXVjnFSlIJluhL2AzxaJ+aQihiw6UwU35VEYJbA3oNL+F5BMm0lncZgQGUWfm893qZJ4Itt4PdWid\/sgN6nFMl6UgfRk\/InSn4vnlW9vf92Tpo2otLgjNBEsPIPMzWlnqEIRoiBAMnF4scaGGTDw5RgDMdtLXO637QYqzus3sBdO9pNevK1T2p7peYyo2qRA4lmUoVlqTObQJUHypqJuIGOmNIrLRM0XWTUP8TL9ba4cYY9Z\/JJV3zADreJk20KQnNDz0jbxZKgRb78oMQw7jW2FUyPfG9D72MUpVKFpd6UiFjdS8W+cRmvvW1Cdj\/JwDNRHxvSz+w9wIDAQABo4IBYzCCAV8wEgYDVR0TAQH\/BAgwBgEB\/wIBADAwBgNVHR8EKTAnMCWgI6Ahhh9odHRwOi8vczEuc3ltY2IuY29tL3BjYTMtZzUuY3JsMA4GA1UdDwEB\/wQEAwIBBjAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zMi5zeW1jYi5jb20wawYDVR0gBGQwYjBgBgpghkgBhvhFAQc2MFIwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vY3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vcnBhMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFTeW1hbnRlY1BLSS0xLTUzNDAdBgNVHQ4EFgQUX2DPYZBV34RDFIpgKrL1evRDGO8wHwYDVR0jBBgwFoAUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwDQYJKoZIhvcNAQELBQADggEBAF6UVkndji1l9cE2UbYD49qecxnyH1mrWH5sJgUs+oHXXCMXIiw3k\/eG7IXmsKP9H+IyqEVv4dn7ua\/ScKAyQmW\/hP4WKo8\/xabWo5N9Q+l0IZE1KPRj6S7t9\/Vcf0uatSDpCr3gRRAMFJSaXaXjS5HoJJtGQGX0InLNmfiIEfXzf+YzguaoxX7+0AjiJVgIcWjmzaLmFN5OUiQt\/eV5E1PnXi8tTRttQBVSK\/eHiXgSgW7ZTaoteNTCLD0IX4eRnh8OsN4wUmSGiaqdZpwOdgyA8nTYKvi4Os7X1g8RvmurFPW9QaAiY4nxug9vKWNmLT+sjHLF+8fk1A\/yO0+MKccABNQwggTQMIIEOaADAgECAhAlDOjgMGEunyuJ9wVNfPj9MA0GCSqGSIb3DQEBBQUAMF8xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjExMDgwMDAwMDBaFw0yMTExMDcyMzU5NTlaMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA2IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8kCAgpejWeYAyq50s7Ttx8vDxFHLsr4P4pAvlXCKNkhRUn9fGtyDGJXSLoKqqmQrOP+LlVt7G3S7P+j34HV+zvQ9tmYhVhz2ANpNje+ODDYgg9VBPrScpZVIUm5SuPG5\/r9aGRwjNJ2ENjalJL0o\/ocFFN0Ylpe8dw9rPcEnTbe11LVtOWvxV3obD0oiXyrxySZxjl9AYE75C55ADk3Tq1Gf8CuvQ87uCL6zeL7PTXrPL28D2v3XWRMxkdHEDLdCQZIZPZFP6sKlLHj9UESeSNY0eIPGmDy\/5HvSt+T8WVrg6d1NFDwGdz4xQIfuU\/n3O4MwrPXT80h5aK7lPoJRUCAwEAAaOCAZswggGXMA8GA1UdEwEB\/wQFMAMBAf8wMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMy5jcmwwDgYDVR0PAQH\/BAQDAgEGMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vY3BzMB0GA1UdDgQWBBR\/02Wnwt3su\/AwCfNDOfoCrzMxMzBtBggrBgEFBQcBDARhMF+hXaBbMFkwVzBVFglpbWFnZS9naWYwITAfMAcGBSsOAwIaBBSP5dMahqyNjmvDz4Bq1EgYLHsZLjAlFiNodHRwOi8vbG9nby52ZXJpc2lnbi5jb20vdnNsb2dvLmdpZjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTA+BgNVHSUENzA1BggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBglghkgBhvhCBAEGCmCGSAGG+EUBCAEwDQYJKoZIhvcNAQEFBQADgYEAEwLd+OiGAPJa+PggDFmIYgfOzvdO+btZoZjl4TjdTrxmGNOt6xjyDcltPkqUIMM8ur1lVMavRLMQrSxrPqvXB7a4gWPF+V4u5Spnzs0zDCrXiVYDIx+zvug6CFm07EU194pb\/2bPUK\/GbVeNGXi3uaLRV+ofmkuvusmOEn7Gvf8OAAAA"}
-01111{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":356,"source":"webex.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":6,"flow_first_seen":1444570636387,"flow_last_seen":1444570636828,"flow_tot_l4_data_len":4142,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3959,"flow_avg_l4_data_len":690,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41386,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01122{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":356,"source":"webex.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":6,"flow_first_seen":1444570636387,"flow_last_seen":1444570636828,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3939,"flow_tot_l4_payload_len":4002,"flow_avg_l4_payload_len":667,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41386,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 03883{"flow_id":21,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":357,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":829761,"pkt_caplen":2633,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2633,"pkt_l4_len":2599,"pkt":"ABoRAAACABoRAAABCABFAAo7AbpAABAGq1VARGlhCggAAQG7yKr7mNrVBGcqu1AY\/\/+jjwAAMIIEIKADAgECAhBRP7l0OHC3NEBBjTCTBpn\/MA0GCSqGSIb3DQEBCwUAMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA2IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHNTAeFw0xMzEwMzEwMDAwMDBaFw0yMzEwMzAyMzU5NTlaMH4xCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEvMC0GA1UEAxMmU3ltYW50ZWMgQ2xhc3MgMyBTZWN1cmUgU2VydmVyIENBIC0gRzQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCy2AXKHHQttRdWOcVKUgmW6EvYDPFon5pCKGLDpTBTflURglsDeg0v4XkEybSWdxmBAZRZ+bz3epkngi23g91aJ3+yA3qcUyXpSB9GT8idKfi+eVb29\/3ZOmjai0uCM0ESw8g8zNaWeoQhGiIEAycXixxoYZMPDlGAMx20tc7rftBirO6zewF072k168rVPanul5jKjapEDiWZShWWpM5tAlQfKmom4gY6Y0istEzRdZNQ\/xMv1trhxhj1n8klXfMAOt4mTbQpCc0PPSNvFkqBFvvygxDDuNbYVTI98b0PvYxSlUoWl3pSIWN1Lxb5xGa+9bUJ2P8nAM1EfG9LP7D3AgMBAAGjggFjMIIBXzASBgNVHRMBAf8ECDAGAQH\/AgEAMDAGA1UdHwQpMCcwJaAjoCGGH2h0dHA6Ly9zMS5zeW1jYi5jb20vcGNhMy1nNS5jcmwwDgYDVR0PAQH\/BAQDAgEGMC8GCCsGAQUFBwEBBCMwITAfBggrBgEFBQcwAYYTaHR0cDovL3MyLnN5bWNiLmNvbTBrBgNVHSAEZDBiMGAGCmCGSAGG+EUBBzYwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM0MB0GA1UdDgQWBBRfYM9hkFXfhEMUimAqsvV69EMY7zAfBgNVHSMEGDAWgBR\/02Wnwt3su\/AwCfNDOfoCrzMxMzANBgkqhkiG9w0BAQsFAAOCAQEAXpRWSd2OLWX1wTZRtgPj2p5zGfIfWatYfmwmBSz6gddcIxciLDeT94bsheawo\/0f4jKoRW\/h2fu5r9JwoDJCZb+E\/hYqjz\/Fptajk31D6XQhkTUo9GPpLu339Vx\/S5q1IOkKveBFEAwUlJpdpeNLkegkm0ZAZfQics2Z+IgR9fN\/5jOC5qjFfv7QCOIlWAhxaObNouYU3k5SJC395XkTU+deLy1NG21AFVIr94eJeBKBbtlNqi141MIsPQhfh5GeHw6w3jBSZIaJqp1mnA52DIDydNgq+Lg6ztfWDxG+a6sU9b1BoCJjifG6D28pY2YtP6yMcsX7x+TUD\/I7T4wpxwAE1DCCBNAwggQ5oAMCAQICECUM6OAwYS6fK4n3BU18+P0wDQYJKoZIhvcNAQEFBQAwXzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA2MTEwODAwMDAwMFoXDTIxMTEwNzIzNTk1OVowgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAryQICCl6NZ5gDKrnSztO3Hy8PEUcuyvg\/ikC+VcIo2SFFSf18a3IMYldIugqqqZCs4\/4uVW3sbdLs\/6PfgdX7O9D22ZiFWHPYA2k2N744MNiCD1UE+tJyllUhSblK48bn+v1oZHCM0nYQ2NqUkvSj+hwUU3RiWl7x3D2s9wSdNt7XUtW05a\/FXehsPSiJfKvHJJnGOX0BgTvkLnkAOTdOrUZ\/wK69Dzu4IvrN4vs9Nes8vbwPa\/ddZEzGR0cQMt0JBkhk9kU\/qwqUseP1QRJ5I1jR4g8aYPL\/ke9K35PxZWuDp3U0UPAZ3PjFAh+5T+fc7gzCs9dPzSHloruU+glFQIDAQABo4IBmzCCAZcwDwYDVR0TAQH\/BAUwAwEB\/zAxBgNVHR8EKjAoMCagJKAihiBodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9wY2EzLmNybDAOBgNVHQ8BAf8EBAMCAQYwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9jcHMwHQYDVR0OBBYEFH\/TZafC3ey78DAJ80M5+gKvMzEzMG0GCCsGAQUFBwEMBGEwX6FdoFswWTBXMFUWCWltYWdlL2dpZjAhMB8wBwYFKw4DAhoEFI\/l0xqGrI2Oa8PPgGrUSBgsexkuMCUWI2h0dHA6Ly9sb2dvLnZlcmlzaWduLmNvbS92c2xvZ28uZ2lmMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AudmVyaXNpZ24uY29tMD4GA1UdJQQ3MDUGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCWCGSAGG+EIEAQYKYIZIAYb4RQEIATANBgkqhkiG9w0BAQUFAAOBgQATAt346IYA8lr4+CAMWYhiB87O9075u1mhmOXhON1OvGYY063rGPINyW0+SpQgwzy6vWVUxq9EsxCtLGs+q9cHtriBY8X5Xi7lKmfOzTMMKteJVgMjH7O+6DoIWbTsRTX3ilv\/Zs9Qr8ZtV40ZeLe5otFX6h+aS6+6yY4Sfsa9\/w4AAAA="}
-01110{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":357,"source":"webex.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":8,"flow_first_seen":1444570636359,"flow_last_seen":1444570636829,"flow_tot_l4_data_len":4182,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2599,"flow_avg_l4_data_len":522,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.97","src_port":51370,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01121{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":357,"source":"webex.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":8,"flow_first_seen":1444570636359,"flow_last_seen":1444570636829,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2579,"flow_tot_l4_payload_len":4002,"flow_avg_l4_payload_len":500,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.97","src_port":51370,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00851{"flow_id":13,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":358,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":830638,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFuc+NAAEAGAcEKCAABQER5meEvAbvnI7F0GNxeD1AYTE9xBgAAFgMBAQYQAAECAQAEJ\/W6AMtMNXfn+z8cZ1EpSauHEvV67C4BIPYGlTr8kboXB9Oq3NXtbsq979Zt74ZTxyldimsSabvCofi01oHiQl5fNMdel1C7y+fi0Ru9KrE5KKP0VIggXSQaBHNsRwU2v6UOVt8Iztltdv0flcWC6UkhfdODoC+ZN\/7PU1vRo\/v1hllBNXjnBma7emhIIACqnC85yKNJ1wThEx64SKTaN23yVcYcgZz0j3zf1KlB9qw4xTefzdb25EOIh9Y0P41fH6BlEUyaMakCXN\/+eNlWfkNgKFeUQ47CAlSUTcLTInY1TaJWxvxGjbJuwCKt8un\/2irPicwzgLDFHuaSgS6TFAMBAAEBFgMBADCXURkOxCraVsD13drdn27VNH9KrjOT3DUDaII8EzfCpFKhxTweqwisHpGfWUrNgAg="}
 00410{"flow_id":13,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":359,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":831131,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAbtAABAGpS9ARHmZCggAAQG74S8Y3F4P5yOyulAQ\/\/\/4OQAA"}
 00407{"flow_id":22,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":360,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":831481,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoY+RAAEAGIz0KCAABQERpYpEJAbvtraFaElJuSVAQTO8MzgAA"}
@@ -268,11 +268,11 @@
 00850{"flow_id":21,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":363,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":839473,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFu6IZAAEAGnVUKCAABQERpYciqAbsEZyq7+5jk6FAYUJjctgAAFgMBAQYQAAECAQBXELeE22orfRHyO7iYVT1m6q3lbIWCe39BzPhHISO8mVEhxzNXSnjyJqJ7t4xvw2RpyedoWUDRQV5M5duqi39l8huSgTr6HUqiPPLrK8H5+YBDkhleHW6xnrG35wBP2sHcBJvySQB0nX7o5+d7iLVUEjuceFEoGz9YiluMpe80JFKVXsu\/EsmYs4FJN0AxRBV4Rg+jzwr3ZRA\/Yf5JIXpge2rbhxPpXr3jpIJ9gQF\/9ttkamjTXFLyMyBlPJ93LtBm40CDLQUP2M5qOJ+2kCU3LGWbK1M9ZrZeaq2uuYufK9LH0wNKfvRQ4QngpGArVSc9BtMjm5o0S0uia8YXpvBVFAMBAAEBFgMBADDeYY6oRb1Sx58+OoYccdOlQcbidfJ+XvnG7OkDkiJ73s0dhqmoA0U2bunZHo5tGpQ="}
 00410{"flow_id":21,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":364,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":842642,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAbxAABAGtWZARGlhCggAAQG7yKr7mOToBGcsAVAQ\/\/8g1wAA"}
 05714{"flow_id":18,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":365,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":894711,"pkt_caplen":3993,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3993,"pkt_l4_len":3959,"pkt":"ABoRAAACABoRAAABCABFAA+LAb1AABAGlf9ARHlkCggAAQG7y\/uPqobccFV5ZFAY\/\/+KJwAAFgMBD14CAABNAwFWGmYS\/Z\/DgIaC4F3A6vWFfTwKeM+7hxQ\/MLnp7eykmCC0VhtNO44CsjutlOFpXxkFi7ilYsk5xuyo2fo3aKYyQQA1AAAF\/wEAAQALAA8FAA8CAATpMIIE5TCCA82gAwIBAgIQKXSJqdQeSb5h94FpRuYh8zANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MB4XDTE1MDQxMDAwMDAwMFoXDTE4MDQxMDIzNTk1OVowdzELMAkGA1UEBhMCdXMxEzARBgNVBAgMCkNhbGlmb3JuaWExETAPBgNVBAcMCFNhbiBKb3NlMRwwGgYDVQQKDBNDaXNjbyBTeXN0ZW1zLCBJbmMuMQwwCgYDVQQLDANDU0cxFDASBgNVBAMMCyoud2ViZXguY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnXjIYUvDCGFnLF6CX7BhvJlmnmrg0KiZFcDP6TyJs2s+n7Hjqpb8O374x26knzLrTkrkpNBVvbi6eY8X6lmrWlqvlgEoyMmslNbZoAjUy1C9HNIMI2F1bLGI\/pKRUGbpk5wvAv6SKOf+cKi3mis7U2sccUb8cFxKTVpp62iK2uOzkFa4zF1i4hm\/NKjJWJVuj\/D8tQpd0PSuU5wWY7G1x\/5UpvvDV7KS7Tsmn3ib\/8gstBL+PLvKZHJ8YWc8u02oGZQoWD64APslwdmLLyDqq5USERl2bc761RHbBhnmKf3IpyvGqgfCFbQ7hfb+sniY0O+KQiBpaJI1bt4iiHQ1YQIDAQABo4IBZDCCAWAwFgYDVR0RBA8wDYILKi53ZWJleC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGUGA1UdIAReMFwwWgYKYIZIAYb4RQEHNjBMMCMGCCsGAQUFBwIBFhdodHRwczovL2Quc3ltY2IuY29tL2NwczAlBggrBgEFBQcCAjAZGhdodHRwczovL2Quc3ltY2IuY29tL3JwYTAfBgNVHSMEGDAWgBRfYM9hkFXfhEMUimAqsvV69EMY7zArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNybDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zcy5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9zcy5zeW1jYi5jb20vc3MuY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAU0XVgHR8KQTLFFzVVA7s1Rlqj4+dm5q+OB5OfJMqYeX\/hnGHVeD8z9\/9EdKsauBRbbFpJk38PC3aGoy0iL9v8CA4V6o0qYzEfedbF\/p\/UuvtChO8CktAaqN64hPdToCJEy3gqyB\/Hv7VVuKXUBogujzn1WBdIyBUlO\/hClSnOD8Qq1So\/AzCrw+\/ChOOV7DI631hsLE1M73UmQqxi7Cbu5R5TsXH6v6s\/7CAPBhVtuxTBBcBuPtA6Pd2Q8vOf6ByuErVmWAV\/tOLfjGuqPuM2JoxzR1iH82zcoIcxOzmtUIYsiTuUSCi\/AsNsm265BOW9oeh5kgZU+pE6LkGX9bECAAU8MIIFODCCBCCgAwIBAgIQUT+5dDhwtzRAQY0wkwaZ\/zANBgkqhkiG9w0BAQsFADCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwHhcNMTMxMDMxMDAwMDAwWhcNMjMxMDMwMjM1OTU5WjB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAstgFyhx0LbUXVjnFSlIJluhL2AzxaJ+aQihiw6UwU35VEYJbA3oNL+F5BMm0lncZgQGUWfm893qZJ4Itt4PdWid\/sgN6nFMl6UgfRk\/InSn4vnlW9vf92Tpo2otLgjNBEsPIPMzWlnqEIRoiBAMnF4scaGGTDw5RgDMdtLXO637QYqzus3sBdO9pNevK1T2p7peYyo2qRA4lmUoVlqTObQJUHypqJuIGOmNIrLRM0XWTUP8TL9ba4cYY9Z\/JJV3zADreJk20KQnNDz0jbxZKgRb78oMQw7jW2FUyPfG9D72MUpVKFpd6UiFjdS8W+cRmvvW1Cdj\/JwDNRHxvSz+w9wIDAQABo4IBYzCCAV8wEgYDVR0TAQH\/BAgwBgEB\/wIBADAwBgNVHR8EKTAnMCWgI6Ahhh9odHRwOi8vczEuc3ltY2IuY29tL3BjYTMtZzUuY3JsMA4GA1UdDwEB\/wQEAwIBBjAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zMi5zeW1jYi5jb20wawYDVR0gBGQwYjBgBgpghkgBhvhFAQc2MFIwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vY3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vcnBhMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFTeW1hbnRlY1BLSS0xLTUzNDAdBgNVHQ4EFgQUX2DPYZBV34RDFIpgKrL1evRDGO8wHwYDVR0jBBgwFoAUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwDQYJKoZIhvcNAQELBQADggEBAF6UVkndji1l9cE2UbYD49qecxnyH1mrWH5sJgUs+oHXXCMXIiw3k\/eG7IXmsKP9H+IyqEVv4dn7ua\/ScKAyQmW\/hP4WKo8\/xabWo5N9Q+l0IZE1KPRj6S7t9\/Vcf0uatSDpCr3gRRAMFJSaXaXjS5HoJJtGQGX0InLNmfiIEfXzf+YzguaoxX7+0AjiJVgIcWjmzaLmFN5OUiQt\/eV5E1PnXi8tTRttQBVSK\/eHiXgSgW7ZTaoteNTCLD0IX4eRnh8OsN4wUmSGiaqdZpwOdgyA8nTYKvi4Os7X1g8RvmurFPW9QaAiY4nxug9vKWNmLT+sjHLF+8fk1A\/yO0+MKccABNQwggTQMIIEOaADAgECAhAlDOjgMGEunyuJ9wVNfPj9MA0GCSqGSIb3DQEBBQUAMF8xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjExMDgwMDAwMDBaFw0yMTExMDcyMzU5NTlaMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA2IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8kCAgpejWeYAyq50s7Ttx8vDxFHLsr4P4pAvlXCKNkhRUn9fGtyDGJXSLoKqqmQrOP+LlVt7G3S7P+j34HV+zvQ9tmYhVhz2ANpNje+ODDYgg9VBPrScpZVIUm5SuPG5\/r9aGRwjNJ2ENjalJL0o\/ocFFN0Ylpe8dw9rPcEnTbe11LVtOWvxV3obD0oiXyrxySZxjl9AYE75C55ADk3Tq1Gf8CuvQ87uCL6zeL7PTXrPL28D2v3XWRMxkdHEDLdCQZIZPZFP6sKlLHj9UESeSNY0eIPGmDy\/5HvSt+T8WVrg6d1NFDwGdz4xQIfuU\/n3O4MwrPXT80h5aK7lPoJRUCAwEAAaOCAZswggGXMA8GA1UdEwEB\/wQFMAMBAf8wMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMy5jcmwwDgYDVR0PAQH\/BAQDAgEGMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vY3BzMB0GA1UdDgQWBBR\/02Wnwt3su\/AwCfNDOfoCrzMxMzBtBggrBgEFBQcBDARhMF+hXaBbMFkwVzBVFglpbWFnZS9naWYwITAfMAcGBSsOAwIaBBSP5dMahqyNjmvDz4Bq1EgYLHsZLjAlFiNodHRwOi8vbG9nby52ZXJpc2lnbi5jb20vdnNsb2dvLmdpZjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTA+BgNVHSUENzA1BggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBglghkgBhvhCBAEGCmCGSAGG+EUBCAEwDQYJKoZIhvcNAQEFBQADgYEAEwLd+OiGAPJa+PggDFmIYgfOzvdO+btZoZjl4TjdTrxmGNOt6xjyDcltPkqUIMM8ur1lVMavRLMQrSxrPqvXB7a4gWPF+V4u5Spnzs0zDCrXiVYDIx+zvug6CFm07EU194pb\/2bPUK\/GbVeNGXi3uaLRV+ofmkuvusmOEn7Gvf8OAAAA"}
-01111{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":365,"source":"webex.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":6,"flow_first_seen":1444570636259,"flow_last_seen":1444570636894,"flow_tot_l4_data_len":4142,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3959,"flow_avg_l4_data_len":690,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.100","src_port":52219,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01122{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":365,"source":"webex.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":6,"flow_first_seen":1444570636259,"flow_last_seen":1444570636894,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3939,"flow_tot_l4_payload_len":4002,"flow_avg_l4_payload_len":667,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.100","src_port":52219,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00852{"flow_id":22,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":366,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":895983,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFuY+VAAEAGIfYKCAABQERpYpEJAbvtraFaElJuSVAYTO\/8iQAAFgMBAQYQAAECAQBKz8VAcYGRCUxyTTm12E2YCFZWr3BjrWhipEpnrXhhxj1MIecbPmgYdshTAomuSJsV+ngNhOnDxwNUl4MphH25YnDW3y\/D5JB+VOryaIKA7PSsSYpU8swhaVzf8\/a3UBkaBacxyaeRKkQbcUWT+268fk63eT6XIEeps92NVGpTa+SuaZvp\/YJJEUPFU0rRb0XwIaVfwwuTg1neFIu1+4epaHSQzQW9eFzmJF3T4+uOLnIvqa\/4Ydz3W7NjcmJv62P1RhVxDAwWQoz5xUBA84Ac4nNtRUQ5ZhiziHLvZmOMgHtfleqw5zTqosgeTmmOakOR6s28Kd5RrKQxHeSTNBGAFAMBAAEBFgMBADDNdsftYPv47HQqVMtWpzE50vsZhtbBXRWYGCfc\/cKXEMfPEY1UJSjDUI+1BaVLkz8="}
 00409{"flow_id":22,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":367,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":896552,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAb5AABAGtWNARGliCggAAQG7kQkSUm5J7a2ioFAQ\/\/9YdwAA"}
 05712{"flow_id":19,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":368,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":897531,"pkt_caplen":3993,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3993,"pkt_l4_len":3959,"pkt":"ABoRAAACABoRAAABCABFAA+LAb9AABAGlf5ARHljCggAAQG72qGkCFzmW\/ejWlAY\/\/\/iVAAAFgMBD14CAABNAwFWGmYSO4ujwppVKuHJGKzYGAeqsTGrkuWznfOYrvCxcCBgdTl8Q+EnZotV0xZg72NNDMfW235XcJYrwHbEaKYyQQA1AAAF\/wEAAQALAA8FAA8CAATpMIIE5TCCA82gAwIBAgIQKXSJqdQeSb5h94FpRuYh8zANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MB4XDTE1MDQxMDAwMDAwMFoXDTE4MDQxMDIzNTk1OVowdzELMAkGA1UEBhMCdXMxEzARBgNVBAgMCkNhbGlmb3JuaWExETAPBgNVBAcMCFNhbiBKb3NlMRwwGgYDVQQKDBNDaXNjbyBTeXN0ZW1zLCBJbmMuMQwwCgYDVQQLDANDU0cxFDASBgNVBAMMCyoud2ViZXguY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnXjIYUvDCGFnLF6CX7BhvJlmnmrg0KiZFcDP6TyJs2s+n7Hjqpb8O374x26knzLrTkrkpNBVvbi6eY8X6lmrWlqvlgEoyMmslNbZoAjUy1C9HNIMI2F1bLGI\/pKRUGbpk5wvAv6SKOf+cKi3mis7U2sccUb8cFxKTVpp62iK2uOzkFa4zF1i4hm\/NKjJWJVuj\/D8tQpd0PSuU5wWY7G1x\/5UpvvDV7KS7Tsmn3ib\/8gstBL+PLvKZHJ8YWc8u02oGZQoWD64APslwdmLLyDqq5USERl2bc761RHbBhnmKf3IpyvGqgfCFbQ7hfb+sniY0O+KQiBpaJI1bt4iiHQ1YQIDAQABo4IBZDCCAWAwFgYDVR0RBA8wDYILKi53ZWJleC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGUGA1UdIAReMFwwWgYKYIZIAYb4RQEHNjBMMCMGCCsGAQUFBwIBFhdodHRwczovL2Quc3ltY2IuY29tL2NwczAlBggrBgEFBQcCAjAZGhdodHRwczovL2Quc3ltY2IuY29tL3JwYTAfBgNVHSMEGDAWgBRfYM9hkFXfhEMUimAqsvV69EMY7zArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNybDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zcy5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9zcy5zeW1jYi5jb20vc3MuY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAU0XVgHR8KQTLFFzVVA7s1Rlqj4+dm5q+OB5OfJMqYeX\/hnGHVeD8z9\/9EdKsauBRbbFpJk38PC3aGoy0iL9v8CA4V6o0qYzEfedbF\/p\/UuvtChO8CktAaqN64hPdToCJEy3gqyB\/Hv7VVuKXUBogujzn1WBdIyBUlO\/hClSnOD8Qq1So\/AzCrw+\/ChOOV7DI631hsLE1M73UmQqxi7Cbu5R5TsXH6v6s\/7CAPBhVtuxTBBcBuPtA6Pd2Q8vOf6ByuErVmWAV\/tOLfjGuqPuM2JoxzR1iH82zcoIcxOzmtUIYsiTuUSCi\/AsNsm265BOW9oeh5kgZU+pE6LkGX9bECAAU8MIIFODCCBCCgAwIBAgIQUT+5dDhwtzRAQY0wkwaZ\/zANBgkqhkiG9w0BAQsFADCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwHhcNMTMxMDMxMDAwMDAwWhcNMjMxMDMwMjM1OTU5WjB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAstgFyhx0LbUXVjnFSlIJluhL2AzxaJ+aQihiw6UwU35VEYJbA3oNL+F5BMm0lncZgQGUWfm893qZJ4Itt4PdWid\/sgN6nFMl6UgfRk\/InSn4vnlW9vf92Tpo2otLgjNBEsPIPMzWlnqEIRoiBAMnF4scaGGTDw5RgDMdtLXO637QYqzus3sBdO9pNevK1T2p7peYyo2qRA4lmUoVlqTObQJUHypqJuIGOmNIrLRM0XWTUP8TL9ba4cYY9Z\/JJV3zADreJk20KQnNDz0jbxZKgRb78oMQw7jW2FUyPfG9D72MUpVKFpd6UiFjdS8W+cRmvvW1Cdj\/JwDNRHxvSz+w9wIDAQABo4IBYzCCAV8wEgYDVR0TAQH\/BAgwBgEB\/wIBADAwBgNVHR8EKTAnMCWgI6Ahhh9odHRwOi8vczEuc3ltY2IuY29tL3BjYTMtZzUuY3JsMA4GA1UdDwEB\/wQEAwIBBjAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zMi5zeW1jYi5jb20wawYDVR0gBGQwYjBgBgpghkgBhvhFAQc2MFIwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vY3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vcnBhMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFTeW1hbnRlY1BLSS0xLTUzNDAdBgNVHQ4EFgQUX2DPYZBV34RDFIpgKrL1evRDGO8wHwYDVR0jBBgwFoAUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwDQYJKoZIhvcNAQELBQADggEBAF6UVkndji1l9cE2UbYD49qecxnyH1mrWH5sJgUs+oHXXCMXIiw3k\/eG7IXmsKP9H+IyqEVv4dn7ua\/ScKAyQmW\/hP4WKo8\/xabWo5N9Q+l0IZE1KPRj6S7t9\/Vcf0uatSDpCr3gRRAMFJSaXaXjS5HoJJtGQGX0InLNmfiIEfXzf+YzguaoxX7+0AjiJVgIcWjmzaLmFN5OUiQt\/eV5E1PnXi8tTRttQBVSK\/eHiXgSgW7ZTaoteNTCLD0IX4eRnh8OsN4wUmSGiaqdZpwOdgyA8nTYKvi4Os7X1g8RvmurFPW9QaAiY4nxug9vKWNmLT+sjHLF+8fk1A\/yO0+MKccABNQwggTQMIIEOaADAgECAhAlDOjgMGEunyuJ9wVNfPj9MA0GCSqGSIb3DQEBBQUAMF8xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjExMDgwMDAwMDBaFw0yMTExMDcyMzU5NTlaMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA2IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8kCAgpejWeYAyq50s7Ttx8vDxFHLsr4P4pAvlXCKNkhRUn9fGtyDGJXSLoKqqmQrOP+LlVt7G3S7P+j34HV+zvQ9tmYhVhz2ANpNje+ODDYgg9VBPrScpZVIUm5SuPG5\/r9aGRwjNJ2ENjalJL0o\/ocFFN0Ylpe8dw9rPcEnTbe11LVtOWvxV3obD0oiXyrxySZxjl9AYE75C55ADk3Tq1Gf8CuvQ87uCL6zeL7PTXrPL28D2v3XWRMxkdHEDLdCQZIZPZFP6sKlLHj9UESeSNY0eIPGmDy\/5HvSt+T8WVrg6d1NFDwGdz4xQIfuU\/n3O4MwrPXT80h5aK7lPoJRUCAwEAAaOCAZswggGXMA8GA1UdEwEB\/wQFMAMBAf8wMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMy5jcmwwDgYDVR0PAQH\/BAQDAgEGMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vY3BzMB0GA1UdDgQWBBR\/02Wnwt3su\/AwCfNDOfoCrzMxMzBtBggrBgEFBQcBDARhMF+hXaBbMFkwVzBVFglpbWFnZS9naWYwITAfMAcGBSsOAwIaBBSP5dMahqyNjmvDz4Bq1EgYLHsZLjAlFiNodHRwOi8vbG9nby52ZXJpc2lnbi5jb20vdnNsb2dvLmdpZjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTA+BgNVHSUENzA1BggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBglghkgBhvhCBAEGCmCGSAGG+EUBCAEwDQYJKoZIhvcNAQEFBQADgYEAEwLd+OiGAPJa+PggDFmIYgfOzvdO+btZoZjl4TjdTrxmGNOt6xjyDcltPkqUIMM8ur1lVMavRLMQrSxrPqvXB7a4gWPF+V4u5Spnzs0zDCrXiVYDIx+zvug6CFm07EU194pb\/2bPUK\/GbVeNGXi3uaLRV+ofmkuvusmOEn7Gvf8OAAAA"}
-01110{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":368,"source":"webex.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":6,"flow_first_seen":1444570636264,"flow_last_seen":1444570636897,"flow_tot_l4_data_len":4142,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3959,"flow_avg_l4_data_len":690,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.99","src_port":55969,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01121{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":368,"source":"webex.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":6,"flow_first_seen":1444570636264,"flow_last_seen":1444570636897,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3939,"flow_tot_l4_payload_len":4002,"flow_avg_l4_payload_len":667,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.99","src_port":55969,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 03470{"flow_id":14,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":369,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":898687,"pkt_caplen":2309,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2309,"pkt_l4_len":2275,"pkt":"ABoRAAACABoRAAABCABFAAj3AcBAABAGMMg+becDCggAAQG7svZgvbGbn0JhQ1AY\/\/\/KrwAAFwMBBWDde1FdWoJWDuJ36PlKWy8Z8EviG2jV4W+KGkEd6W\/guAjEifv9fBDCH9+v3GZ8sypODLmQzBSnbslrOpYCfWOH9IdRjgX25zNML\/jvNaV6OdNRv1+Pk8Aw1JRYGm35ODHu7UdMrb2ZpY0w67xXnTvc2rVZXlA7xJNc2BGRnkuZGuozOEJSQMhqTZPeyTvyb0wVuWxRopCC2hu5uvWjlvvxc4LO0P7n7+pIJ1Bf55yP9RSrrXwfAG52wDw7JiNs\/Q8UifKi8OByfAS1ae3q7\/ScOdQuC2y5rh2vpSFM\/oFXSRW4lavqwkbaA3HAMXJdsnYFkgNA6jIdzPiVTvXmsxlJA3QxQ0rZfzwoKLvApXdMw30R5YbK89GnZh9lnczyP4QWFKuffm\/vKqfIwWIERKiFRkT7VUB8inwWwdvLyy5pDpo8IxKgHskWtjuU0eKIR1WiQmLE3idaRqWZU8xosc7oeSaGpmfxGolkPTG7xWEit50mRz13TBREfI+Y0W7tLPMGJ1QHGVVerko+O3kgNwzGtoNqGH86YGf2gkGmNkXQINjPzxY1YzbUG0nD6lT8S4+oYDZsdyE91wNqw4ss\/8Z32Gk9a4GB26rNC2HWrv8mE0VW7V+OtSNsjejA5hIf52nQFtQxOFABVjdL2YFiP16hrGKsCEVecpGrE4FapisFrMpJd8wSIP8Z2G+QVjuiFA63gzng398lzTOhOtyk9DuQqBuVCQDnGIXM1S+Uajq1uAlZmECvSIcyuYGTu5cZNhlJCI0gJgR854Pc8SNgtbhajOCvVLGsqmJ1Z8arwqbOT72dGX1mtm2\/jWG0IRka4OpOoI2USFVDdXOJnksmG93cQaJ60GvIzx56evOOkeEG6UYfA2uhryk\/FiyLXOeI6jtNKJJU5YzG+Q7Ly0PrTWsj6FQfmmsXZLpHBrat9V2zNnGSURdG1P73eUCwqb13yFYpSQWp5WEgm7rbo9G5zo2Y4542IFd8FeoHr0FKZON79unA7kvP2v1PbWH2VqNdpTmvgZ7JqO9KfXpJh8+RpKnwvY5P+2K2f65Ixx\/AsN9FnJZk1lhWkmkR4yW6MkNYY4uTmUYwGIa4dn+jHWjGNC9mpI5JvwfwRkoBA\/h2RZGXDGqWyb6T7AXiZajnRE2MttwnMTeYX32ri6s\/9x6mRUaUF1iCowSU+4uqEhXR4OvG2kcwQWw9q9hWrObEr3YESOtHlKTxaZoVyWMrXHSi77pM99QlwpcHrdFNTi\/i\/Sv2yrJNSDiWxZROaF1sHa4vt1+6kxEwT\/Uhf1FgOdagMtCzShZY1xQX5F8YOXsAHKOYg8ctiZsvrey+WhmaiVA70VSNhYFdyzSWpVE8CiV4TQZlWKoeTTtlnIyiHRyyoISoOKOHpcYMDcP\/Vps8f\/WiPxLziihOtDuw5RCzQraGTJMW08io5pS3KcGhWjyeRjF9AZfEdO09QEsoogtYrKB+8Q1rQZgL9\/hkr3AoqDmXSVNf8kNR8lNat3LE1OGJg3oNxNejSCWlareae7fD69\/HVxNyk1dqq6JmYWdP8QnsLgPwckcy0K87DYw4qlNoGciIsb+ExmSAS0HLNJC6ffrLH+LgiHUUHzzZxhWlSmCioPLNLxh5\/agSF5C5Oeb+iXn\/YNdKMMr3y4hzZAFbtwxiqvzATIUsQrn2mVpBIu0eYPvwaCEblmJroRyO5BxhUkPVxTCrpBExMm4ENkm1RjDYU8Qu4eX4XDau3XynJ19km42r1mMdaZJrg+n5UtDENLfdd3sxt0JnwdU8ECQ2oBhP1Qe36+aBU\/ZPbxGLAXojhvzX1u7dvwOeYPJgl7dAf3nxZhcDAQNAnds9\/tJb406vCBadsl8Ux8fxf\/TxUtBTMoFLoyxTR4cXj\/u1KeLAxhj\/ExaRt88vE30Wxc2hPMzZV8qRRyMaYxVvWX3bmrGykcHYwf2m4iv7z7BSEfjxlW40G8adMtWyK5p4pdb81lxtB\/hdT2u+ed7TFmJH05UaTxZ1xOMeAF04bB4UiIPM7tLrtwC7yawFCSa19669UvJFcsckaQpSO7yugEgKKJWdomCzA+M7Qg0UYQKLft0gAhc0dEsB2hA9kpjtHAyFyzhhOg02sOnj3aFnsWAvLPwEh4a19gAVFZ+aXpsSWl24QLXviRJ\/HiY5kFTggCyOwpuflU5dhJLwPNTcB7MUQoi0r9tU+jwyBM1FwPa2vsP9rN3ODTiH28eNfrHTGWj2hDjqqGWybDqJ6NcXTnrLX7hqJ52YZanAqelXOoXDCBxVDV+C83K\/lRsReFbaydVmIGfAt1wjs8dKuUnnR8RJluX7X\/mgeerWhF\/ggIEnc66WGT6DLCIywvCVDg0+Lc0Iw6lhprxYYtwzQSK0dCsqiL5AduwK5WIOyFxNNUHkC0T9B8ei\/cxrKXTn2SGI+f2VnUfgdjUqI4\/Tfr86cuGgBEaR9EGprwn9bdJb1Xp5KlRUVSS0HAqF4RxqrjiuKZlPuTFjRRQ+Meg7MByIgLHbHMmQ1tvCKyMZnnJ0dLEtzrsMsCBJHLrshcuDS5vDklYn1jiPhLc5f0uOlPeFKQOOoU7NMAss1p1w9EudT+TwqbmyK+JNatJkjdhkwgXc31cIgTFiL6\/TWvG+4xrJNszOZz26CnAuAEdL2ulIi3JjTUE9ZFnx\/tL27DxCO4SS\/NLyK8Gufckh\/DJ8prQe1czlZ\/2cK3UwIOtTGYUPcLhb65Gxu49J2Hu2ZSXS9jCKE4kZOwrV3RUj9CYUT4ux7LSEYbb2Gx7\/jWO4nHrUOoms+5UidpIYakVr+C4p9oVn7mRrqUKWMQ3Kpm8tma7ZFyB\/wLDFxrwZUzb+MZGM8oAObbNJdpMap9ZASyRe1JkAo\/LOGOoLl8X9c8rv9amSUnj5S23SEyY8i7TbR0\/zfq4X6\/yv\/b1ZKxkH7AwraD618y0EuJGU4Ufsg57MdRUDAQAgpL2NNQm25P39Nva6IyGHkTSOVEKrtfAgvLc0DNz\/PtA="}
 00849{"flow_id":23,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":370,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":899301,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFu2lxAAEAGq3kKCAABQERpZ6GqAbsG3RmZ+SL2ClAYTO9tJwAAFgMBAQYQAAECAQBR11gDSI0mnDZ9mJO34BHZiGaXufHHx8CsR6Be+Te0OnR0gJ8RTMaIk1DH6ST47bCFvccOK1TKqbr6cuX9mu3AvrPFbANOKjQYWyGWclpxBJU00HSDgsf3tXUWPPUPdwzoZAWMAgVKQhzd1kznVZ5pGAcQN5CozP9bk0XrveDz80w\/tPuj098aBdk1xWRR9mic6f2p9E3J1dQkurPaIajvAg4DevM5kskfb4XhbePaEh7QDMdJbuTHnpLwUx408R5gkHli60UUruksvNppZ3N4l7B5ekI71HCckqTO5KlnCFg3jEPINupUtidLfQnFz373Dc+yNb5dYdOLFR7fqOGiFAMBAAEBFgMBADCKJ\/AKrAveqKpjl+DyUCSNgWnnugZuPfFZ+Yan7R3r8U\/I+qwhH27GTa3bIr23wkA="}
 00409{"flow_id":23,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":371,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":899792,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAcFAABAGtVtARGlnCggAAQG7oar5IvYKBt0a31AQ\/\/9H0QAA"}
@@ -285,7 +285,7 @@
 00411{"flow_id":19,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":379,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":962816,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAcRAABAGpVxARHljCggAAQG72qGkCGxJW\/ekoFAQ\/\/\/+3QAA"}
 00407{"flow_id":11,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":380,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":963026,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoNxxAAEAGu1wKCAABch3MMcm+AbvkVPYwG6sPdFAQQLBVrgAA"}
 03814{"flow_id":11,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":381,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":963296,"pkt_caplen":2581,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2581,"pkt_l4_len":2547,"pkt":"ABoRAAACABoRAAABCABFAAoHAcVAABAGFtVyHcwxCggAAQG7yb4bqw905FT2MFAY\/\/8QegAABAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MB4XDTEzMTAzMTAwMDAwMFoXDTIzMTAzMDIzNTk1OVowfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLYBcocdC21F1Y5xUpSCZboS9gM8WifmkIoYsOlMFN+VRGCWwN6DS\/heQTJtJZ3GYEBlFn5vPd6mSeCLbeD3Vonf7IDepxTJelIH0ZPyJ0p+L55Vvb3\/dk6aNqLS4IzQRLDyDzM1pZ6hCEaIgQDJxeLHGhhkw8OUYAzHbS1zut+0GKs7rN7AXTvaTXrytU9qe6XmMqNqkQOJZlKFZakzm0CVB8qaibiBjpjSKy0TNF1k1D\/Ey\/W2uHGGPWfySVd8wA63iZNtCkJzQ89I28WSoEW+\/KDEMO41thVMj3xvQ+9jFKVShaXelIhY3UvFvnEZr71tQnY\/ycAzUR8b0s\/sPcCAwEAAaOCAWMwggFfMBIGA1UdEwEB\/wQIMAYBAf8CAQAwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNiLmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vczIuc3ltY2IuY29tMGsGA1UdIARkMGIwYAYKYIZIAYb4RQEHNjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMB8GA1UdIwQYMBaAFH\/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBCwUAA4IBAQBelFZJ3Y4tZfXBNlG2A+PannMZ8h9Zq1h+bCYFLPqB11wjFyIsN5P3huyF5rCj\/R\/iMqhFb+HZ+7mv0nCgMkJlv4T+FiqPP8Wm1qOTfUPpdCGRNSj0Y+ku7ff1XH9LmrUg6Qq94EUQDBSUml2l40uR6CSbRkBl9CJyzZn4iBH183\/mM4LmqMV+\/tAI4iVYCHFo5s2i5hTeTlIkLf3leRNT514vLU0bbUAVUiv3h4l4EoFu2U2qLXjUwiw9CF+HkZ4fDrDeMFJkhomqnWacDnYMgPJ02Cr4uDrO19YPEb5rqxT1vUGgImOJ8boPbyljZi0\/rIxyxfvH5NQP8jtPjCnHAATUMIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ\/XxrcgxiV0i6CqqpkKzj\/i5Vbext0uz\/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6\/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn\/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4\/VBEnkjWNHiDxpg8v+R70rfk\/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10\/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH\/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB\/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW\/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3\/DgAAAA=="}
-01111{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":381,"source":"webex.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":8,"flow_first_seen":1444570636155,"flow_last_seen":1444570636963,"flow_tot_l4_data_len":4150,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2547,"flow_avg_l4_data_len":518,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.204.49","src_port":51646,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01122{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":381,"source":"webex.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":8,"flow_first_seen":1444570636155,"flow_last_seen":1444570636963,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2527,"flow_tot_l4_payload_len":3970,"flow_avg_l4_payload_len":496,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.204.49","src_port":51646,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00407{"flow_id":11,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":382,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":963553,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoNx1AAEAGu1sKCAABch3MMcm+AbvkVPYwG6sZU1AQTvg9hwAA"}
 00854{"flow_id":11,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":383,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":973588,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFuNx5AAEAGuhQKCAABch3MMcm+AbvkVPYwG6sZU1AYTvj6ZAAAFgMBAQYQAAECAQCAe\/mp5u2\/6229QI24iKcByMNry7UNBZfsXakGUQT8wFWc4pDl+1RCfxyQOgnwxykqX9gP2Dq\/DHVfpBd5xWi8IwL5SRWbK1nUCmyi2wHJTm3svxRNqYkq1J5+gFzTflfDMnMHwFrLSrNICds\/UF+g32M9S9LiT99JvXj\/NLtmyyHZcLbapqb0TO\/jgg0je9l2yNo1Y45fVAFKsoVeIpYFI35++TY5832x1BWGgqvJ0UhHZkO38wh6dZFCw1Ei0Zz3myvGEQjMcMc3YwEG2PrXTpoxKFjkjcanY6aazaT3NRQiCgU4OuWkFkcMODlWNsusZQ+rcxALJm0l6DWF66sBFAMBAAEBFgMBADAYwKGBhq5NY6YAhyZgirCQhkrB\/4exqoUrr4zHmiAHgMalmSruBKlic2lOJkHB9KY="}
 00410{"flow_id":11,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":384,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570636,"pkt_ts_usec":973786,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAcZAABAGILNyHcwxCggAAQG7yb4bqxlT5FT3dlAQ\/\/+LOQAA"}
@@ -313,14 +313,14 @@
 00410{"flow_id":23,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":406,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570637,"pkt_ts_usec":191363,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAdRAABAGtUhARGlnCggAAQG7oar5IvZFBt0c6VAQ\/\/9FjAAA"}
 01056{"flow_id":22,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":407,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570637,"pkt_ts_usec":191588,"pkt_caplen":528,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":528,"pkt_l4_len":494,"pkt":"ABoRAAACABoRAAABCABFAAICY+ZAAEAGIWEKCAABQERpYpEJAbvtraKgElJuhFAYTO9hMgAAFwMBACD22CDOs8BfPgmxeWsfNUhHUZqu\/f1zvWDBKCbiFwJ1ORcDAQGwZON2fqrVig0UeSVfKSUtB054WY1\/ZJhZaEmhVp9yAP6rHKkkGmfVfKAcSImwt548wRKQlD9usyJ+B1uFD\/PSYmEj6BKXx13DuCAgPBCmw9fhkKC\/NA8Eb+9lMpX1B0wqLyLIamLEAR0hGrq+QOAFXXQbOHRw5AlprpyYnPmEfDMeGq1nJRCrlLfxILJ9rKHp3qjrzY2RvX2isXsu6nPapV\/qe4PAf\/3mOdQTTpuVrCzmucUv2SEiHiw396jr2Wfs1HtO\/93Av6iG5+MA8utP5KFzxhb7B4r8l5pfnt3a8CvaKeAwCP8bNnMI31DAZdYyhr4OMyWUpu+0RQEbffygIB5fn2vBympfI61\/KnvaFj+fU8Pj9GhPkG+DRXTdIjtYMTd\/uLFBD\/VwARbhfio3+a5lwmdUskpYPzmrIEJWxVXXJQWVQeJA\/J9slMgGa9qLAYwFceEVA4W4zoYjemZYUochTqIRQlGhJ2rxWsAwhF\/lzGojaxeZLazrj5YQePw6+CzAoSanCNWMRkd0HTkVSYxRIkpgCClJ+QGZ9tOPzAIzb3iIMgxcUYfBJAyn5L\/t"}
 00410{"flow_id":22,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":408,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570637,"pkt_ts_usec":191762,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAdVAABAGtUxARGliCggAAQG7kQkSUm6E7a2kelAQ\/\/9WYgAA"}
-00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":409,"source":"webex.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1444570637191,"flow_last_seen":0,"flow_tot_l4_data_len":664,"flow_min_l4_data_len":664,"flow_max_l4_data_len":664,"flow_avg_l4_data_len":664,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"172.16.1.75","src_port":64538,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":409,"source":"webex.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1444570637191,"flow_last_seen":0,"flow_min_l4_payload_len":656,"flow_max_l4_payload_len":656,"flow_tot_l4_payload_len":656,"flow_avg_l4_payload_len":656,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"172.16.1.75","src_port":64538,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 01271{"flow_id":24,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":409,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570637,"pkt_ts_usec":191973,"pkt_caplen":698,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":698,"pkt_l4_len":664,"pkt":"ABoRAAACABoRAAABCABFAAKsAABAAEARgN0KCAABrBABS\/waE8QCmKnIUkVHSVNURVIgc2lwOjE3Mi4xNi4xLjc1O3RyYW5zcG9ydD1VRFAgU0lQLzIuMA0KVmlhOiBTSVAvMi4wL1VEUCAxMC4xMzMuMjA2LjQ3OjY0NTM4O2JyYW5jaD16OWhHNGJLLTUyNDI4Ny0xLS0tM2U0Njk4NjE4Y2ZiMmI3MztycG9ydA0KTWF4LUZvcndhcmRzOiA3MA0KQ29udGFjdDogPHNpcDo0NTE5MUAxMC4xMzMuMjA2LjQ3OjY0NTM4O3JpbnN0YW5jZT03YTQ2ZjFlMTI3MDJlN2ZiO3RyYW5zcG9ydD1VRFA+DQpUbzogPHNpcDo0NTE5MUAxNzIuMTYuMS43NTt0cmFuc3BvcnQ9VURQPg0KRnJvbTogPHNpcDo0NTE5MUAxNzIuMTYuMS43NTt0cmFuc3BvcnQ9VURQPjt0YWc9ZDM4MzM3NjcNCkNhbGwtSUQ6IEtvcExUdzl4c19sRXBDdGlQYTA3YlEuLg0KQ1NlcTogNCBSRUdJU1RFUg0KRXhwaXJlczogNjANCkFsbG93OiBJTlZJVEUsIEFDSywgQ0FOQ0VMLCBCWUUsIE5PVElGWSwgUkVGRVIsIE1FU1NBR0UsIE9QVElPTlMsIElORk8sIFNVQlNDUklCRQ0KU3VwcG9ydGVkOiByZXBsYWNlcywgbm9yZWZlcnN1YiwgZXh0ZW5kZWQtcmVmZXIsIHRpbWVyLCBvdXRib3VuZCwgcGF0aCwgWC1jaXNjby1zZXJ2aWNldXJpDQpVc2VyLUFnZW50OiBab2lwZXIgcjMzNjg4DQpBbGxvdy1FdmVudHM6IHByZXNlbmNlLCBrcG1sDQpDb250ZW50LUxlbmd0aDogMA0KDQo="}
-00500{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":409,"source":"webex.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1444570637191,"flow_last_seen":0,"flow_tot_l4_data_len":664,"flow_min_l4_data_len":664,"flow_max_l4_data_len":664,"flow_avg_l4_data_len":664,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"172.16.1.75","src_port":64538,"dst_port":5060,"l4_proto":"udp","ndpi": {"proto":"SIP","breed":"Acceptable","category":"VoIP"}}
+00512{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":409,"source":"webex.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1444570637191,"flow_last_seen":0,"flow_min_l4_payload_len":656,"flow_max_l4_payload_len":656,"flow_tot_l4_payload_len":656,"flow_avg_l4_payload_len":656,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"172.16.1.75","src_port":64538,"dst_port":5060,"l4_proto":"udp","ndpi": {"proto":"SIP","breed":"Acceptable","category":"VoIP"}}
 00407{"flow_id":16,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":410,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570638,"pkt_ts_usec":197194,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo0S9AAEAGIu8KCAABch3Ki7gMAbtSShQdrbX3PVAQTbZWSgAA"}
 01847{"flow_id":16,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":411,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570638,"pkt_ts_usec":198277,"pkt_caplen":1119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1119,"pkt_l4_len":1085,"pkt":"ABoRAAACABoRAAABCABFAARRAdZAABAGHiByHcqLCggAAQG7uAyttfc9UkoUHVAY\/\/\/a\/wAAMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA2IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8kCAgpejWeYAyq50s7Ttx8vDxFHLsr4P4pAvlXCKNkhRUn9fGtyDGJXSLoKqqmQrOP+LlVt7G3S7P+j34HV+zvQ9tmYhVhz2ANpNje+ODDYgg9VBPrScpZVIUm5SuPG5\/r9aGRwjNJ2ENjalJL0o\/ocFFN0Ylpe8dw9rPcEnTbe11LVtOWvxV3obD0oiXyrxySZxjl9AYE75C55ADk3Tq1Gf8CuvQ87uCL6zeL7PTXrPL28D2v3XWRMxkdHEDLdCQZIZPZFP6sKlLHj9UESeSNY0eIPGmDy\/5HvSt+T8WVrg6d1NFDwGdz4xQIfuU\/n3O4MwrPXT80h5aK7lPoJRUCAwEAAaOCAZswggGXMA8GA1UdEwEB\/wQFMAMBAf8wMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMy5jcmwwDgYDVR0PAQH\/BAQDAgEGMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vY3BzMB0GA1UdDgQWBBR\/02Wnwt3su\/AwCfNDOfoCrzMxMzBtBggrBgEFBQcBDARhMF+hXaBbMFkwVzBVFglpbWFnZS9naWYwITAfMAcGBSsOAwIaBBSP5dMahqyNjmvDz4Bq1EgYLHsZLjAlFiNodHRwOi8vbG9nby52ZXJpc2lnbi5jb20vdnNsb2dvLmdpZjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTA+BgNVHSUENzA1BggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBglghkgBhvhCBAEGCmCGSAGG+EUBCAEwDQYJKoZIhvcNAQEFBQADgYEAEwLd+OiGAPJa+PggDFmIYgfOzvdO+btZoZjl4TjdTrxmGNOt6xjyDcltPkqUIMM8ur1lVMavRLMQrSxrPqvXB7a4gWPF+V4u5Spnzs0zDCrXiVYDIx+zvug6CFm07EU194pb\/2bPUK\/GbVeNGXi3uaLRV+ofmkuvusmOEn7Gvf8OAAAA"}
-01112{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":411,"source":"webex.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":8,"flow_first_seen":1444570636252,"flow_last_seen":1444570638198,"flow_tot_l4_data_len":4150,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2862,"flow_avg_l4_data_len":518,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.202.139","src_port":47116,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01123{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":411,"source":"webex.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":8,"flow_first_seen":1444570636252,"flow_last_seen":1444570638198,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2842,"flow_tot_l4_payload_len":3970,"flow_avg_l4_payload_len":496,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.202.139","src_port":47116,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 05675{"flow_id":20,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":412,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570638,"pkt_ts_usec":199485,"pkt_caplen":3961,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3961,"pkt_l4_len":3927,"pkt":"ABoRAAACABoRAAABCABFAA9rAddAABAGFYVyHcgLCggAAQG7uuGRntLdbmEtY1AY\/\/+AEAAAFgMBDz4CAAAtAwFWGmYSW0EiuvKB8G4duX+mVQdIp5xJ8dkxayHOG+eykgAANQAABf8BAAEACwAPBQAPAgAE6TCCBOUwggPNoAMCAQICECl0ianUHkm+YfeBaUbmIfMwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDAeFw0xNTA0MTAwMDAwMDBaFw0xODA0MTAyMzU5NTlaMHcxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMREwDwYDVQQHDAhTYW4gSm9zZTEcMBoGA1UECgwTQ2lzY28gU3lzdGVtcywgSW5jLjEMMAoGA1UECwwDQ1NHMRQwEgYDVQQDDAsqLndlYmV4LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ14yGFLwwhhZyxegl+wYbyZZp5q4NComRXAz+k8ibNrPp+x46qW\/Dt++MdupJ8y605K5KTQVb24unmPF+pZq1par5YBKMjJrJTW2aAI1MtQvRzSDCNhdWyxiP6SkVBm6ZOcLwL+kijn\/nCot5orO1NrHHFG\/HBcSk1aaetoitrjs5BWuMxdYuIZvzSoyViVbo\/w\/LUKXdD0rlOcFmOxtcf+VKb7w1eyku07Jp94m\/\/ILLQS\/jy7ymRyfGFnPLtNqBmUKFg+uAD7JcHZiy8g6quVEhEZdm3O+tUR2wYZ5in9yKcrxqoHwhW0O4X2\/rJ4mNDvikIgaWiSNW7eIoh0NWECAwEAAaOCAWQwggFgMBYGA1UdEQQPMA2CCyoud2ViZXguY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH\/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYDVR0jBBgwFoAUX2DPYZBV34RDFIpgKrL1evRDGO8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Muc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAFNF1YB0fCkEyxRc1VQO7NUZao+PnZuavjgeTnyTKmHl\/4Zxh1Xg\/M\/f\/RHSrGrgUW2xaSZN\/Dwt2hqMtIi\/b\/AgOFeqNKmMxH3nWxf6f1Lr7QoTvApLQGqjeuIT3U6AiRMt4Ksgfx7+1Vbil1AaILo859VgXSMgVJTv4QpUpzg\/EKtUqPwMwq8PvwoTjlewyOt9YbCxNTO91JkKsYuwm7uUeU7Fx+r+rP+wgDwYVbbsUwQXAbj7QOj3dkPLzn+gcrhK1ZlgFf7Ti34xrqj7jNiaMc0dYh\/Ns3KCHMTs5rVCGLIk7lEgovwLDbJtuuQTlvaHoeZIGVPqROi5Bl\/WxAgAFPDCCBTgwggQgoAMCAQICEFE\/uXQ4cLc0QEGNMJMGmf8wDQYJKoZIhvcNAQELBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MB4XDTEzMTAzMTAwMDAwMFoXDTIzMTAzMDIzNTk1OVowfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLYBcocdC21F1Y5xUpSCZboS9gM8WifmkIoYsOlMFN+VRGCWwN6DS\/heQTJtJZ3GYEBlFn5vPd6mSeCLbeD3Vonf7IDepxTJelIH0ZPyJ0p+L55Vvb3\/dk6aNqLS4IzQRLDyDzM1pZ6hCEaIgQDJxeLHGhhkw8OUYAzHbS1zut+0GKs7rN7AXTvaTXrytU9qe6XmMqNqkQOJZlKFZakzm0CVB8qaibiBjpjSKy0TNF1k1D\/Ey\/W2uHGGPWfySVd8wA63iZNtCkJzQ89I28WSoEW+\/KDEMO41thVMj3xvQ+9jFKVShaXelIhY3UvFvnEZr71tQnY\/ycAzUR8b0s\/sPcCAwEAAaOCAWMwggFfMBIGA1UdEwEB\/wQIMAYBAf8CAQAwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNiLmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vczIuc3ltY2IuY29tMGsGA1UdIARkMGIwYAYKYIZIAYb4RQEHNjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMB8GA1UdIwQYMBaAFH\/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBCwUAA4IBAQBelFZJ3Y4tZfXBNlG2A+PannMZ8h9Zq1h+bCYFLPqB11wjFyIsN5P3huyF5rCj\/R\/iMqhFb+HZ+7mv0nCgMkJlv4T+FiqPP8Wm1qOTfUPpdCGRNSj0Y+ku7ff1XH9LmrUg6Qq94EUQDBSUml2l40uR6CSbRkBl9CJyzZn4iBH183\/mM4LmqMV+\/tAI4iVYCHFo5s2i5hTeTlIkLf3leRNT514vLU0bbUAVUiv3h4l4EoFu2U2qLXjUwiw9CF+HkZ4fDrDeMFJkhomqnWacDnYMgPJ02Cr4uDrO19YPEb5rqxT1vUGgImOJ8boPbyljZi0\/rIxyxfvH5NQP8jtPjCnHAATUMIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ\/XxrcgxiV0i6CqqpkKzj\/i5Vbext0uz\/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6\/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn\/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4\/VBEnkjWNHiDxpg8v+R70rfk\/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10\/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH\/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB\/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW\/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3\/DgAAAA=="}
-01111{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":412,"source":"webex.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":6,"flow_first_seen":1444570636270,"flow_last_seen":1444570638199,"flow_tot_l4_data_len":4110,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":685,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.200.11","src_port":47841,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01122{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":412,"source":"webex.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":6,"flow_first_seen":1444570636270,"flow_last_seen":1444570638199,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":3970,"flow_avg_l4_payload_len":661,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.200.11","src_port":47841,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00496{"flow_id":18,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":413,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570638,"pkt_ts_usec":200377,"pkt_caplen":113,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":113,"pkt_l4_len":79,"pkt":"ABoRAAACABoRAAABCABFAABjAdhAABAGpQxARHlkCggAAQG7y\/uPqpY\/cFV6qlAY\/\/9k7wAAFAMBAAEBFgMBADC+wNoJ2WMs\/kaYz+tTyOltIAk5CPeovLxPrlbRQogHN3MeURFd+ERbTcs80zOPM\/0="}
 00494{"flow_id":19,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":414,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570638,"pkt_ts_usec":201355,"pkt_caplen":113,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":113,"pkt_l4_len":79,"pkt":"ABoRAAACABoRAAABCABFAABjAdlAABAGpQxARHljCggAAQG72qGkCGxJW\/ekoFAY\/\/8w5QAAFAMBAAEBFgMBADCClCt8nCyG8uA3DQ\/JHlSa+N9aejykoxJQAMeJ2cM3K1MpJK4JimEThmjEiLBqmOU="}
 02251{"flow_id":21,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":417,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570638,"pkt_ts_usec":203525,"pkt_caplen":1408,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1408,"pkt_l4_len":1374,"pkt":"ABoRAAACABoRAAABCABFAAVyAdxAABAGr\/xARGlhCggAAQG7yKr7mOUjBGct21AY\/\/+CIwAAFwMBBSAY+YDQBCZItaZYaxWGIUxU+pqzqQ1ndJ\/\/iJygcdZYFVRuLbm3W6+z7NmtECu4DNCVX3+94D4zU64u9KtpKvaSl0gdpa85Io+OH93MqLa2zYvwufyZMp4ZAKqvEFOONvxUvJ6Rf2\/hH9FDvu13VVhRm0fNBWPq8GQ0HoUb3JK2OYHFU9WVEiPl\/2tOhRvGR3SlCDLSN\/daritZkbGZIT3sl\/zwx5b4He1UhIO2Z99Ut\/uswhzPkS+V8RDG7vpOHmoVQRP8c6HLF0gj2rhuPXrGGUus9rTIJHklDGFyo6RuVkph9haSAXZeJxiuUfUUiDlUEkBJ2iACbcSjPpJi2\/qQNsA1aIy2xCNUPKH36DehBtKYuusFoliAIakNaIqnqM8xUAMzCjnNH+fQJT22s5IsN4swGJeoIIWq00qQxPfAQkJugdHgDhMpq9sJyMgMWAhG4lbSew5eb\/RFFsAlXZhzWcL+HDMCRFVCIucYsFkgslcnigqo9pKPoE+VCPV9X9lbBKcfZFNf8Us1vYsTyZXukNpOwW5e4G0crgDXHy4Em1fergSxApwwaUJNS8llaoIbvEe9rKELwWsMGfqKXCkXyD7kIBcUpHw6ZeYs8KE8RK61uqtaPv8JjwN4YwCR38kxo8xIDYGwNfAAkUua6nun0oUBqjdbgPijp37cUaJmyAUYcG3AZaF9oJtY9MI8O5tn5Jqjw2sE84foDGhHKrIB8r5VEzC6GSVlhq6X4eDyILulDEFD46vDqLVL2\/4Tr3qRtYXZnEnd0VWsKK4IVCC3PKG62yAkj+JnKPKRbmthZDCpK8gy\/7GKgbjCWI1AYya1qAZ\/IG+XjyulObOLtyqiRDAfXB2iVSfN3JAmezIbab4Pf1qFscRTJ48rMG9gJOTPffM19HeO9a\/tD\/QLto2HGQF7a56KvrbgcIcWtUD3Cv\/9PvdDgNWylvGDpWXw2rR9vfU+N2Dl1Ecen17SuE05+ujwu7t2jiIcmMFwH5q8qIEccpc8gtwkDLT4TeKwliXx7KVmlDsif6VAr5mwYauOCTmAfXz3Wr0xrJFQI6FeGFqTrR0H00Odj5F\/qcHk5JxgSMraIdnKVRiiQQsxLFoc2Kw6wIwDPvxbz93UxrZQaLMKu5o8KjU2bncXKo99VzfFk0nFaC26+\/7+H7x2XD3PGyYtVsItxRRuuvCbGkeuknwDeliAh6O0hM9qhVtIET5whZlb2PPvbUh9BCFW19il0VaScY1lw69WS\/XkL5\/9+1bkNuTjEAXXMGf5XRXk4wFuqlV4sBk65++IfaybgGO\/FPQHzcrV001Zy\/RwwHm\/qQV2qeNR\/mSnIFLuz1mbdLc0lp\/RrnBJFXdTs6+a46ktZyJ99DaeF715TYQ0mNmbksl2gX4GhUOA7d+h7PWD0tOdpXGpEf+INYJtg4BJ9meGHTjMGjZs30LtEBO1DUf19oS8pIljghRcg6h2R3CB3emU+oWse81mypFhzKf+S6UdVAX1\/398beeL3JqOjH0Dszm5ttSXHcGf33c3nsWjmm46g6Jnf5So6OCgTbCPRmhgaLaa40OjYnIp3g9\/JhRn6xLYtp+Ud5ZS1P7T1LKP2i9l1RLdP49imtCA0QlpitAIqOryU16iMmLIKNzQIzibqbciIe3zK16uWFigqS0fNlQKcGD0cx4vldfmuL51jQE9rH5vjgGgvfajqdhiygny49i7ZGxzWK72uvo109E79EzsPfLxcE9oMjD3XsRvTf5HFQMBACBwpCiWSOZI3NIV2SER6CDEMofuNUDvBcJ0bovrQ+QYzA=="}
@@ -328,7 +328,7 @@
 03390{"flow_id":12,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":419,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570638,"pkt_ts_usec":211110,"pkt_caplen":2245,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2245,"pkt_l4_len":2211,"pkt":"ABoRAAACABoRAAABCABFAAi3Ad5AABAGpfXRxd6fCggAAQG7uYqEY\/z4e5wV5lAY\/\/+KCQAAFwMBBWBIqRCnjYw8AfOCURpJNQkDYpxFSqEWp9kGgM6+ZYVEbRytMlDHxnWfc8XZN0\/Jx7gF6TEHjiFhieHTDTuzl20HC5RG2oksahpab2gea21+eA1clGlLDvJNsylN8CXpCCMwwprtbgW1\/rIaDuT0+vCA3CBDI3e43enZ2EwtySD5WREZQAkB72UnhKctapztUkRwKQ2bJ43R12kihf+6z0YPr4q3WVPdfb3xCscmWD18tPnrOPmJrswfsHxOZpcc+RthLw5c7GmSU5xY8Yf2vN19SF43r0pye6in2J41Z2gaNvaxMpSrFZJNL\/5vm76QKvswMO\/z74tEJzSVPKnytSud9RC7wn3pzzVt9JVLF5dJoXUzNj59FuUDW5G\/tFH4tp9tQRBv4JD\/wjgi0YIxsJMnMJzFwTUrc8La9f8cBd0bVi\/sAtX2XfNp0zcaSUQtwD6mcSr4PkefKYzvskeHxFboGOlGiK32+wpwLwQQ0\/mseViunDbX7mwX1WMKgqMCgqXFO8Tr7906FOzo0py\/b\/xSsoj+IkFrOfDA1kpJJgryct26OBaleVQZN\/Y65WbI15Wt3eqdtx0pp2Rd0j6StI\/Q+\/Vu6McmpD5gO2pY8d5buH2TgUup\/jmD1ckiu2q7gGyBftClq4fwH7ZuEuauJn\/jby1BZwayn0+\/m2Jy1yBnsLiZ+5xlUsXalwMx3oGSWFxq+fdhU18NJO6CAKEafqdPbeJxL0qlMMeBWD4KCn0lPEyL0\/B7gG+GhSyLCSpxBNdZqJVpp4b5ehZgZCjRc9nDxzv0w3gGjDmNa2Aa8QKLewl9vaaFedxmbF9ESp9wdavX9sfzsRsNJVQTMLhDL6GTf5CnVmUo16Mq\/8bX8\/xGYqX86p60mSVxkgVjBhMiFNaODFwwUSWHuA7z23dEJflVFaV69cVoAuJJXK62xCxl7MRIzqwwz3kSWhRc+GhI+q7dLO4qSORsgbML4dEbVTNliss\/aH0aRdch8qZcTvWikQECyuh40wBuYkN3iQXI7xTKTsXHTU2qExx2UOIkGZDeRd53O\/W3+XlhiJ2ZPUhJ7sTXR176q5kj+rcdGgEshWWKpg55m8DNM5L\/fDWBTlE+2o2Mkq0H4DeMVHgzHCo0Ms8UD6F8FnjchVBfmHmFPxgoX+R\/PRv\/\/WQe+b7Kv0yL4VBi21cWYRau2NRC8zYoPQeEd563VJI+xljYAa15PdGXP7CFHMPN0gSQ+JqStWMZaOf4TRz9noSM7UtVQBAzngtvpuGMV6l+kvGrSQ0oasGJPmuROFlVsYZ\/CZgumw9vUO0XCH9\/v7JUyGEeIUZGBUT69ddZDk1QW\/WLKySV\/EubY2L9voSh+NFlmE6mi2hfn53mJaoyMfjY7lD4hzEgPtwwCQm0CSL\/Xy2WgRHGsHuNjw\/DxF67k5R7Kib3omVifzmQ3h+4zu5w01JhNagkG42xiEGjaNeOrBNpgu\/eyg0RZFDNaSIfe6O+pQAVGlg78dsHgNlQzhWl80jnNBKiKB4YxhXqK1BddjVMXrJUbFRfRZoyXX+GFMGymnQabyjEmYSMEju8C6VgiM96XB9w0acHReqz51t6+PObTup4iE51KXW7BQJCtGWHY230GR8ZA6otFcHTCR3A0I6LSvHs6Tg7wsTQMEdo+0I9QJfK8gwuYFV8AcB8DXpLAUOcMVDhQ7roZVrHP3dcAgiOAmOAErr4vjrwTr8KMZ4O\/z0emWAxmLSW3zqUzB9g+3RoWqx2NavuU5gtmc0766kh2bm6VDt7AK45IcabzPKwwdpsHgfWJb8E\/fG1pF+Z1mJyxyz4uP+TJhB+7FFUwYQzwWGgbRcDAQMAe+ZhlsRtShTkg2fyevfKzdzv+GBE1hQQtOhsn3QgyFEBLjPVI8L5PlpSSEq4VM7bJLFmEXM78FpxLY0XabtQRgUsd669ge2ZN2e+T5DjcJPhk0UGy\/7MyAi2xpy9TqsmrXspvvhlECVbfAyegLlrBt+0lYXdP14hvwjSRu8JJXg2vqB8kQmumF6fcnSV60Qe2jVahhghcNMpX0N\/qjO5Ovxs922FmuGmx28RmfVnwhbZMWLS1YFVcOLqiOt\/6yTpLv63MAedZaCcKtkAcMe0G6REe4sldgkurKzkBAOb7WzYhMGog5NTkJX2kJT7tv9y07GZo0nuCQlTM3ZsboApMZP+7cJqXuD\/BwIuw2wEBAT1Wae07bUJOuS5k5k6fYAaXiSUyHJgQg+VTMUbIcVSybfLEetZIGPkz9nw6maaY\/sNPbGu6yvEL50s7Z+3BlZ2A8exqziAHLi3V1hp5nXLcKVClFv7fnkYuikhLVgN23\/mJRITPSgOVB4zbN\/UtCN+Zyaos6KX23xiqOFLfdJldq82L5dt+P2\/xZ5ZDvv\/FnCNVo5LoyVEAeya9mIk3afznCnNuhb5a\/2enaU8gYvJz\/eqHHu+ZtY27iYzTaxqrl2ndFC7kTyeLUb1ZYRbjwbRb8JrZjmZWIdcCRAWS4PyqKtzl5cQqqq7BKHvqlWayoSgoXG1YUyM6ecUEjLP0IjHORAlPfuonr+WCdIgJNb6Lik9TMnkmtoTO8W8w55FBc2cgrp6YsbhW64d5LgxE440r+1GSqpMQuuZ09mDfKC1V3kPVfzOoGv0qOKIOI0LCAvMrKldxU0\/371NprLzkn+MzYc+6tnaaTa+d4dnCOxa+dsBNE4M7CQpwiOIfiZQXBLHs+BKAsQOI9SN+bFxGd54ByEGe6rquTSNA0HP2I6cpKOMrdV9288rhbIO6Uf2hkJCsbc\/emCCd4cg7WwBwprwtd4kmg1E99CFqRvUrOkgG4ASgNdBjV0500oGGZOfGvBlULWxfRJ\/TvkgB0\/UsZk9FQMBACBIp8wb88lQWNdzs2Pb2nZJRWd7eiMKNXHcuIJts1BROg=="}
 03392{"flow_id":13,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":420,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570638,"pkt_ts_usec":211737,"pkt_caplen":2245,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2245,"pkt_l4_len":2211,"pkt":"ABoRAAACABoRAAABCABFAAi3Ad9AABAGnHxARHmZCggAAQG74S8Y3F5K5yO0lFAY\/\/\/VXgAAFwMBBWAwLX8ZpC+NjLNrThU\/Qiu7MZG0sO8PFM2Y8cX67I+4GS4myH53ZMqEe8nFxFhsL89AjQ4jVY\/oTPkHSVrq6JwXoUPXAd60UI1\/CcpPBlj\/ksEAtFL1gPkgGAnKl6RcFXh06W3R+bNqbwxP4LbNOQQY27QRro1L1s3NcPfx3LDThjwf608Rog2U\/Hxaw2+DS\/DmTrHJL6rclrmHDhaTsOXzEZm2FUr31NKhu2WCPAa\/\/mjbu8Ur86JPEDdmYiD6zJ+2fzqqzTQ9Gs0QLDIoyCETJ9K2yJ6mHDhEDorBwxIv\/WMGQ838uIAw+2Yf6GZOFEDwgvUXt8B7E9BRq9Eu1TfhVcoNIZJFIAoiKID1teFchbo1Hyn4U1OVk2faVixZbhEHhqT8HQyvSjgdOkOt3nvSKy5rzbRL+uttdTV3BCbbXfCRt4uUI6qMTFBjp2UsrvVxu4qSj4TzMym5YyhOlldW8EbAeBaGWoi1W842kR\/DFhsFGxRkLpEAQGXUuxB35ssimoJjYPCsCr3WF0gk8cC5iY8W6WshhREPJYgJIQJ\/moz+DJBZTyEcRfpcmjATwxO8rnCQxHEIjXGz2KjdmOG2vSkJOVEqr422zYuhJz38igYVpTNHkVxHt\/bVIBz\/5oczZwrSH40g0fjlidkLHQS5a\/Z9I3cj3GRbUDDnTMl8EvOf\/L+QTeOF\/3xf2NIcDhtCwQcDnO0D1JowYRbx9klMDwzzwSJK7um3RiDzrqHJWKAemZO+XaAzs6mG3TA\/1JrsFH7FL2CONlfyJHx1jvc2gQ33j9\/3lEy2\/+ButxDDU9awHYovEUcSMP\/qjJgPNjRLnzlkqlETK1so\/Odxmot6NGMv3TFWnahFcdbkBp+HTGXaP4NTS\/Flb4m5ykhnnEyXVjPRVEiWUL95\/H8s0GFx53XN\/9TdvYwzi4wClz61AWfbHZCihcmoSRgSWmOBElVA1h1csdciy6US75mMvpdUsP\/uCi5Zm5eLQz6OVGTkE\/OZB+ZJD\/TMXT5THU4hwDQMn7K5cezP98Ln\/e1+OIGEwkSzsWXfvh\/5gmjleCiRHsvxGVqKKxEvwiShn6UXjVYil93vyUGD7kU9Lbpyn+elmI1kCCl0tuuXFBzDSSAXiDHSlyVqD7fVFcgbUsYMBmn9JWnq\/tfHjbOxJwF\/N7bjn8vbxLjehD84NIYLGOn1bAI0OeIuuP2v1\/htfdzui1fcigF8hmSYomcOyCVeq5nT8bAIozkFv6aNzU+fJqgydQlnpoqE6eZcvkRsG96LeJiIs669DTNLgP71ZWdkMaeur6KelTJoUZ9RimFoTAJxak6CShYXWCZAQ0cq\/IAwuzS9LWRfSZy4rtPxyYe44uH6BPay2oW+91ZFStjES+\/dOJ8jNVTSPa0+Cr8jIspeXXbWyqrpM\/HK6xM1OXl7QyTKVgWWq3dkOwIb+3WjxHB8EtJPMV7LlVggKZk\/dxNBaN0PEvOAnLioQpsR3l24kZnJr3KylVsFsQVG\/xFfX8PWoVutljM9MLvnjOYC2dd8TZEbpf6o9jvJHBATbBKIQw\/eXMQitoNMISXU6UUcWQLjYglmThUkEU6F27pAvmlmKa4SjWIkMTr2eA5u5VZsSzscvP8QibmEKpg8AEE6KiQI9SNNFcCoFHCtMkWaeaqRUkpAT7RNQ3o70jyZLIdWQBMKhcPE4yrrQtCpdBkmf\/RlHMobSakmS9u+LZwjEZrcCofeHgDzENuSM7xEPIJ+GrC3cdX8Up3e6s35vXcsywe1AZEUukKAjGbcFW9P6PksoMQudKZQgrY2NA+yepkIG3rg0eQ+CCEKB\/Xas1RtvN8QWBcDAQMAOc27yvY7FIJcRuB+j6sqt+3JjDpMvi3BKr5GfGDFKnOeYy4i7qdxOPRjXbRLuhZpEiZbu6fAyX0xrWV8cK7ZucQsmE\/kdwuToIg2PbUfZKR3RlXKuRgUhgAilWCbs0JAYM7I6SGb81A9jKGTZUJKK1zMhXj0IuIiEkuHmvLGuC+nnZWgfZCBNYc38UF2f9DsVNAfnS09bO9HEDCMleKUCpQ0LEM7oteYhZETtZb9Y+xemK+TPWGOT+TlZvlEEE3FKRjDdLxelebkCzwgHxgGBatYmvE2mb8pd30dYeSEYf3XQdauToAZpU2dpqIYKG1OuYgj\/XxMz1qsHobHQULq494dfD+8ql9hivT1yV0tc2PCavYedg5YOV1RYid+b5Ik4DzT3QshRJXrwgr6ZM8VqgIpIBtluEP0Kt\/S2PZrmChVtafPqgV7pnS5VdWgy1Me9MKlvmkjLO9MmmTZR6EMhd1FBWVZWV\/+wvPEpepamB69SWyLTQ16AqTMt0mJq8RhjrWcafqIRzb7bn2XpWqZwn0wYkv7L27\/ORlZXXpqsUND4VLQIaC092AiCKT2zidGwyFInBaeBKTio0BetL3qP7ZyB8QCl3DYDn41Cdx76zCnL+A1ausO1PBR7I+Sl85bn5X3tH6QhtLgorunc0iQkr0WOQPB0WIKUI4cDj0wfjoRLUDJ3wTMHiH6QCawDkIPaWLvFxfXZWCp63KX2Uti5JGhhuSLa2Ac9N6RcIGzskPl68UlZAR+0gmGEHYVa22tUCSZ2d36spGZMn3K4s3scj\/Na6KLvsI4GV1TXvL7oNvbMLdeUfX\/2gFYjHN+2jGrFtWmvbHajuC3\/fTFgWsedk2+cnM23ZQEHJNpaAydnWsDvp1CjNLPzqXxmGWBM6eoNmVAkNDd3glxS2fDd+ScafZM1QCBw\/WO+SvRXrWKcZ7K8VAtFAe9Pb0Rfjr+XRAf9pGjrykMP\/KYHsZXsRRE5vXE\/1dvCTNVi1ISVXagvJtihI0rq7CyBrRVm9HMkqfzFQMBACB4uyAggbr8leqvh4SMZbnXe3zvVEUIp3e2CJOZK3lXhg=="}
 03866{"flow_id":23,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":421,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570638,"pkt_ts_usec":212212,"pkt_caplen":2608,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2608,"pkt_l4_len":2574,"pkt":"ABoRAAACABoRAAABCABFAAoiAeBAABAGq0JARGlnCggAAQG7oar5IvZFBt0c6VAY\/\/9g+wAAFwMBCdCK5dEYCE9oHkE3SpubThJUXHGcidWdcxDMgTa12LtrUw8bMQZCwdunM8HzMEz2zgyp5AvwwEuRQ0x+Fl3+\/AqPwG0s5WMib3\/d6T+l+iiahv346Rf9OTEr0ILMEJkx9frczSG9KytDHXomCsNwVbxwrqWB5ATREJ1nAQ9E+LzVpP\/U+uMEO0G5j1MMku2xOTETmqZ5aKQmFG7USDFkRc3Roj82iIzSZKyCTHGES60pTDDd6m6i5UimAPWpS06e5LgtwHKgqB3Pl4UE7UEkifQ2x25d5y16grqaFUwLyEsoRvYSUTGOE3i6D9ivBoPePih2fooAVPAc3Fl4KYBbEhJb2yupgYoVWqMYMr3Z2v9eOC8t9tl\/VdulNM1pbdZ\/jWn1UXzjnwuZjqDZ1rKEo042qrE3H\/TA78FScV21e8lPcS+jaxgm1DQ8lRbu\/XQE1qTsgQypn381Q7oug1ZgEpy0dVt7eVI1xiDAdOFmRy3D1xBRz0T2rcFTG01GBw17Dv0UuI+zNjo\/4PawXO8lrpfG2412ABWrfn8UEByN3I8Zj+wsBDDhRx8nVJmx\/STQHEIAWD7qvtEQffwdg1FsqtP6n3lu1smBumVNRLiz01whCzi1nj6ARxgXNkjc6y+vRC8sgxdmMlOqvgGx4YXKiXl8e8FuMTN6yjf44o85ZlaVt56hIkK\/kN7rMfz0ZGXOEl3rczDkaGgzZZZqiNOsHECPOYlJczABbsqx\/kjo4gZNImKtqhCSLSG2iDEtbYFYkxMCmPkQ7BKn6WjxndfsdbWOn89JHSHwX6ycxoFUIQNYEGG7r97JSH9brW8FDRUmKmoQjJILO6Rl1L3AhrdhnmGiDvj+GMwZCmFQDU1cYH2PViJu+MycMRl5UTiKnyOMeEqTzq1+iUmOHHYWvVsC0V6wKkOYQqBmZigC1GESOHd4qezBl8LqxeTLpO9LY9\/Ygw+ofYIKrY8rkn4FN9L4gK4e9YNxqdzcw5iLxS9+dQKynbIgwQAeq80NjGPqliC7hPhnauZpyYUxAdT3H\/wjXxYmYAaQKLkOaW0SknLbVO3M0voO5ngCPOvRZsxog90A9isviQ5ZiafJVT6Us4TDvb6YhD85MIW4tJUrfYxQV3Ro6Y3JguaaKkfpHRxAhWjtXC1AK3sVdsChFCxVXzZ+P35Oyu\/nALPWCfqvgFBBQaYcxyaSk9R6qXOV8OC3GpacYLvYmhBiT+sma4\/iyfuY3rmGL7oSAtLoynpWooJL5lcLxTk4teSYhgE4\/OFv0IhYy33fa2DRDoPqxbWQeUo4EswfdMW1NeqRIyCpcJNu+rO5ex9Q\/ecqlurBUOLi01sc5rjoYhegURRPTGTqoBlLv4KMskPUkwqfUqHbYvwQRprqTRdXhmx26sxN2CI\/QN5EDt0WvmYQfuXIoP2IpkxYUeBsgMdMuNFwR5CIiXq9sFDTAXFvaxfDOJinGWv\/eOyJWVkIGZkX0n+wN46Zw\/pVSMBMbXfZHzMGgqavn4qdDoNyCyjsIa3x8suJk+q5+nv0yh4k+iKTKEanfCF7BYqAwYrD1tVJvIqnC+rV8b9Zy4NyLD7bzv2UBm0nimg3XFjOV98qoN0iyDnvUOv6yZZXdzcCffKuu4nWivmIhoWUnT61sVBWiElNE8YgkowiDHi+mxlc\/oNcBrARNn0P0igbhat3b1akdrCxDR2\/U6cH0oaNhCEolXs\/yKaJ95xLb8hTk9mYTOH\/uROpjf7JG9OHNJJcq3q9VWi1fDWOv7\/F94Z7pB+bdMIBNzGgsj1i7ZXbkcEEyPk9T2grNbzHznbwZfLISKTTNoW5jiyFMHEGllFIE16v8dHxQzajq9OWj0SltehQ119DBfCxIxHvvpFPyx0eIWDHKWmwCeN7xj4bXDMLYJupbD4VKHtRRtv5o4YQ675DoWOVk78XsnH4AB9NqX7TQD\/D7sYMUPQuBwD+c4m+uyrKfO4QqBNnCXQaxhnzlXc+8CPcFDgj9b8sd2\/ke2yefxzj0tFSbEvGYhFiA65W79kISOzBxUPbVXhtCj1s0209bdvsrZF5ikonuKFdymCqveoneVPXQESGOo9bws2D7HuDHB4W\/j+dDmQBLQz336V+9uLZ8tvBdTscoUMqwbDTUd5N6d0dmDCR3B5pvftwil+ftPXSP6mmn+FxUWV5nbr\/M98wXANPMJ+UkVbPg8qGypyZ2Fiyptc7PkKevXGlPGe5fVc0Il2F0t4RTVTFOVGE3yThumtuHr9bfKJXT3XkhFjf+8TVWF3+Td2KC+4AeOBHbQYSDxVD3g2bGi0s4uP4C4KjDCWoD61C230SjXICRct1NF\/axFUSFaw8\/rq75gL5iIHvQ6vFd6nQLTFPcwrjLF505QOhebJ+VrU+KJYBUcVqgo7M6X4TY1e+pTlQd+Y+zzsHMh6T3BwcEDOlFzZwzOyDc8m6jt0eZ2ZuolmucLjXEwSb7wM7xpJ0bGVvbIpYRtY0u2Vkme+BkLi9GT8HvNeKx79Gp4qn47tv6sIMY5d5JEVsQtSdmOHVUnn3AXdGKp4r2+ZOL+p13hTWXyoqCerenzG+2Bjpp1aMab6Yew92WQq+3yGhDXmkOv1sBHTcOpoG+oloye3gAsg+uAxYkwWrHzUU9zBYVy\/Vz+XtEkenIZRJMCOgGYh+2q+3Oqyu6vSaOuzbDM77Mk4tuRJwJhxqz5QTiQF4C7rbWDhFBzXWKDqkNguCiiibxO4ZPOuZwMroaG2pVqLrtipPOFLSSauoblrzOFkbD+Jz987MCevqnGCktde1xw0sNRogWyaA7Ej+6e022ffku4ryJqqsaHDvkHI7pInrb\/y74a\/zyHyZdmHTaKfKtZwW53tYxkEhks+SUr9ZdCguudE5dZQdokJHXaad97apBZNEjmJ5i8v\/\/DX+ZAbLGd6A8ejIz\/HZlctBSy7giKH0HgjpJr7mBro2t3XmMLskFdAfqbb6gkTcc+VMT865Rlkunikmf7LsHKLxoXs9ItYXe3chSJX9jpDefuJX+W\/94VDJ9JX65x\/CdAPOw4y8Wfan\/idNdBzMqbKzoyzAVnjKX3TZYL7uZQyj8qLiOireH\/3y+YRGZVry8v4n6iE5RCRFnzYyblek8nWmOS5J0IP9QhIgNemLIfV1to\/LMRyAhUx6sCMbJpdwV+yzJVkjzxDztVAdY4qbREl4ebJXnGDHyqLobJd+5mxY1tsnGHoJSb3yB00x3vhc1m046nlLV3EtLCTxYPBBxJp+zCDsKHtXBcsoQ9x1LT5SmtgZKVmJoKc21ydRf1d2PhWdHvMo6z3Cxhe8r3YrCL7q8sF7w4sG9xnjOJGkASvAFPtxCf+EZEHWEp7kFQMBACCCItIQVCaP2PI7n+NEWkiy8a7lKqnCPKr5eoNbQO79Sw=="}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":422,"source":"webex.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1444570638225,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"216.58.208.40","src_port":43433,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":422,"source":"webex.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1444570638225,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"216.58.208.40","src_port":43433,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":25,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":422,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570638,"pkt_ts_usec":225615,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8UR1AAEAGNzMKCAAB2DrQKKmpAbtoC5J\/AAAAAKACOQjy7gAAAgQFtAQCCAoATMNiAAAAAAEDAwY="}
 00409{"flow_id":25,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":423,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570638,"pkt_ts_usec":234305,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAeFAABAGtoPYOtAoCggAAQG7qamX9G2AaAuSgFAS\/\/9SAQAA"}
 00408{"flow_id":11,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":424,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570638,"pkt_ts_usec":235564,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoNx9AAEAGu1kKCAABch3MMcm+AbvkVPd2G6sZU1ARTvg8QAAA"}
@@ -357,30 +357,30 @@
 00408{"flow_id":23,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":452,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570639,"pkt_ts_usec":262175,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo2l5AAEAGrL0KCAABQERpZ6GqAbsG3Rzp+SMAP1AQa7XP3AAA"}
 00411{"flow_id":23,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":453,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570639,"pkt_ts_usec":263789,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAe9AABAGtS1ARGlnCggAAQG7oar5IwA\/Bt0c6VAR\/\/87kQAA"}
 00717{"flow_id":25,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":455,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570639,"pkt_ts_usec":266192,"pkt_caplen":281,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":281,"pkt_l4_len":247,"pkt":"ABoRAAACABoRAAABCABFAAELUR9AAEAGNmIKCAAB2DrQKKmpAbtoC5KAl\/RtgVAYOQjE6AAAFgMBAN4BAADaAwOv\/q6xmTCIAwLzDcizR7a\/t25hvWTVcDLyx+PEedO+jAAAKMArwCzAL8AwAJ4An8AJwArAE8AUADMAOcAHwBEAnACdAC8ANQAFAP8BAACJAAAAHQAbAAAYc3NsLmdvb2dsZS1hbmFseXRpY3MuY29tAAsABAMAAQIACgA0ADIADgANABkACwAMABgACQAKABYAFwAIAAYABwAUABUABAAFABIAEwABAAIAAwAPABAAEQAjAAAADQAgAB4GAQYCBgMFAQUCBQMEAQQCBAMDAQMCAwMCAQICAgM="}
-00766{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":455,"source":"webex.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":4,"flow_first_seen":1444570638225,"flow_last_seen":1444570639266,"flow_tot_l4_data_len":327,"flow_min_l4_data_len":20,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":81,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"216.58.208.40","src_port":43433,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"ssl.google-analytics.com","ja3":"75edb912bc6f0a222ae3e3e47f5c89b1","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00777{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":455,"source":"webex.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":4,"flow_first_seen":1444570638225,"flow_last_seen":1444570639266,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":227,"flow_tot_l4_payload_len":227,"flow_avg_l4_payload_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"216.58.208.40","src_port":43433,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"ssl.google-analytics.com","ja3":"75edb912bc6f0a222ae3e3e47f5c89b1","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":25,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":456,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570639,"pkt_ts_usec":266643,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfBAABAGtnTYOtAoCggAAQG7qamX9G2BaAuTY1AQ\/\/9RHwAA"}
 01271{"flow_id":24,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":457,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570639,"pkt_ts_usec":266868,"pkt_caplen":698,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":698,"pkt_l4_len":664,"pkt":"ABoRAAACABoRAAABCABFAAKsAABAAEARgN0KCAABrBABS\/waE8QCmKnIUkVHSVNURVIgc2lwOjE3Mi4xNi4xLjc1O3RyYW5zcG9ydD1VRFAgU0lQLzIuMA0KVmlhOiBTSVAvMi4wL1VEUCAxMC4xMzMuMjA2LjQ3OjY0NTM4O2JyYW5jaD16OWhHNGJLLTUyNDI4Ny0xLS0tM2U0Njk4NjE4Y2ZiMmI3MztycG9ydA0KTWF4LUZvcndhcmRzOiA3MA0KQ29udGFjdDogPHNpcDo0NTE5MUAxMC4xMzMuMjA2LjQ3OjY0NTM4O3JpbnN0YW5jZT03YTQ2ZjFlMTI3MDJlN2ZiO3RyYW5zcG9ydD1VRFA+DQpUbzogPHNpcDo0NTE5MUAxNzIuMTYuMS43NTt0cmFuc3BvcnQ9VURQPg0KRnJvbTogPHNpcDo0NTE5MUAxNzIuMTYuMS43NTt0cmFuc3BvcnQ9VURQPjt0YWc9ZDM4MzM3NjcNCkNhbGwtSUQ6IEtvcExUdzl4c19sRXBDdGlQYTA3YlEuLg0KQ1NlcTogNCBSRUdJU1RFUg0KRXhwaXJlczogNjANCkFsbG93OiBJTlZJVEUsIEFDSywgQ0FOQ0VMLCBCWUUsIE5PVElGWSwgUkVGRVIsIE1FU1NBR0UsIE9QVElPTlMsIElORk8sIFNVQlNDUklCRQ0KU3VwcG9ydGVkOiByZXBsYWNlcywgbm9yZWZlcnN1YiwgZXh0ZW5kZWQtcmVmZXIsIHRpbWVyLCBvdXRib3VuZCwgcGF0aCwgWC1jaXNjby1zZXJ2aWNldXJpDQpVc2VyLUFnZW50OiBab2lwZXIgcjMzNjg4DQpBbGxvdy1FdmVudHM6IHByZXNlbmNlLCBrcG1sDQpDb250ZW50LUxlbmd0aDogMA0KDQo="}
 00408{"flow_id":22,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":458,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":266395,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoY+dAAEAGIzoKCAABQERpYpEJAbvtraR6ElJuhFARTO8JcgAA"}
 00410{"flow_id":22,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":459,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":267573,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfFAABAGtTBARGliCggAAQG7kQkSUm6E7a2ke1AQ\/\/9WYQAA"}
-00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":461,"source":"webex.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1444570640269,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.202.139","src_port":47135,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":461,"source":"webex.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1444570640269,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.202.139","src_port":47135,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":26,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":461,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":269875,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8fMBAAEAGd0oKCAABch3Ki7gfAbudV783AAAAAKACOQjtmQAAAgQFtAQCCAoATMP3AAAAAAEDAwY="}
 00410{"flow_id":26,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":462,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":284293,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfNAABAGIixyHcqLCggAAQG7uB9iqEDInVe\/OFAS\/\/+vRQAA"}
-00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":463,"source":"webex.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1444570640284,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.213.212","src_port":41757,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":463,"source":"webex.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1444570640284,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.213.212","src_port":41757,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":27,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":463,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":284770,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8nBhAAEAGTKkKCAABch3V1KMdAbtvG1\/vAAAAAKACOQiE1wAAAgQFtAQCCAoATMP3AAAAAAEDAwY="}
 00410{"flow_id":27,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":464,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":298110,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfRAABAGFuJyHdXUCggAAQG7ox2Q5KAQbxtf8FAS\/\/+4\/gAA"}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":465,"source":"webex.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1444570640298,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.204.49","src_port":51676,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":465,"source":"webex.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1444570640298,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.204.49","src_port":51676,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":28,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":465,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":298584,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8YQlAAEAGkVsKCAABch3MMcncAbvjbaL+AAAAAKACOQiwWQAAAgQFtAQCCAoATMP3AAAAAAEDAwY="}
 00410{"flow_id":28,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":466,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":309751,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfVAABAGIIRyHcwxCggAAQG7ydwckl0B422i\/1AS\/\/+b4gAA"}
-00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":467,"source":"webex.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1444570640310,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.98","src_port":37139,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":467,"source":"webex.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1444570640310,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.98","src_port":37139,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":29,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":467,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":310108,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8S45AAEAGO38KCAABQERpYpETAbtLyIh5AAAAAKACOQgv9gAAAgQFtAQCCAoATMP3AAAAAAEDAwY="}
 00409{"flow_id":29,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":468,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":319368,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfZAABAGtStARGliCggAAQG7kRO0N3eGS8iIelAS\/\/9pVAAA"}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":469,"source":"webex.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1444570640319,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41394,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":469,"source":"webex.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1444570640319,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41394,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":30,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":469,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":319795,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8c3VAAEAGE5MKCAABQERpZ6GyAbtpybCOAAAAAKACOQjZNwAAAgQFtAQCCAoATMP7AAAAAAEDAwY="}
 00409{"flow_id":30,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":470,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":330160,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfdAABAGtSVARGlnCggAAQG7obKWNk9xacmwj1AS\/\/9YsAAA"}
-00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":471,"source":"webex.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1444570640330,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51134,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":471,"source":"webex.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1444570640330,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51134,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":31,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":471,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":330424,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8tGhAAEAGXWUKCAABPm3geMe+AbssX3BwAAAAAKACOQi7XAAAAgQFtAQCCAoATMQYAAAAAAEDAwY="}
 00409{"flow_id":31,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":472,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":338147,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfhAABAGP+o+beB4CggAAQG7x77ToI+PLF9wcVAS\/\/+9aQAA"}
-00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":473,"source":"webex.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1444570640338,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51135,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":473,"source":"webex.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1444570640338,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51135,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":32,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":473,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":338595,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA82ZNAAEAGODoKCAABPm3geMe\/Abvolh2LAAAAAKACOQhSCQAAAgQFtAQCCAoATMQYAAAAAAEDAwY="}
 00409{"flow_id":32,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":474,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":344333,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAflAABAGP+k+beB4CggAAQG7x78XaeJ06JYdjFAS\/\/+9aAAA"}
 00409{"flow_id":16,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":475,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":344574,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAABAAEAG9B4KCAABch3Ki7gMAbtSShQeAAAAAFAEAABI\/wAA"}
@@ -391,7 +391,7 @@
 00408{"flow_id":19,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":480,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":345761,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAABAAEAGdyAKCAABQER5Y9qhAbtb96ShAAAAAFAEAAAPOwAA"}
 00408{"flow_id":20,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":481,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":345959,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAABAAEAG9p4KCAABch3IC7rhAbtuYS1kAAAAAFAEAAATTQAA"}
 00408{"flow_id":20,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":482,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":346151,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAABAAEAG9p4KCAABch3IC7rhAbtuYS1kAAAAAFAEAAATTQAA"}
-00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":484,"source":"webex.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1444570640346,"flow_last_seen":0,"flow_tot_l4_data_len":55,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"80.74.110.68","src_port":33459,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":484,"source":"webex.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1444570640346,"flow_last_seen":0,"flow_min_l4_payload_len":23,"flow_max_l4_payload_len":23,"flow_tot_l4_payload_len":23,"flow_avg_l4_payload_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"80.74.110.68","src_port":33459,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00457{"flow_id":33,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":484,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":346801,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"ABoRAAACABoRAAABCABFAABLP\/ZAAEAGY3QKhc4vUEpuRIKzAbsvtI0Fj3ahWYAYAWE\/AgAAAQEICgBMxFRXHeViFQMBABJ8gv9dmaTjHFUtA85jnlaY0C8="}
 00424{"flow_id":33,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":485,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":347186,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABoRAAACABoRAAABCABFAAA0P\/dAAEAGY4oKhc4vUEpuRIKzAbsvtI0cj3ahWYARAWFq6AAAAQEICgBMxFRXHeVi"}
 00409{"flow_id":33,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":486,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":347516,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfpAABAG0ZNQSm5ECoXOLwG7grOPdqFZL7SNHVAQ\/\/+mgQAA"}
@@ -404,10 +404,10 @@
 00410{"flow_id":28,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":493,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":372948,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAf5AABAGIHtyHcwxCggAAQG7ydwckl0B422i\/1AS\/\/+b4gAA"}
 00435{"flow_id":29,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":494,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":373238,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8S49AAEAGO34KCAABQERpYpETAbtLyIh5AAAAAKACOQgvkgAAAgQFtAQCCAoATMRbAAAAAAEDAwY="}
 00409{"flow_id":29,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":495,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":381985,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAf9AABAGtSJARGliCggAAQG7kRO0N3eGS8iIelAS\/\/9pVAAA"}
-00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":496,"source":"webex.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1444570640382,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33511,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":496,"source":"webex.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1444570640382,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33511,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":34,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":496,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":382255,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8O9hAAEAGNk0KCAABUEpuRILnAbv7u\/+DAAAAAKACOQgB2AAAAgQFtAQCCAoATMRbAAAAAAEDAwY="}
 00410{"flow_id":34,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":497,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":385652,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAgBAABAGoDlQSm5ECggAAQG7gucERAB8+7v\/hFAS\/\/9imAAA"}
-00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":498,"source":"webex.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1444570640385,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33512,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":498,"source":"webex.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1444570640385,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33512,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":35,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":498,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":385961,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8smJAAEAGv8IKCAABUEpuRILoAbtZhnY\/AAAAAKACOQgtTwAAAgQFtAQCCAoATMRdAAAAAAEDAwY="}
 00409{"flow_id":35,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":499,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":389057,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAgFAABAGoDhQSm5ECggAAQG7guimeYnAWYZ2QFAS\/\/9ilwAA"}
 00435{"flow_id":30,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":500,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":389377,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8c3ZAAEAGE5IKCAABQERpZ6GyAbtpybCOAAAAAKACOQjY0wAAAgQFtAQCCAoATMRfAAAAAAEDAwY="}
@@ -418,31 +418,31 @@
 00409{"flow_id":32,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":505,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":403608,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAgRAABAGP94+beB4CggAAQG7x78XaeJ06JYdjFAS\/\/+9aAAA"}
 00407{"flow_id":26,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":508,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":404023,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAofMJAAEAGd1wKCAABch3Ki7gfAbudV784YqhAyVAQOQh2PgAA"}
 00493{"flow_id":26,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":509,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":404146,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnfMNAAEAGdxwKCAABch3Ki7gfAbudV784YqhAyVAYOQizYAAAFgMBADoBAAA2AwHL0KbklNiTQBXXAOTSW3u+JaExiKsBBup5X7QAW6mJdAAABAA1AP8BAAAJACMAAAAPAAEB"}
-00732{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":509,"source":"webex.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":6,"flow_first_seen":1444570640269,"flow_last_seen":1444570640404,"flow_tot_l4_data_len":223,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.202.139","src_port":47135,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00742{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":509,"source":"webex.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":6,"flow_first_seen":1444570640269,"flow_last_seen":1444570640404,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.202.139","src_port":47135,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00410{"flow_id":26,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":510,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":404321,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAgVAABAGIhpyHcqLCggAAQG7uB9iqEDJnVe\/d1AQ\/\/+vBwAA"}
 00409{"flow_id":27,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":511,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":404444,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAonBpAAEAGTLsKCAABch3V1KMdAbtvG1\/wkOSgEVAQOQh\/9wAA"}
 00494{"flow_id":27,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":512,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":404564,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnnBtAAEAGTHsKCAABch3V1KMdAbtvG1\/wkOSgEVAYOQgbMgAAFgMBADoBAAA2AwGrp6IiqHkBm3loHqbaZBzbVkh+xkbqhD+UPXWnBcnLxAAABAA1AP8BAAAJACMAAAAPAAEB"}
-00732{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":512,"source":"webex.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":6,"flow_first_seen":1444570640284,"flow_last_seen":1444570640404,"flow_tot_l4_data_len":223,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.213.212","src_port":41757,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00742{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":512,"source":"webex.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":6,"flow_first_seen":1444570640284,"flow_last_seen":1444570640404,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.213.212","src_port":41757,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":27,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":513,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":404731,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAgZAABAGFtByHdXUCggAAQG7ox2Q5KARbxtgL1AQ\/\/+4wAAA"}
 00408{"flow_id":28,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":514,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":404851,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoYQtAAEAGkW0KCAABch3MMcncAbvjbaL\/HJJdAlAQOQhi2wAA"}
 00495{"flow_id":28,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":515,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":404972,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnYQxAAEAGkS0KCAABch3MMcncAbvjbaL\/HJJdAlAYOQhAsgAAFgMBADoBAAA2AwGD780leUD\/zJ6TyDunDGCFeal9B+1RLC9bN3N7SvEEPAAABAA1AP8BAAAJACMAAAAPAAEB"}
-00731{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":515,"source":"webex.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":6,"flow_first_seen":1444570640298,"flow_last_seen":1444570640404,"flow_tot_l4_data_len":223,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.204.49","src_port":51676,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00741{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":515,"source":"webex.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":6,"flow_first_seen":1444570640298,"flow_last_seen":1444570640404,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.204.49","src_port":51676,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":28,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":516,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":405134,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAgdAABAGIHJyHcwxCggAAQG7ydwckl0C422jPlAQ\/\/+bpAAA"}
 00407{"flow_id":29,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":517,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":405337,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoS5BAAEAGO5EKCAABQERpYpETAbtLyIh6tDd3h1AQOQgwTQAA"}
 00494{"flow_id":29,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":518,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":405816,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnS5FAAEAGO1EKCAABQERpYpETAbtLyIh6tDd3h1AYOQiLjgAAFgMBADoBAAA2AwERAQnq4d\/gxiGfJU2bLkxxyvmp1+D227r48TmpdQ4WzgAABAA1AP8BAAAJACMAAAAPAAEB"}
-00730{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":518,"source":"webex.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":6,"flow_first_seen":1444570640310,"flow_last_seen":1444570640405,"flow_tot_l4_data_len":223,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.98","src_port":37139,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00740{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":518,"source":"webex.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":6,"flow_first_seen":1444570640310,"flow_last_seen":1444570640405,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.98","src_port":37139,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":29,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":519,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":406001,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAghAABAGtRlARGliCggAAQG7kRO0N3eHS8iIuVAQ\/\/9pFgAA"}
 00407{"flow_id":30,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":520,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":406122,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoc3dAAEAGE6UKCAABQERpZ6GyAbtpybCPljZPclAQOQgfqQAA"}
 00494{"flow_id":30,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":521,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":406243,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnc3hAAEAGE2UKCAABQERpZ6GyAbtpybCPljZPclAYOQg1JwAAFgMBADoBAAA2AwGYvNjE9n0n5PBRt0o9HyCmeZcSM\/CYZuDVHrLRWw9j1QAABAA1AP8BAAAJACMAAAAPAAEB"}
-00731{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":521,"source":"webex.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":6,"flow_first_seen":1444570640319,"flow_last_seen":1444570640406,"flow_tot_l4_data_len":223,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41394,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00741{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":521,"source":"webex.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":6,"flow_first_seen":1444570640319,"flow_last_seen":1444570640406,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41394,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":30,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":522,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":406408,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAglAABAGtRNARGlnCggAAQG7obKWNk9yacmwzlAQ\/\/9YcgAA"}
 00407{"flow_id":31,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":523,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":406529,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAotGpAAEAGXXcKCAABPm3geMe+AbssX3Bx06CPkFAQOQiEYgAA"}
 00493{"flow_id":31,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":524,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":406648,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABntGtAAEAGXTcKCAABPm3geMe+AbssX3Bx06CPkFAYOQhVUgAAFgMBADoBAAA2AwHChCdZOEMAlD5sXipmDRVVUN8O0TYEJmE+D4b2cbQgJQAABAA1AP8BAAAJACMAAAAPAAEB"}
-00732{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":524,"source":"webex.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":6,"flow_first_seen":1444570640330,"flow_last_seen":1444570640406,"flow_tot_l4_data_len":223,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51134,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00742{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":524,"source":"webex.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":6,"flow_first_seen":1444570640330,"flow_last_seen":1444570640406,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51134,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":31,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":525,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":406810,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAgpAABAGP9g+beB4CggAAQG7x77ToI+QLF9wsFAQ\/\/+9KwAA"}
 00408{"flow_id":32,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":526,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":406931,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo2ZVAAEAGOEwKCAABPm3geMe\/Abvolh2MF2nidVAQOQiEYQAA"}
 00495{"flow_id":32,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":527,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":407052,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABn2ZZAAEAGOAwKCAABPm3geMe\/Abvolh2MF2nidVAYOQhfdgAAFgMBADoBAAA2AwHVxA3qKVbS+aM2DodEgQ0ezLSejrbBA\/G4QcrR0TfK+wAABAA1AP8BAAAJACMAAAAPAAEB"}
-00732{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":527,"source":"webex.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":6,"flow_first_seen":1444570640338,"flow_last_seen":1444570640407,"flow_tot_l4_data_len":223,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51135,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00742{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":527,"source":"webex.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":6,"flow_first_seen":1444570640338,"flow_last_seen":1444570640407,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51135,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":32,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":528,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":407211,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAgtAABAGP9c+beB4CggAAQG7x78XaeJ16JYdy1AQ\/\/+9KgAA"}
 00407{"flow_id":33,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":529,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":407386,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAABAAEAGo40Khc4vUEpuRIKzAbsvtI0dAAAAAFAEAADXXQAA"}
 00408{"flow_id":26,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":530,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":407504,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAofMRAAEAGd1oKCAABch3Ki7gfAbudV793YqhAyVAQOQh1\/wAA"}
@@ -452,21 +452,21 @@
 00408{"flow_id":34,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":534,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":407983,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoO9lAAEAGNmAKCAABUEpuRILnAbv7u\/+EBEQAfVAQOQgpkQAA"}
 00407{"flow_id":35,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":535,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":408102,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAosmNAAEAGv9UKCAABUEpuRILoAbtZhnZApnmJwVAQOQgpkAAA"}
 00703{"flow_id":34,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":536,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":408223,"pkt_caplen":270,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":270,"pkt_l4_len":236,"pkt":"ABoRAAACABoRAAABCABFAAEAO9pAAEAGNYcKCAABUEpuRILnAbv7u\/+EBEQAfVAYOQjgzQAAFgMBANMBAADPAwFWGmYQaUf4c9qAoNyA\/Wv7T0CEUJYDhQEnkMlpU0A7GyBKAAAAOC7EJ2lJH7mDuj6DaIBXRCqOxY\/AVNJYEqB0IgBGAAQABQAvADXAAsAEwAXADMAOwA\/AB8AJwArAEcATwBQAMwA5ADIAOAAKwAPADcAIwBIAFgATAAkAFQASAAMACAAUABEA\/wEAAEAACwAEAwABAgAKADQAMgAOAA0AGQALAAwAGAAJAAoAFgAXAAgABgAHABQAFQAEAAUAEgATAAEAAgADAA8AEAAR"}
-00718{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":536,"source":"webex.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":4,"flow_first_seen":1444570640382,"flow_last_seen":1444570640408,"flow_tot_l4_data_len":316,"flow_min_l4_data_len":20,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":79,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33511,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00729{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":536,"source":"webex.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":4,"flow_first_seen":1444570640382,"flow_last_seen":1444570640408,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":216,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33511,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":34,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":537,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":408448,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAgxAABAGoC1QSm5ECggAAQG7gucERAB9+7wAXFAQ\/\/9hwQAA"}
 00702{"flow_id":35,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":538,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":408569,"pkt_caplen":270,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":270,"pkt_l4_len":236,"pkt":"ABoRAAACABoRAAABCABFAAEAsmRAAEAGvvwKCAABUEpuRILoAbtZhnZApnmJwVAYOQglNwAAFgMBANMBAADPAwFWGmYQn3y+Y635kayg0wLQlN\/9KaMadTF0LMgTLEN5tSBKAAAAOC7EJ2lJH7mDuj6DaIBXRCqOxY\/AVNJYEqB0IgBGAAQABQAvADXAAsAEwAXADMAOwA\/AB8AJwArAEcATwBQAMwA5ADIAOAAKwAPADcAIwBIAFgATAAkAFQASAAMACAAUABEA\/wEAAEAACwAEAwABAgAKADQAMgAOAA0AGQALAAwAGAAJAAoAFgAXAAgABgAHABQAFQAEAAUAEgATAAEAAgADAA8AEAAR"}
-00718{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":538,"source":"webex.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":4,"flow_first_seen":1444570640385,"flow_last_seen":1444570640408,"flow_tot_l4_data_len":316,"flow_min_l4_data_len":20,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":79,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33512,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00729{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":538,"source":"webex.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":4,"flow_first_seen":1444570640385,"flow_last_seen":1444570640408,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":216,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33512,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":35,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":539,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":408732,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAg1AABAGoCxQSm5ECggAAQG7guimeYnBWYZ3GFAQ\/\/9hwAAA"}
 00407{"flow_id":30,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":540,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":408854,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoc3lAAEAGE6MKCAABQERpZ6GyAbtpybDOljZPclAQOQgfagAA"}
 00407{"flow_id":31,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":541,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":408974,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAotGxAAEAGXXUKCAABPm3geMe+AbssX3Cw06CPkFAQOQiEIwAA"}
 00408{"flow_id":32,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":542,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":409094,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo2ZdAAEAGOEoKCAABPm3geMe\/Abvolh3LF2nidVAQOQiEIgAA"}
 05394{"flow_id":25,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":543,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":491206,"pkt_caplen":3751,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3751,"pkt_l4_len":3717,"pkt":"ABoRAAACABoRAAABCABFAA6ZAg5AABAGp+XYOtAoCggAAQG7qamX9G2BaAuTY1AY\/\/8D1wAAFgMDAEECAAA9AwNWGmYWXEGw9CJjvdcNuzSsMlp9Orc+irG3LDezhMQ32wDALwAAFQAAAAD\/AQABAAALAAQDAAECACMAABYDAwzLCwAMxwAMxAAFRjCCBUIwggQqoAMCAQICCHWz0GAVbUuOMA0GCSqGSIb3DQEBCwUAMEkxCzAJBgNVBAYTAlVTMRMwEQYDVQQKEwpHb29nbGUgSW5jMSUwIwYDVQQDExxHb29nbGUgSW50ZXJuZXQgQXV0aG9yaXR5IEcyMB4XDTE1MDkyOTE5MDAwN1oXDTE1MTIyODAwMDAwMFowcDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEzARBgNVBAoMCkdvb2dsZSBJbmMxHzAdBgNVBAMMFiouZ29vZ2xlLWFuYWx5dGljcy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC9BndDbJK8n7UlIX\/panjjh8hJC5iT0ZBb4n1fzKUGCslR7CuA61\/m5PuhHD7uChpG8m+dcIdjK+lCk4Ky\/GjTkY8xuesL9WBwMHS\/Hrat89knNWIA4R+pVzg3Mhs+X5UMRmpdBZOmr4NrSJF8Lrb62Mof9jRYV+TfZLSYQGtdCECWJyWPzvviaBYn0y\/StSRbgzKH\/OZ2PFi5kULxOFq6N2Z1rQMg1an9CA4b0071UiZ81PNNyOXn0hQAYgiG1taVb0pwcq6dkDzdkU8Mj5UQEwk7PxR0R9obitrIs4rbpf8WxzqsPYmwOc4u8iUoIs1JhHXQXOBS9Il8fv6siekJAgMBAAGjggIFMIICATAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwgdIGA1UdEQSByjCBx4IWKi5nb29nbGUtYW5hbHl0aWNzLmNvbYITYXBwLW1lYXN1cmVtZW50LmNvbYIUZ29vZ2xlLWFuYWx5dGljcy5jb22CFGdvb2dsZXRhZ21hbmFnZXIuY29tghJzZXJ2aWNlLnVyY2hpbi5jb22CGHNzbC5nb29nbGUtYW5hbHl0aWNzLmNvbYIKdXJjaGluLmNvbYIYd3d3Lmdvb2dsZS1hbmFseXRpY3MuY29tghh3d3cuZ29vZ2xldGFnbWFuYWdlci5jb20waAYIKwYBBQUHAQEEXDBaMCsGCCsGAQUFBzAChh9odHRwOi8vcGtpLmdvb2dsZS5jb20vR0lBRzIuY3J0MCsGCCsGAQUFBzABhh9odHRwOi8vY2xpZW50czEuZ29vZ2xlLmNvbS9vY3NwMB0GA1UdDgQWBBT7LQYFGFR41L0io4xkJ374xMN2JjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFErdBhYbvPZotXb1gba7Yhq6WoEvMCEGA1UdIAQaMBgwDAYKKwYBBAHWeQIFATAIBgZngQwBAgIwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3BraS5nb29nbGUuY29tL0dJQUcyLmNybDANBgkqhkiG9w0BAQsFAAOCAQEAQJSeiLmnd4PKpAfj7I3xzeXS1dNcG6fyiARh5Zoe0SUxjPFwo88NMrzmh0tyACdSvc8NJDQzX8TKtj83s8i19Ake7gtOnF9Tpu2Hzclzi3q+SiEfev2tJudnpEvRMWpVSKV2LXURdVH8U2o1372iylNiJCZT09KlUfkrxYU4N89A\/vnhmzqxQRy\/XRuLgKbUXvBKpr965AgdOBQ1UOjR9ssZes3Mwd1+y57S8qJ\/K66iFyIufxsa620sBJ9dGoqC9UrOLL1FUd4NViOrTCWlMXGetNRkwskmJgfCd79OPNFsbl8mrjHGjY4vuv2jRpRQ83MOifldMLRH4JGYvQWCiAAD9DCCA\/AwggLYoAMCAQICAwI6gzANBgkqhkiG9w0BAQsFADBCMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMSR2VvVHJ1c3QgR2xvYmFsIENBMB4XDTEzMDQwNTE1MTU1NloXDTE2MTIzMTIzNTk1OVowSTELMAkGA1UEBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRlcm5ldCBBdXRob3JpdHkgRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCcKgR3XNhQkToGo4Lg2FBIvIk\/8RlwGohGfuCPxfGJziHuWv5hDbcyRImgdAtTT1WkzoJile7rWV\/G4QWAEsRelD+8W0g49FP3JOb7kekVxM\/0Uw30SvyfVN59vqBrb4fA0FAfKDADQNoIc1Fsf\/86PKc3Bo69SxEE630k3ub5\/DFx+5TVYPMuSq9C0svqxGoassxT3RVLix\/IGWEfzZ2oPmMrhDVpZYTIGcVGIvhTlb7jgEoQxirsupcgEcc5mRAEoPBhepUljE5SdeK27QjKFPzOImqzTs9GA5eXA37Asd57r0Uzz7o+cbfe9CUlwg01iZ2d+w4ReYkeN8WvjnJpAgMBAAGjgecwgeQwHwYDVR0jBBgwFoAUwHqYaI2J+6sFZAwRfap9ZbjKzE4wHQYDVR0OBBYEFErdBhYbvPZotXb1gba7Yhq6WoEvMA4GA1UdDwEB\/wQEAwIBBjAuBggrBgEFBQcBAQQiMCAwHgYIKwYBBQUHMAGGEmh0dHA6Ly9nLnN5bWNkLmNvbTASBgNVHRMBAf8ECDAGAQH\/AgEAMDUGA1UdHwQuMCwwKqAooCaGJGh0dHA6Ly9nLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAXBgNVHSAEEDAOMAwGCisGAQQB1nkCBQEwDQYJKoZIhvcNAQELBQADggEBAKr6qSDNameD7V7Uft4dxH\/gJQYAxST7qcgtbX7enYJlLIFjNGY+6VLCCLTLL\/dfmTpqnFB6hQWMfdEqSITTCWx8ws01n\/OC7lLeaF\/kAIoXIJb3KY2aTcuo3obIDW9WhwN9Az\/c+nl9IRn5yDovUXaMx0GScY8lzjf4SkwAI+\/ENRCu4COAc3xNNC7IbpDWEB6ZhHMacPLtVQ7uFwbqZ+4y6yzdZwc\/9ovCcN5bAOa7G9M2GiJsbLA1QmyQCT2T6WQJIg6FBp\/CcyHT5l+A5I2FIjpzA7Fgjq5o4vQ+l+dgEgloNt461uJDlVs3gZKBH7uN161SZBZXltleNH7INdgAA4EwggN9MIIC5qADAgECAgMSu+YwDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0VxdWlmYXgxLTArBgNVBAsTJEVxdWlmYXggU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0wMjA1MjEwNDAwMDBaFw0xODA4MjEwNDAwMDBaMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDazBhjMP30FyMaVn5b3zxsOORxt3iR1Lyh2Ez4qEO2A+lNIQcIiNpYL2Y5Kb0FeIudOOgFt2p+caTmxGCmsO+A5IkoD54l1u2D862mkceYyUIYNRSdrZhGki5PyvGHQ8EWlVctUO+JLYB6V63y7l9r0gCNuRT4FBU12cBGo3tyyJG\/yVUrzdCXPpwmZMzfzoMZccpO5tTVe6kZzVXeyOzSXjhT5VxPjC3+UCM2\/Gbmy46kORkAt5UCOZELDv44LtEdBZr2TT5vDwcdrywej2A54vo2UxM51F4mK9s9qBS9MusYAyhSBHHlqzM94Ti7BzaEYpx56hYw9F\/AK+hxa+T5AgMBAAGjgfAwge0wHwYDVR0jBBgwFoAUSOZo+SvSspXXR9gjIBBPM5iQn9QwHQYDVR0OBBYEFMB6mGiNifurBWQMEX2qfWW4ysxOMA8GA1UdEwEB\/wQFMAMBAf8wDgYDVR0PAQH\/BAQDAgEGMDoGA1UdHwQzMDEwL6AtoCuGKWh0dHA6Ly9jcmwuZ2VvdHJ1c3QuY29tL2NybHMvc2VjdXJlY2EuY3JsME4GA1UdIARHMEUwQwYEVR0gADA7MDkGCCsGAQUFBwIBFi1odHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkwDQYJKoZIhvcNAQEFBQADgYEAduESbk5LFhKGMAaygQjP8AjHx3F+Zu7C7dQ7H\/\/w8MhO1kM4sLkwfRjQVYOiass2EZzoSGajbX+4E9RH\/otaXHP8rtkbMhk4q5c0FKqW0uujHBQISba75ZHvgzbrHVZvytq8c2OQ5H97PiLLPQftXzh0nOMDUE6hr5juYfKEPxIWAwMBTQwAAUkDABdBBIaKNVmPKL3TXXfhqMLDWuNGuVEzZureya0ML+MyYUl5oX8b7lGhet1wfigTSCer1FgnvtMkLDpU2KzVIU4FEgwGAQEACjO0VooNP1L6232eswqmLt\/1deu7q3pXGl44Jso6LvWSKYw1C7GnaJTLN+Vu2BAlYMazfva\/KG14DJLJcn63aooqWw6UnUr\/YLfSQIyKmPVbsvo\/vCtiw16J5eKpYkUTXOowdDWqJzfpnNc\/nvp9DYi3Z3Up8G5WJ3obs\/AcVqRCDkZXqmMTbIadu\/TDtG2L5fsDjNgV9vI9gn\/uWjFmo\/gPd1CkZpVRnqrWikJGDKE9Z+n+Me\/0lLxabZBRTPYb36gWdRsdNF\/8I+x2jBPiEVhOAa\/UtlAKTqDPo0etmhQuyNJSi39NvqO3zgYxYpnDMrLT5JVnPNqRwZH5dt0clhYDAwAEDgAAAA=="}
-01262{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":543,"source":"webex.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":6,"flow_first_seen":1444570638225,"flow_last_seen":1444570640491,"flow_tot_l4_data_len":4064,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3717,"flow_avg_l4_data_len":677,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"216.58.208.40","src_port":43433,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"ssl.google-analytics.com","server_names":"*.google-analytics.com,app-measurement.com,google-analytics.com,googletagmanager.com,service.urchin.com,ssl.google-analytics.com,urchin.com,www.google-analytics.com,www.googletagmanager.com","ja3":"75edb912bc6f0a222ae3e3e47f5c89b1","ja3s":"389ed42c02ebecc32e73aa31def07e14","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=Google Inc, CN=Google Internet Authority G2","issuerDN":"C=US, ST=California, L=Mountain View, O=Google Inc, CN=*.google-analytics.com","fingerprint":"E0:F0:1E:71:F2:B5:D9:2D:F7:4E:8F:CB:10:37:17:7C:0C:C4:07:9D"}}
+01273{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":543,"source":"webex.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":6,"flow_first_seen":1444570638225,"flow_last_seen":1444570640491,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3697,"flow_tot_l4_payload_len":3924,"flow_avg_l4_payload_len":654,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"216.58.208.40","src_port":43433,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"ssl.google-analytics.com","server_names":"*.google-analytics.com,app-measurement.com,google-analytics.com,googletagmanager.com,service.urchin.com,ssl.google-analytics.com,urchin.com,www.google-analytics.com,www.googletagmanager.com","ja3":"75edb912bc6f0a222ae3e3e47f5c89b1","ja3s":"389ed42c02ebecc32e73aa31def07e14","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=Google Inc, CN=Google Internet Authority G2","issuerDN":"C=US, ST=California, L=Mountain View, O=Google Inc, CN=*.google-analytics.com","fingerprint":"E0:F0:1E:71:F2:B5:D9:2D:F7:4E:8F:CB:10:37:17:7C:0C:C4:07:9D"}}
 00408{"flow_id":25,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":544,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":491530,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoUSBAAEAGN0QKCAAB2DrQKKmpAbtoC5Njl\/R78lAQSDX6eAAA"}
 00582{"flow_id":25,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":545,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":592124,"pkt_caplen":180,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":180,"pkt_l4_len":146,"pkt":"ABoRAAACABoRAAABCABFAACmUSFAAEAGNsUKCAAB2DrQKKmpAbtoC5Njl\/R78lAYSDUnbQAAFgMDAEYQAABCQQQARi2Sq6lomOqdBwTXeK+7\/VSCE644W9ePmSa9EWlwoNhBkPWiERqUZ6KGC\/aDzofvpP6QqC1qdhwZ214CYXZcFAMDAAEBFgMDACiMfFcaI1hpldHeUclqaHBcFUg1h+fECh+\/j1y52hpRJWkfYJdr7o0+"}
 00409{"flow_id":25,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":546,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":592914,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAg9AABAGtlXYOtAoCggAAQG7qamX9HvyaAuT4VAQ\/\/9CMAAA"}
 00589{"flow_id":35,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":547,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":593166,"pkt_caplen":183,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":183,"pkt_l4_len":149,"pkt":"ABoRAAACABoRAAABCABFAACpAhBAABAGn6hQSm5ECggAAQG7guimeYnBWYZ3GFAY\/\/\/TtAAAFgMBAFECAABNAwFWGmYw1S2SuQizrUA2AASo1\/xNI5gqSv2km0LL+94AiyBKAAAAOC7EJ2lJH7mDuj6DaIBXRCqOxY\/AVNJYEqB0IgAEAAAF\/wEAAQAUAwEAAQEWAwEAIAtAOY9Gt7feGYdDv\/ZQ6IBSs9DH9KrW9HIkjyflxg+V"}
-00759{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":547,"source":"webex.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":6,"flow_first_seen":1444570640385,"flow_last_seen":1444570640593,"flow_tot_l4_data_len":485,"flow_min_l4_data_len":20,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":80,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33512,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6dfe5eb347aa509fc445e5628d467a2b","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
+00770{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":547,"source":"webex.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":6,"flow_first_seen":1444570640385,"flow_last_seen":1444570640593,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":216,"flow_tot_l4_payload_len":345,"flow_avg_l4_payload_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33512,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6dfe5eb347aa509fc445e5628d467a2b","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
 00407{"flow_id":35,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":548,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":593288,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAosmVAAEAGv9MKCAABUEpuRILoAbtZhncYpnmKQlAQPLgkhwAA"}
 00467{"flow_id":35,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":549,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":643888,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":97,"pkt_l4_len":63,"pkt":"ABoRAAACABoRAAABCABFAABTsmZAAEAGv6cKCAABUEpuRILoAbtZhncYpnmKQlAYPLgwbgAAFAMBAAEBFgMBACB3tOPNrA1yIPhgJ2zXsFBvVf8GU6w+9JhDmg6WwOMMyw=="}
 00409{"flow_id":35,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":550,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570640,"pkt_ts_usec":644580,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAhFAABAGoChQSm5ECggAAQG7guimeYpCWYZ3Q1AQ\/\/9hFAAA"}
@@ -503,19 +503,19 @@
 01271{"flow_id":24,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":583,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570660,"pkt_ts_usec":729371,"pkt_caplen":698,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":698,"pkt_l4_len":664,"pkt":"ABoRAAACABoRAAABCABFAAKsAABAAEARgN0KCAABrBABS\/waE8QCmKnIUkVHSVNURVIgc2lwOjE3Mi4xNi4xLjc1O3RyYW5zcG9ydD1VRFAgU0lQLzIuMA0KVmlhOiBTSVAvMi4wL1VEUCAxMC4xMzMuMjA2LjQ3OjY0NTM4O2JyYW5jaD16OWhHNGJLLTUyNDI4Ny0xLS0tM2U0Njk4NjE4Y2ZiMmI3MztycG9ydA0KTWF4LUZvcndhcmRzOiA3MA0KQ29udGFjdDogPHNpcDo0NTE5MUAxMC4xMzMuMjA2LjQ3OjY0NTM4O3JpbnN0YW5jZT03YTQ2ZjFlMTI3MDJlN2ZiO3RyYW5zcG9ydD1VRFA+DQpUbzogPHNpcDo0NTE5MUAxNzIuMTYuMS43NTt0cmFuc3BvcnQ9VURQPg0KRnJvbTogPHNpcDo0NTE5MUAxNzIuMTYuMS43NTt0cmFuc3BvcnQ9VURQPjt0YWc9ZDM4MzM3NjcNCkNhbGwtSUQ6IEtvcExUdzl4c19sRXBDdGlQYTA3YlEuLg0KQ1NlcTogNCBSRUdJU1RFUg0KRXhwaXJlczogNjANCkFsbG93OiBJTlZJVEUsIEFDSywgQ0FOQ0VMLCBCWUUsIE5PVElGWSwgUkVGRVIsIE1FU1NBR0UsIE9QVElPTlMsIElORk8sIFNVQlNDUklCRQ0KU3VwcG9ydGVkOiByZXBsYWNlcywgbm9yZWZlcnN1YiwgZXh0ZW5kZWQtcmVmZXIsIHRpbWVyLCBvdXRib3VuZCwgcGF0aCwgWC1jaXNjby1zZXJ2aWNldXJpDQpVc2VyLUFnZW50OiBab2lwZXIgcjMzNjg4DQpBbGxvdy1FdmVudHM6IHByZXNlbmNlLCBrcG1sDQpDb250ZW50LUxlbmd0aDogMA0KDQo="}
 01272{"flow_id":24,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":584,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570664,"pkt_ts_usec":697173,"pkt_caplen":698,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":698,"pkt_l4_len":664,"pkt":"ABoRAAACABoRAAABCABFAAKsAABAAEARgN0KCAABrBABS\/waE8QCmKnIUkVHSVNURVIgc2lwOjE3Mi4xNi4xLjc1O3RyYW5zcG9ydD1VRFAgU0lQLzIuMA0KVmlhOiBTSVAvMi4wL1VEUCAxMC4xMzMuMjA2LjQ3OjY0NTM4O2JyYW5jaD16OWhHNGJLLTUyNDI4Ny0xLS0tM2U0Njk4NjE4Y2ZiMmI3MztycG9ydA0KTWF4LUZvcndhcmRzOiA3MA0KQ29udGFjdDogPHNpcDo0NTE5MUAxMC4xMzMuMjA2LjQ3OjY0NTM4O3JpbnN0YW5jZT03YTQ2ZjFlMTI3MDJlN2ZiO3RyYW5zcG9ydD1VRFA+DQpUbzogPHNpcDo0NTE5MUAxNzIuMTYuMS43NTt0cmFuc3BvcnQ9VURQPg0KRnJvbTogPHNpcDo0NTE5MUAxNzIuMTYuMS43NTt0cmFuc3BvcnQ9VURQPjt0YWc9ZDM4MzM3NjcNCkNhbGwtSUQ6IEtvcExUdzl4c19sRXBDdGlQYTA3YlEuLg0KQ1NlcTogNCBSRUdJU1RFUg0KRXhwaXJlczogNjANCkFsbG93OiBJTlZJVEUsIEFDSywgQ0FOQ0VMLCBCWUUsIE5PVElGWSwgUkVGRVIsIE1FU1NBR0UsIE9QVElPTlMsIElORk8sIFNVQlNDUklCRQ0KU3VwcG9ydGVkOiByZXBsYWNlcywgbm9yZWZlcnN1YiwgZXh0ZW5kZWQtcmVmZXIsIHRpbWVyLCBvdXRib3VuZCwgcGF0aCwgWC1jaXNjby1zZXJ2aWNldXJpDQpVc2VyLUFnZW50OiBab2lwZXIgcjMzNjg4DQpBbGxvdy1FdmVudHM6IHByZXNlbmNlLCBrcG1sDQpDb250ZW50LUxlbmd0aDogMA0KDQo="}
 01272{"flow_id":24,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":585,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570668,"pkt_ts_usec":729335,"pkt_caplen":698,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":698,"pkt_l4_len":664,"pkt":"ABoRAAACABoRAAABCABFAAKsAABAAEARgN0KCAABrBABS\/waE8QCmKnIUkVHSVNURVIgc2lwOjE3Mi4xNi4xLjc1O3RyYW5zcG9ydD1VRFAgU0lQLzIuMA0KVmlhOiBTSVAvMi4wL1VEUCAxMC4xMzMuMjA2LjQ3OjY0NTM4O2JyYW5jaD16OWhHNGJLLTUyNDI4Ny0xLS0tM2U0Njk4NjE4Y2ZiMmI3MztycG9ydA0KTWF4LUZvcndhcmRzOiA3MA0KQ29udGFjdDogPHNpcDo0NTE5MUAxMC4xMzMuMjA2LjQ3OjY0NTM4O3JpbnN0YW5jZT03YTQ2ZjFlMTI3MDJlN2ZiO3RyYW5zcG9ydD1VRFA+DQpUbzogPHNpcDo0NTE5MUAxNzIuMTYuMS43NTt0cmFuc3BvcnQ9VURQPg0KRnJvbTogPHNpcDo0NTE5MUAxNzIuMTYuMS43NTt0cmFuc3BvcnQ9VURQPjt0YWc9ZDM4MzM3NjcNCkNhbGwtSUQ6IEtvcExUdzl4c19sRXBDdGlQYTA3YlEuLg0KQ1NlcTogNCBSRUdJU1RFUg0KRXhwaXJlczogNjANCkFsbG93OiBJTlZJVEUsIEFDSywgQ0FOQ0VMLCBCWUUsIE5PVElGWSwgUkVGRVIsIE1FU1NBR0UsIE9QVElPTlMsIElORk8sIFNVQlNDUklCRQ0KU3VwcG9ydGVkOiByZXBsYWNlcywgbm9yZWZlcnN1YiwgZXh0ZW5kZWQtcmVmZXIsIHRpbWVyLCBvdXRib3VuZCwgcGF0aCwgWC1jaXNjby1zZXJ2aWNldXJpDQpVc2VyLUFnZW50OiBab2lwZXIgcjMzNjg4DQpBbGxvdy1FdmVudHM6IHByZXNlbmNlLCBrcG1sDQpDb250ZW50LUxlbmd0aDogMA0KDQo="}
-00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":586,"source":"webex.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1444570669736,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51154,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":586,"source":"webex.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1444570669736,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51154,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":36,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":586,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570669,"pkt_ts_usec":736143,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA80OhAAEAGQOUKCAABPm3geMfSAbvlsh8HAAAAAKACOQhHhwAAAgQFtAQCCAoATM\/vAAAAAAEDAwY="}
 00409{"flow_id":36,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":587,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570669,"pkt_ts_usec":745196,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAiJAABAGP8A+beB4CggAAQG7x9IaTeD45bIfCFAS\/\/+9VQAA"}
-00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":588,"source":"webex.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1444570669745,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51155,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":588,"source":"webex.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1444570669745,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51155,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":37,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":588,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570669,"pkt_ts_usec":745822,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8QwJAAEAGzssKCAABPm3geMfTAbvSW4ztAAAAAKACOQjs9gAAAgQFtAQCCAoATM\/vAAAAAAEDAwY="}
 00409{"flow_id":37,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":589,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570669,"pkt_ts_usec":760020,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAiNAABAGP78+beB4CggAAQG7x9MtpHMS0luM7lAS\/\/+9VAAA"}
 00407{"flow_id":36,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":590,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570669,"pkt_ts_usec":760287,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo0OlAAEAGQPgKCAABPm3geMfSAbvlsh8IGk3g+VAQOQiETgAA"}
 00493{"flow_id":36,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":591,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570669,"pkt_ts_usec":760654,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABn0OpAAEAGQLgKCAABPm3geMfSAbvlsh8IGk3g+VAYOQh66wAAFgMBADoBAAA2AwE1744IWto6M0QCtsjP9fOG23xHxlWSJd969XnKXp6XHQAABAA1AP8BAAAJACMAAAAPAAEB"}
-00732{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":591,"source":"webex.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":4,"flow_first_seen":1444570669736,"flow_last_seen":1444570669760,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51154,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00742{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":591,"source":"webex.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":4,"flow_first_seen":1444570669736,"flow_last_seen":1444570669760,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51154,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":36,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":592,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570669,"pkt_ts_usec":761708,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAiRAABAGP74+beB4CggAAQG7x9IaTeD55bIfR1AQ\/\/+9FwAA"}
 00407{"flow_id":37,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":593,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570669,"pkt_ts_usec":762448,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoQwNAAEAGzt4KCAABPm3geMfTAbvSW4zuLaRzE1AQOQiETQAA"}
 00494{"flow_id":37,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":594,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570669,"pkt_ts_usec":762590,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnQwRAAEAGzp4KCAABPm3geMfTAbvSW4zuLaRzE1AYOQhN4wAAFgMBADoBAAA2AwE4pMre7\/gDNHFUYUtdH4I+oIdCvO8Q22rK5cuvc6RHAwAABAA1AP8BAAAJACMAAAAPAAEB"}
-00732{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":594,"source":"webex.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":4,"flow_first_seen":1444570669745,"flow_last_seen":1444570669762,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51155,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00742{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":594,"source":"webex.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":4,"flow_first_seen":1444570669745,"flow_last_seen":1444570669762,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51155,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":37,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":595,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570669,"pkt_ts_usec":763196,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAiVAABAGP70+beB4CggAAQG7x9MtpHMT0luNLVAQ\/\/+9FgAA"}
 00407{"flow_id":31,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":596,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570670,"pkt_ts_usec":369848,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAotG1AAEAGXXQKCAABPm3geMe+AbssX3Cw06CPkFAROQiEIgAA"}
 00410{"flow_id":31,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":597,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570670,"pkt_ts_usec":370331,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAiZAABAGP7w+beB4CggAAQG7x77ToI+QLF9wsVAQ\/\/+9KgAA"}
@@ -524,12 +524,12 @@
 00410{"flow_id":32,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":600,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570670,"pkt_ts_usec":373698,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAihAABAGP7o+beB4CggAAQG7x78XaeJ16JYdzFAQ\/\/+9KQAA"}
 00410{"flow_id":32,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":601,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570670,"pkt_ts_usec":373944,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAilAABAGP7k+beB4CggAAQG7x78XaeJ16JYdzFAR\/\/+9KAAA"}
 05676{"flow_id":36,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":602,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570670,"pkt_ts_usec":676967,"pkt_caplen":3961,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3961,"pkt_l4_len":3927,"pkt":"ABoRAAACABoRAAABCABFAA9rAipAABAGMHU+beB4CggAAQG7x9IaTeD55bIfR1AY\/\/9VLwAAFgMBDz4CAAAtAwFWGmY08WBlVaMiuMkf\/1kPwYrznYnbZP8YRm1BkLyY7wAANQAABf8BAAEACwAPBQAPAgAE6TCCBOUwggPNoAMCAQICECl0ianUHkm+YfeBaUbmIfMwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDAeFw0xNTA0MTAwMDAwMDBaFw0xODA0MTAyMzU5NTlaMHcxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMREwDwYDVQQHDAhTYW4gSm9zZTEcMBoGA1UECgwTQ2lzY28gU3lzdGVtcywgSW5jLjEMMAoGA1UECwwDQ1NHMRQwEgYDVQQDDAsqLndlYmV4LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ14yGFLwwhhZyxegl+wYbyZZp5q4NComRXAz+k8ibNrPp+x46qW\/Dt++MdupJ8y605K5KTQVb24unmPF+pZq1par5YBKMjJrJTW2aAI1MtQvRzSDCNhdWyxiP6SkVBm6ZOcLwL+kijn\/nCot5orO1NrHHFG\/HBcSk1aaetoitrjs5BWuMxdYuIZvzSoyViVbo\/w\/LUKXdD0rlOcFmOxtcf+VKb7w1eyku07Jp94m\/\/ILLQS\/jy7ymRyfGFnPLtNqBmUKFg+uAD7JcHZiy8g6quVEhEZdm3O+tUR2wYZ5in9yKcrxqoHwhW0O4X2\/rJ4mNDvikIgaWiSNW7eIoh0NWECAwEAAaOCAWQwggFgMBYGA1UdEQQPMA2CCyoud2ViZXguY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH\/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYDVR0jBBgwFoAUX2DPYZBV34RDFIpgKrL1evRDGO8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Muc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAFNF1YB0fCkEyxRc1VQO7NUZao+PnZuavjgeTnyTKmHl\/4Zxh1Xg\/M\/f\/RHSrGrgUW2xaSZN\/Dwt2hqMtIi\/b\/AgOFeqNKmMxH3nWxf6f1Lr7QoTvApLQGqjeuIT3U6AiRMt4Ksgfx7+1Vbil1AaILo859VgXSMgVJTv4QpUpzg\/EKtUqPwMwq8PvwoTjlewyOt9YbCxNTO91JkKsYuwm7uUeU7Fx+r+rP+wgDwYVbbsUwQXAbj7QOj3dkPLzn+gcrhK1ZlgFf7Ti34xrqj7jNiaMc0dYh\/Ns3KCHMTs5rVCGLIk7lEgovwLDbJtuuQTlvaHoeZIGVPqROi5Bl\/WxAgAFPDCCBTgwggQgoAMCAQICEFE\/uXQ4cLc0QEGNMJMGmf8wDQYJKoZIhvcNAQELBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MB4XDTEzMTAzMTAwMDAwMFoXDTIzMTAzMDIzNTk1OVowfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLYBcocdC21F1Y5xUpSCZboS9gM8WifmkIoYsOlMFN+VRGCWwN6DS\/heQTJtJZ3GYEBlFn5vPd6mSeCLbeD3Vonf7IDepxTJelIH0ZPyJ0p+L55Vvb3\/dk6aNqLS4IzQRLDyDzM1pZ6hCEaIgQDJxeLHGhhkw8OUYAzHbS1zut+0GKs7rN7AXTvaTXrytU9qe6XmMqNqkQOJZlKFZakzm0CVB8qaibiBjpjSKy0TNF1k1D\/Ey\/W2uHGGPWfySVd8wA63iZNtCkJzQ89I28WSoEW+\/KDEMO41thVMj3xvQ+9jFKVShaXelIhY3UvFvnEZr71tQnY\/ycAzUR8b0s\/sPcCAwEAAaOCAWMwggFfMBIGA1UdEwEB\/wQIMAYBAf8CAQAwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNiLmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vczIuc3ltY2IuY29tMGsGA1UdIARkMGIwYAYKYIZIAYb4RQEHNjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMB8GA1UdIwQYMBaAFH\/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBCwUAA4IBAQBelFZJ3Y4tZfXBNlG2A+PannMZ8h9Zq1h+bCYFLPqB11wjFyIsN5P3huyF5rCj\/R\/iMqhFb+HZ+7mv0nCgMkJlv4T+FiqPP8Wm1qOTfUPpdCGRNSj0Y+ku7ff1XH9LmrUg6Qq94EUQDBSUml2l40uR6CSbRkBl9CJyzZn4iBH183\/mM4LmqMV+\/tAI4iVYCHFo5s2i5hTeTlIkLf3leRNT514vLU0bbUAVUiv3h4l4EoFu2U2qLXjUwiw9CF+HkZ4fDrDeMFJkhomqnWacDnYMgPJ02Cr4uDrO19YPEb5rqxT1vUGgImOJ8boPbyljZi0\/rIxyxfvH5NQP8jtPjCnHAATUMIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ\/XxrcgxiV0i6CqqpkKzj\/i5Vbext0uz\/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6\/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn\/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4\/VBEnkjWNHiDxpg8v+R70rfk\/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10\/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH\/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB\/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW\/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3\/DgAAAA=="}
-01112{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":602,"source":"webex.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":6,"flow_first_seen":1444570669736,"flow_last_seen":1444570670676,"flow_tot_l4_data_len":4110,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":685,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51154,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01123{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":602,"source":"webex.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":6,"flow_first_seen":1444570669736,"flow_last_seen":1444570670676,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":3970,"flow_avg_l4_payload_len":661,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51154,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00407{"flow_id":36,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":603,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570670,"pkt_ts_usec":678036,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo0OtAAEAGQPYKCAABPm3geMfSAbvlsh9HGk3wPFAQTE9hhQAA"}
 00851{"flow_id":36,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":604,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570670,"pkt_ts_usec":728746,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFu0OxAAEAGP68KCAABPm3geMfSAbvlsh9HGk3wPFAYTE+3ZwAAFgMBAQYQAAECAQBcqxtsDTGlipY3CqYvMhYWSR\/8XHHZXEFgKc28Jn+a29M9CnV4bkbE4IMmcB7kQnQHLnsYeOID0oEkbJng69hDFpcijtob8vZi11lJgHyFoDw0mbA\/HPJJ8lx55Bf9SDGt2koX\/heYW5uOytG1uc8PLJo3xUiuujXgCH3djGHUIooxWzxLGe2mFwiaYj6IWa3U+jlNoz3PWvB1g5BwrlViXx9njdhK0Q3aM1CJPxDVCxEafUC4KSpHqwcstTUtOAA8Gi050jeZwIPKWigkS3Em0NBV0ENN6mTmH8ETG4QO3xwLEaxtxz8Ch\/KjfKvst2ZHdf3QDHdrItKtoIOqOwwHFAMBAAEBFgMBADAaALQ2pUk5ebL0fOsBMmvnDjpE9bl5GxXpter9Zsd9\/1uEjoQZJQkgxUVbBb+uhKg="}
 00409{"flow_id":36,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":605,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570670,"pkt_ts_usec":729666,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAitAABAGP7c+beB4CggAAQG7x9IaTfA85bIgjVAQ\/\/+sjgAA"}
 05677{"flow_id":37,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":606,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570670,"pkt_ts_usec":730016,"pkt_caplen":3961,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3961,"pkt_l4_len":3927,"pkt":"ABoRAAACABoRAAABCABFAA9rAixAABAGMHM+beB4CggAAQG7x9MtpHMT0luNLVAY\/\/\/JRgAAFgMBDz4CAAAtAwFWGmYzMITHz8pj+nvXObs\/kOYhDg2UDp0EdJOkGpmV8AAANQAABf8BAAEACwAPBQAPAgAE6TCCBOUwggPNoAMCAQICECl0ianUHkm+YfeBaUbmIfMwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDAeFw0xNTA0MTAwMDAwMDBaFw0xODA0MTAyMzU5NTlaMHcxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMREwDwYDVQQHDAhTYW4gSm9zZTEcMBoGA1UECgwTQ2lzY28gU3lzdGVtcywgSW5jLjEMMAoGA1UECwwDQ1NHMRQwEgYDVQQDDAsqLndlYmV4LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ14yGFLwwhhZyxegl+wYbyZZp5q4NComRXAz+k8ibNrPp+x46qW\/Dt++MdupJ8y605K5KTQVb24unmPF+pZq1par5YBKMjJrJTW2aAI1MtQvRzSDCNhdWyxiP6SkVBm6ZOcLwL+kijn\/nCot5orO1NrHHFG\/HBcSk1aaetoitrjs5BWuMxdYuIZvzSoyViVbo\/w\/LUKXdD0rlOcFmOxtcf+VKb7w1eyku07Jp94m\/\/ILLQS\/jy7ymRyfGFnPLtNqBmUKFg+uAD7JcHZiy8g6quVEhEZdm3O+tUR2wYZ5in9yKcrxqoHwhW0O4X2\/rJ4mNDvikIgaWiSNW7eIoh0NWECAwEAAaOCAWQwggFgMBYGA1UdEQQPMA2CCyoud2ViZXguY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH\/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYDVR0jBBgwFoAUX2DPYZBV34RDFIpgKrL1evRDGO8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Muc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAFNF1YB0fCkEyxRc1VQO7NUZao+PnZuavjgeTnyTKmHl\/4Zxh1Xg\/M\/f\/RHSrGrgUW2xaSZN\/Dwt2hqMtIi\/b\/AgOFeqNKmMxH3nWxf6f1Lr7QoTvApLQGqjeuIT3U6AiRMt4Ksgfx7+1Vbil1AaILo859VgXSMgVJTv4QpUpzg\/EKtUqPwMwq8PvwoTjlewyOt9YbCxNTO91JkKsYuwm7uUeU7Fx+r+rP+wgDwYVbbsUwQXAbj7QOj3dkPLzn+gcrhK1ZlgFf7Ti34xrqj7jNiaMc0dYh\/Ns3KCHMTs5rVCGLIk7lEgovwLDbJtuuQTlvaHoeZIGVPqROi5Bl\/WxAgAFPDCCBTgwggQgoAMCAQICEFE\/uXQ4cLc0QEGNMJMGmf8wDQYJKoZIhvcNAQELBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MB4XDTEzMTAzMTAwMDAwMFoXDTIzMTAzMDIzNTk1OVowfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLYBcocdC21F1Y5xUpSCZboS9gM8WifmkIoYsOlMFN+VRGCWwN6DS\/heQTJtJZ3GYEBlFn5vPd6mSeCLbeD3Vonf7IDepxTJelIH0ZPyJ0p+L55Vvb3\/dk6aNqLS4IzQRLDyDzM1pZ6hCEaIgQDJxeLHGhhkw8OUYAzHbS1zut+0GKs7rN7AXTvaTXrytU9qe6XmMqNqkQOJZlKFZakzm0CVB8qaibiBjpjSKy0TNF1k1D\/Ey\/W2uHGGPWfySVd8wA63iZNtCkJzQ89I28WSoEW+\/KDEMO41thVMj3xvQ+9jFKVShaXelIhY3UvFvnEZr71tQnY\/ycAzUR8b0s\/sPcCAwEAAaOCAWMwggFfMBIGA1UdEwEB\/wQIMAYBAf8CAQAwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNiLmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vczIuc3ltY2IuY29tMGsGA1UdIARkMGIwYAYKYIZIAYb4RQEHNjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMB8GA1UdIwQYMBaAFH\/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBCwUAA4IBAQBelFZJ3Y4tZfXBNlG2A+PannMZ8h9Zq1h+bCYFLPqB11wjFyIsN5P3huyF5rCj\/R\/iMqhFb+HZ+7mv0nCgMkJlv4T+FiqPP8Wm1qOTfUPpdCGRNSj0Y+ku7ff1XH9LmrUg6Qq94EUQDBSUml2l40uR6CSbRkBl9CJyzZn4iBH183\/mM4LmqMV+\/tAI4iVYCHFo5s2i5hTeTlIkLf3leRNT514vLU0bbUAVUiv3h4l4EoFu2U2qLXjUwiw9CF+HkZ4fDrDeMFJkhomqnWacDnYMgPJ02Cr4uDrO19YPEb5rqxT1vUGgImOJ8boPbyljZi0\/rIxyxfvH5NQP8jtPjCnHAATUMIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ\/XxrcgxiV0i6CqqpkKzj\/i5Vbext0uz\/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6\/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn\/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4\/VBEnkjWNHiDxpg8v+R70rfk\/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10\/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH\/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB\/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW\/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3\/DgAAAA=="}
-01112{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":606,"source":"webex.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":6,"flow_first_seen":1444570669745,"flow_last_seen":1444570670730,"flow_tot_l4_data_len":4110,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":685,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51155,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01123{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":606,"source":"webex.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":6,"flow_first_seen":1444570669745,"flow_last_seen":1444570670730,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":3970,"flow_avg_l4_payload_len":661,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51155,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00407{"flow_id":37,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":607,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570670,"pkt_ts_usec":730757,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoQwVAAEAGztwKCAABPm3geMfTAbvSW40tLaSCVlAQTE9hhAAA"}
 00858{"flow_id":37,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":608,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570670,"pkt_ts_usec":781382,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFuQwZAAEAGzZUKCAABPm3geMfTAbvSW40tLaSCVlAYTE+2\/AAAFgMBAQYQAAECAQCWt0bEGBDiaW3wkbA3O9F3Ig4uidDxRApMSk8+hNZu3nn\/2GHToLO1hDLhQlAUkWRhyw0t1zVFXdxxdkjFz+5r0lkpZkHUszIurP+R8\/miZN4KjtkgXpMas\/So\/iPlXIMc\/yjT4WQBt4gtBtYhmFSppzsDmDIIk7mvfZxHXTD23VSjluF2QBfO2IWqMrFMUF5kLARyx4G2\/8ZjdNECapgOq9cdJsgD5BlcY2c+dHng19\/mYZA2BSxtQAyOT54Ghdr77MsgQiN2Llu3v+LZWpM+Zbvdg4hXwk\/BShSPoskiySh9VLMF\/nq+MGssfcSvrol76Im5W9PG\/DQIxfUY9d4FFAMBAAEBFgMBADBxLGEx28Qy59TtwMgeCKhDXvKFs7ZrkHvDe4Wu\/kgdVZQLIXwlg8iFIVwJQqhI6Xs="}
 00409{"flow_id":37,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":609,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570670,"pkt_ts_usec":782112,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAi1AABAGP7U+beB4CggAAQG7x9MtpIJW0luOc1AQ\/\/+sjQAA"}
@@ -545,15 +545,15 @@
 00707{"flow_id":37,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":620,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570671,"pkt_ts_usec":150838,"pkt_caplen":272,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":272,"pkt_l4_len":238,"pkt":"ABoRAAACABoRAAABCABFAAECAjRAABAGPtQ+beB4CggAAQG7x9MtpIKR0luQTVAY\/\/\/rJAAAFwMBAKCEUhgKS7Ore4V4XA8IdFUR4Er1pvl9N7NYzUrhqEqujMkCBt+R8+2ApxunQLbKtNBJ8frcD2IKNtRomHDisv5N1FfXTiIF2dw6IwJazu6xz8Sd9iJy3puaVNpZiGX3bSd4UxrqDoDAiYTuOjZvvQvkxFi3mKSaoKyOk3zR\/ULK5zXQWWH0E74qa1ipQXdhN7aYZwSSWvuhhYGExQr7m8GaFwMBADA1J1QYl7kQR0+Pa+4n7lamQYXLA+LfemMg8fQ6Z4hBckTkoKi+8YFeNtjNLDUxh78="}
 00408{"flow_id":37,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":621,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570671,"pkt_ts_usec":202137,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoQwhAAEAGztkKCAABPm3geMfTAbvSW5BNLaSDa1AQatU+yQAA"}
 01735{"flow_id":37,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":622,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570671,"pkt_ts_usec":657240,"pkt_caplen":1024,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1024,"pkt_l4_len":990,"pkt":"ABoRAAACABoRAAABCABFAAPyAjVAABAGO+M+beB4CggAAQG7x9MtpINr0luQTVAY\/\/+gngAAFwMBA4B4LQc11sgj5iAjgSB3smLHk7\/SenRjb8ZFufK1knTFHzViNUQ\/iWw\/BOftoBW9nu2wpcFh2HwgU90pvkNcoN3JCbeXg7zpP1ezlsV6QElTGlBhpUkmV46hyOlVhhnaJx1KI0dq7t9l2OweDBGK0PQn5LHPHqu3x3JwyzvWZe6xh\/rGhX21y1g9t7yynI49ZQ1uUFo+qHPBLxoGdUow0Nj+lk0BQmVemJO5h7c0sShigdmTKTicVuZqbHk\/pE38q1MzwYlWJWSLv2xA2GgCJqiuRlsay4my3w7o9Vi1Ji5WFF9W8QkwiGSI5ggoIDDBZWH3NmaA+lF8t3eiBjypw\/rWIh9A2GBa3astQstJfJ08\/f53WRAGsSNqvaLmfLY8ybTwelhl+r\/IsAm\/v+U9SALE6vcYTZzwtM7rC0Y4D6OKd5A2YZrYZr5N+9ozCULr\/LwYAYAzJil4Lo2Cf7apInyitpc\/u55LLzZ+QHjotatTnTmeP+cEBxnKpPddLlPdVCvBesENj6jodLYSANMsJbl8Ph9BrHzMFj4hWAUgN9EqjGPvfT3Ev+JIBaoKqTIsS4Jdxtn1gw4zM5eITulccgYHizb7hA1c+re\/xWy3E2bQxzCqjtlptwHqBhwzh7BEAmwlvt6\/QPrJoU3B4ajbDa\/JBst1RbCrRoJRTmMwBmupRBWsPxCdvz\/ONIep8rncQophQvNN00cswoHha82TMfvBV9GWfAU4JOqknc7fIUig\/Fq9FzM5SR3AIldNixb6m6k2BJgbP7Pdm3XQ4rykU\/h3IUpB9cU2BiQB2JGXhl8vAT2MALS8szaGnalxePhZ\/bkp0IVj3CB8leJca9JvvjCdvmJEhQQ8JNLfy62IYtvdHh\/WvnJCUwTiJB+3rdbOgNDbnIS6FrKbcF5eLcmQYyfDnGpnmjiopAp5z+p+nganqLY6s2IodIyKWKoxKXHcUIGTrSy1e1bInxGzE0NHM7L5ZVjjKw4KM00glRLxFzT1YXy9uo0vKe\/nyD3jl4ArmoCsPvapZZ1+b4t13d2fXbhrcNpDAY94KdF\/pnb5WAkfCD3uJkZNtnnwz2iPpqszCJeS7SCcEyTkm6h8bhd95c1TdZd53H96TlF53rKj9WkZ3aJQmix4oXCwZwJkfRd\/Y7hdGD+ihyVfdmDmYW3M4SNv8CCf+KYV74TZla\/OWJ0vmxcDAQBA7bK+SOd8Bp2bc2MJqkBhbTMVnwLf1cGaM\/0unjO3v+yruYCgeAeC00Ow3WKSsgss2LTGvZ1dgWooudhb7lqK0g=="}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":632,"source":"webex.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1444570672215,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41419,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":632,"source":"webex.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1444570672215,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41419,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":38,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":632,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570672,"pkt_ts_usec":215106,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8MYhAAEAGVYAKCAABQERpZ6HLAbsAQeF1AAAAAKACOQgEvgAAAgQFtAQCCAoATND9AAAAAAEDAwY="}
 00410{"flow_id":38,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":633,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570672,"pkt_ts_usec":219041,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAjpAABAGtOJARGlnCggAAQG7ocv\/vh6KAEHhdlAS\/\/9YlwAA"}
 00408{"flow_id":38,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":634,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570672,"pkt_ts_usec":219386,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoMYlAAEAGVZMKCAABQERpZ6HLAbsAQeF2\/74ei1AQOQgfkAAA"}
 00494{"flow_id":38,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":635,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570672,"pkt_ts_usec":269788,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnMYpAAEAGVVMKCAABQERpZ6HLAbsAQeF2\/74ei1AYOQieegAAFgMBADoBAAA2AwGjqRN4oMmUAvXJWDJ5WPEL71jxOoo9r1VB6+4PEHNUEQAABAA1AP8BAAAJACMAAAAPAAEB"}
-00731{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":635,"source":"webex.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":4,"flow_first_seen":1444570672215,"flow_last_seen":1444570672269,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41419,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00741{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":635,"source":"webex.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":4,"flow_first_seen":1444570672215,"flow_last_seen":1444570672269,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41419,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00410{"flow_id":38,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":636,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570672,"pkt_ts_usec":270226,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAjtAABAGtOFARGlnCggAAQG7ocv\/vh6LAEHhtVAQ\/\/9YWQAA"}
 05712{"flow_id":38,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":643,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570672,"pkt_ts_usec":626514,"pkt_caplen":3993,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3993,"pkt_l4_len":3959,"pkt":"ABoRAAACABoRAAABCABFAA+LAj9AABAGpXpARGlnCggAAQG7ocv\/vh6LAEHhtVAY\/\/\/4awAAFgMBD14CAABNAwFWGmY2OKSnMLhuCBt0JAb2DEjvPN+R95L+HKgtL7uTUiDN0VOJNIBlLSS4f88OqxP3+igjtpCbQoGsmGl2RmZTSAA1AAAF\/wEAAQALAA8FAA8CAATpMIIE5TCCA82gAwIBAgIQKXSJqdQeSb5h94FpRuYh8zANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MB4XDTE1MDQxMDAwMDAwMFoXDTE4MDQxMDIzNTk1OVowdzELMAkGA1UEBhMCdXMxEzARBgNVBAgMCkNhbGlmb3JuaWExETAPBgNVBAcMCFNhbiBKb3NlMRwwGgYDVQQKDBNDaXNjbyBTeXN0ZW1zLCBJbmMuMQwwCgYDVQQLDANDU0cxFDASBgNVBAMMCyoud2ViZXguY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnXjIYUvDCGFnLF6CX7BhvJlmnmrg0KiZFcDP6TyJs2s+n7Hjqpb8O374x26knzLrTkrkpNBVvbi6eY8X6lmrWlqvlgEoyMmslNbZoAjUy1C9HNIMI2F1bLGI\/pKRUGbpk5wvAv6SKOf+cKi3mis7U2sccUb8cFxKTVpp62iK2uOzkFa4zF1i4hm\/NKjJWJVuj\/D8tQpd0PSuU5wWY7G1x\/5UpvvDV7KS7Tsmn3ib\/8gstBL+PLvKZHJ8YWc8u02oGZQoWD64APslwdmLLyDqq5USERl2bc761RHbBhnmKf3IpyvGqgfCFbQ7hfb+sniY0O+KQiBpaJI1bt4iiHQ1YQIDAQABo4IBZDCCAWAwFgYDVR0RBA8wDYILKi53ZWJleC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGUGA1UdIAReMFwwWgYKYIZIAYb4RQEHNjBMMCMGCCsGAQUFBwIBFhdodHRwczovL2Quc3ltY2IuY29tL2NwczAlBggrBgEFBQcCAjAZGhdodHRwczovL2Quc3ltY2IuY29tL3JwYTAfBgNVHSMEGDAWgBRfYM9hkFXfhEMUimAqsvV69EMY7zArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNybDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zcy5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9zcy5zeW1jYi5jb20vc3MuY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAU0XVgHR8KQTLFFzVVA7s1Rlqj4+dm5q+OB5OfJMqYeX\/hnGHVeD8z9\/9EdKsauBRbbFpJk38PC3aGoy0iL9v8CA4V6o0qYzEfedbF\/p\/UuvtChO8CktAaqN64hPdToCJEy3gqyB\/Hv7VVuKXUBogujzn1WBdIyBUlO\/hClSnOD8Qq1So\/AzCrw+\/ChOOV7DI631hsLE1M73UmQqxi7Cbu5R5TsXH6v6s\/7CAPBhVtuxTBBcBuPtA6Pd2Q8vOf6ByuErVmWAV\/tOLfjGuqPuM2JoxzR1iH82zcoIcxOzmtUIYsiTuUSCi\/AsNsm265BOW9oeh5kgZU+pE6LkGX9bECAAU8MIIFODCCBCCgAwIBAgIQUT+5dDhwtzRAQY0wkwaZ\/zANBgkqhkiG9w0BAQsFADCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwHhcNMTMxMDMxMDAwMDAwWhcNMjMxMDMwMjM1OTU5WjB+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAstgFyhx0LbUXVjnFSlIJluhL2AzxaJ+aQihiw6UwU35VEYJbA3oNL+F5BMm0lncZgQGUWfm893qZJ4Itt4PdWid\/sgN6nFMl6UgfRk\/InSn4vnlW9vf92Tpo2otLgjNBEsPIPMzWlnqEIRoiBAMnF4scaGGTDw5RgDMdtLXO637QYqzus3sBdO9pNevK1T2p7peYyo2qRA4lmUoVlqTObQJUHypqJuIGOmNIrLRM0XWTUP8TL9ba4cYY9Z\/JJV3zADreJk20KQnNDz0jbxZKgRb78oMQw7jW2FUyPfG9D72MUpVKFpd6UiFjdS8W+cRmvvW1Cdj\/JwDNRHxvSz+w9wIDAQABo4IBYzCCAV8wEgYDVR0TAQH\/BAgwBgEB\/wIBADAwBgNVHR8EKTAnMCWgI6Ahhh9odHRwOi8vczEuc3ltY2IuY29tL3BjYTMtZzUuY3JsMA4GA1UdDwEB\/wQEAwIBBjAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zMi5zeW1jYi5jb20wawYDVR0gBGQwYjBgBgpghkgBhvhFAQc2MFIwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vY3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vcnBhMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFTeW1hbnRlY1BLSS0xLTUzNDAdBgNVHQ4EFgQUX2DPYZBV34RDFIpgKrL1evRDGO8wHwYDVR0jBBgwFoAUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwDQYJKoZIhvcNAQELBQADggEBAF6UVkndji1l9cE2UbYD49qecxnyH1mrWH5sJgUs+oHXXCMXIiw3k\/eG7IXmsKP9H+IyqEVv4dn7ua\/ScKAyQmW\/hP4WKo8\/xabWo5N9Q+l0IZE1KPRj6S7t9\/Vcf0uatSDpCr3gRRAMFJSaXaXjS5HoJJtGQGX0InLNmfiIEfXzf+YzguaoxX7+0AjiJVgIcWjmzaLmFN5OUiQt\/eV5E1PnXi8tTRttQBVSK\/eHiXgSgW7ZTaoteNTCLD0IX4eRnh8OsN4wUmSGiaqdZpwOdgyA8nTYKvi4Os7X1g8RvmurFPW9QaAiY4nxug9vKWNmLT+sjHLF+8fk1A\/yO0+MKccABNQwggTQMIIEOaADAgECAhAlDOjgMGEunyuJ9wVNfPj9MA0GCSqGSIb3DQEBBQUAMF8xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjExMDgwMDAwMDBaFw0yMTExMDcyMzU5NTlaMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA2IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8kCAgpejWeYAyq50s7Ttx8vDxFHLsr4P4pAvlXCKNkhRUn9fGtyDGJXSLoKqqmQrOP+LlVt7G3S7P+j34HV+zvQ9tmYhVhz2ANpNje+ODDYgg9VBPrScpZVIUm5SuPG5\/r9aGRwjNJ2ENjalJL0o\/ocFFN0Ylpe8dw9rPcEnTbe11LVtOWvxV3obD0oiXyrxySZxjl9AYE75C55ADk3Tq1Gf8CuvQ87uCL6zeL7PTXrPL28D2v3XWRMxkdHEDLdCQZIZPZFP6sKlLHj9UESeSNY0eIPGmDy\/5HvSt+T8WVrg6d1NFDwGdz4xQIfuU\/n3O4MwrPXT80h5aK7lPoJRUCAwEAAaOCAZswggGXMA8GA1UdEwEB\/wQFMAMBAf8wMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMy5jcmwwDgYDVR0PAQH\/BAQDAgEGMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vY3BzMB0GA1UdDgQWBBR\/02Wnwt3su\/AwCfNDOfoCrzMxMzBtBggrBgEFBQcBDARhMF+hXaBbMFkwVzBVFglpbWFnZS9naWYwITAfMAcGBSsOAwIaBBSP5dMahqyNjmvDz4Bq1EgYLHsZLjAlFiNodHRwOi8vbG9nby52ZXJpc2lnbi5jb20vdnNsb2dvLmdpZjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTA+BgNVHSUENzA1BggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBglghkgBhvhCBAEGCmCGSAGG+EUBCAEwDQYJKoZIhvcNAQEFBQADgYEAEwLd+OiGAPJa+PggDFmIYgfOzvdO+btZoZjl4TjdTrxmGNOt6xjyDcltPkqUIMM8ur1lVMavRLMQrSxrPqvXB7a4gWPF+V4u5Spnzs0zDCrXiVYDIx+zvug6CFm07EU194pb\/2bPUK\/GbVeNGXi3uaLRV+ofmkuvusmOEn7Gvf8OAAAA"}
-01111{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":643,"source":"webex.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":6,"flow_first_seen":1444570672215,"flow_last_seen":1444570672626,"flow_tot_l4_data_len":4142,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3959,"flow_avg_l4_data_len":690,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41419,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01122{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":643,"source":"webex.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":6,"flow_first_seen":1444570672215,"flow_last_seen":1444570672626,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3939,"flow_tot_l4_payload_len":4002,"flow_avg_l4_payload_len":667,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41419,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00409{"flow_id":38,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":644,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570672,"pkt_ts_usec":627470,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoMYtAAEAGVZEKCAABQERpZ6HLAbsAQeG1\/74t7lAQTO\/8BgAA"}
 00851{"flow_id":38,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":645,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570672,"pkt_ts_usec":678256,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFuMYxAAEAGVEoKCAABQERpZ6HLAbsAQeG1\/74t7lAYTO+atwAAFgMBAQYQAAECAQAuppU4ElPOMVNipeJaWtYwd\/pvWAtwO7pVTcwUuBj0JDxY6VnwQzztScdjLr8Pcj8u3vy6LVQ7m48dDphYxGEqcu1rKhix8wpyxf8hqqzr4ft8X2BnR6SvAXq0uv6MX5HQ7oD5GSdsggxLFSZHneq9DKcQgX7+0nhFxKzwVtVldpjLXq79j\/rlFiYG81tL9wnO473pAKuLlL3yKl8wMiRrEmsrw68MWwi3GZ+GT3VPpSn40JTjfnZIjmlrzilGE91ULr\/9YU92jzBIBKS+GmFJZMGK71hcaw3F6KJaWBf1gxX8k+\/DfohrkTinc38RSeL4CG507sR24h+ewz7oE4uyFAMBAAEBFgMBADC4olNnPx+6lJkGqx6oK+EiWjHYmGYPffVkRkiK0WyPT8N+5YzjoItdJvrDQJeo9zE="}
 00410{"flow_id":38,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":646,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570672,"pkt_ts_usec":679144,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAkBAABAGtNxARGlnCggAAQG7ocv\/vi3uAEHi+1AQ\/\/9HsAAA"}
@@ -562,15 +562,15 @@
 00411{"flow_id":38,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":659,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570672,"pkt_ts_usec":943507,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAkdAABAGtNVARGlnCggAAQG7ocv\/vi4pAEHlBVAQ\/\/9FawAA"}
 03874{"flow_id":38,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":660,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570673,"pkt_ts_usec":246494,"pkt_caplen":2608,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2608,"pkt_l4_len":2574,"pkt":"ABoRAAACABoRAAABCABFAAoiAkhAABAGqtpARGlnCggAAQG7ocv\/vi4pAEHlBVAY\/\/\/XVwAAFwMBCdBxLLWSPEcVTPk19a6RQSj\/HYO13nqarKLu4pl+tnPrre2wPJIRBzaFPuCZR4nIVzVt5TgLzsUv4LDQFurGviI+25Sp4kPOj8WFqS4ctOKFW\/a\/c7HRcHubuPd8PgX4kQ5PwrFXHw1+ELd4KWdXwJuHECA8USn7TQSdk+zsnZGABbL0TklMSnEDkhf5fI4dGCYqiJJa3a8f7TLBhsJO16gnqb0vreOrQCMdXy3ZW+A2kYdg+F0r\/pkGWR8rmaOk660cRikdWW+bMqYisJqG9blxC3OO0DOIlJH\/SF1+pArnMi4yt0yQCEswGNiPvwMyMDYkeV3e\/a3+nF4v3mSWBTZZcQtEkcZ3fuLnmB+Oa87Zy35Rb792AZ7zfZKhwcbUJfxNk0M30v5SnhKor\/QMBN+3461ebWJFlABREdcWXp3uhJs0cj6SU+rxjRHKRGu1vyQbz7WmxJf20XJ618iszXhYhP8PM0vhTizUHHmyWIwZUzL13fRRYeU8uKecwjxsYu+PhwwbXYZKbz42ZGCVm5VoHEd\/6KGLL8MmRPLo1sSKugMNc3aX5pmkcDl0Keryiphq6jrc5HNpB9ksfAv+387vXz0cPxgry+shHAzJyVkFtB\/3CIQ69oOpS\/o2gzSyduBgf4wXr9mvD0B4gi0xu2hj2M8nmsSyS5ZF8NpVcT8Bs8GF2hQD9A1QmQ5hVsqev1h5b8x1I\/0VSazTpLSwWA5n9ImKNrB28ZWiYFtJoKcRBidm3YKdX59A5CGziIgMIUivq2vEaxvMojJ\/Q+uKu0gGLPC+odug2TFrzpmJIEDIvKwjczNJ+qzMCAJGzPzXP+Iutfd7KHi6jzIwOUSFk1RthpSgLUhNAm4MqwX0ux3upofh91y1pDof5xDFfwQrXMaWYISh12sxcquzh201cUFjVc5RJH+D9OLmrU8szFmDpNFSQvlUHEWnie4Sz1eskdMXnrtLc\/sAyBEgLG0Hbp0BRoOKD5ChN5yIT0j+kQJDj8dRk4FyBbyx3bhh8tOozGT0icyAvbpHdJpc93mD4l\/Fh9Byz2cyotXvuL3UKHYuzVrF\/Px8ZCFz+04bU0cl9+t2SzSD7qP6U1sQG+mzG7bpH3TwcrdQDCQq1eTexNP4Nz+CySuHIHVdKWpmbIvWlQYl7+tjJoOZ1COZF3mEaRVy3g351VmsNdg4z0EfD7KxIyidbgJEUTTVY\/VXriJ01zyMiBBAbEGSDERkCW0oki8KPVvatcrO2WVVw7CIbC2A9FxL7j1h1NmPMiyLBsXZEAaQNmajnRGpm2A9T\/T7oyQFne9VuFfvrux07UlC6xt84ucd27tP+EG7YmDrd0XZA0yczM5u3T5QHouULTzku\/QkF0UBr7DnUC2xcchQrMQLMP2\/i2sNaXPHPcOhHhQW0BtzWeKngcaGZICXtm3gzGFP\/14SF6QGhvDIhss2Ngm8a3xJCLZGbXMr68va9eSCzC9p4bESe7hArjqLEkM1DnO4Qy6gSi803M6HqbEPhUZp3kLuaPb++WcBRiqYA+tp6ZmAYxGo1lrF8WcPx5ETYNoNx+qIlrbYBErT45GqSGHgFa\/bsXT6AjmPD2BsMuzb3MyNt48XQNqYST2ZncnpbRB\/QDVJ+RSbyKEoPzkyn+jPX4a10oXE5\/SME1lX8NtesLsxqF39WQ8kVuvaYluWx0NlM+AsltoGs7wH7w\/Ke\/LRbm2y3g\/fNZcD0MYBnJCU24WwkN0XxN8LtHZKIMgGB2SIat65m61dqCewFMxUzGtA7goYvEa9UoCuKk1HFzmZnRndCVESjMHcWPR86Vsxl6eMaglOYVoxuHyLq4wyyJ94\/VgJ4zdfJI4VhdvJXUZ\/F0PbkuoSicbt0GdvFak33YaiS1ueqdyvEyzEgdsakioBGYIiM4SdVkY\/+xGswRVfu6HRWGtCsZXu7keWt8qgYMb5wFSdc+4fnsr2RFgiYAR2dhWrn\/Hm3EoKIZ8RrcBb48ERdhcLVCWM3ruYR7WN0mJpAN2LGbEl\/b6tjSFn2xwt28fX1bXGZOix4hZ+25HRCORrW8HLeednkeSYM21yclGjGhydge9dvPkxfGs6gFLUNMdD7u1RfLlHTogwsdMMCYB3Z0HqDf9JyOyAHme07NG8nR5fGVkYgSLRWbK03\/74Qu9bmpVcM23hXQgklG+0RH3aSYDC2S\/L9T3GsseReB0W1Ltt+sCTVZkGtsDBrP0kaRW2iP1wo7Bztt02WEKs3jx+YaxcWkZfRdKSjDkoGS5w68U3UeX8eWlaCGKZ9SM\/X3WBdD3oQ+G9BX76RDWBW0yLgRkzFDNtCuCBT2F88ngyJBdrM\/h7V31HBvtd7YPbui5Il073EqntQHrDIsOhwMAkqi9B\/kv76U\/paWJF8woebSmmJHRkjpRSgZgBRqy5YDWgsEkBsb\/M7PToEBQ3leCAwUVxr8WS75bWnbVdbkIZdY+PTaLeeCkuG7H7vwHsMHNE1K7RV2aEJqgrchEzMkpJfc\/F3W7UorADHKMPEliKd7a1Sl5kCk3D9DaJfO3OQsBHyh3ZE7AAsge2VLZ\/hKcfBRRDWXybOanemCu6Q7vsvM8wWH4o8dl4VDgGt80bTo8Wt1uxpADugU6ulqKwUOXrGWE5bDusJ2mpJbpLoLiFHB23KWFqKzDZwzFrN0wJTtYC96dHAFFtcFTJAxVJXjOFXgbY7vRAZRGUwDQXteKawnevNpun7oZyesoi7eusyyYP2jxb+HyXF+z7ka6hd60sXztpl8vmZcoekRcexV9VhJVffkIysEhlTHwq1XquRiHrMeRzFOZtAIJBPJ6OZxJcxt20ZPFVJr8aJ8EpGmcPk9Vrzifck90TJwUFBj1fhjVY\/UPhml37sb\/LM8HBxgBhMnNtJeY7KSrWcNA5DLTaNxf2vVrKUt7LUhb0Q\/D8yV+8tnQoqnGzXd4q7PgiJ5Ok02GD1eJbmsGd8S46DGlSQ2ESWiFO81bUBCz\/l+gy6UWKEh\/Dk3vJef1PahTiYWdIeKgHkHGP9f5CayvJZetPhLRg2JcUwKffvitpq3RA60DPcuH5N7FFwzhR+R2KhtSqQFLREu3\/ny4h2cMyB6kAUHnvrnSRJbtqPECJz3ku2o3UDldRKB+N\/okiRvibcBw8LdAM2eYNe4pcJ3TZPSMDc5M13NTrYEFMCbRwBCL31Sr9XIldusv6xbllg7QWuoPgFbQbBXbGMK9TKRzIvrHbzjSFGNrhzkAZRY1XEJbbyX4CL95T8494H\/EN9az0oAVmouUwLKw9TcllFwgrYL9Izx4U7UjaNaDShgCnfoEPMD+MNTfyg1MAEL10owxfKqO3l+CO7xyXepyXAUAYKab7FQMBACA9dI3WgNGnAauL1dqZIyQbop7VGGyDAjtV+hyF5mmGyA=="}
 00409{"flow_id":38,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":661,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570673,"pkt_ts_usec":280105,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoMY5AAEAGVY4KCAABQERpZ6HLAbsAQeUF\/744I1AUa7XPtwAA"}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":662,"source":"webex.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1444570674487,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55665,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":662,"source":"webex.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1444570674487,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55665,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":39,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":662,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570674,"pkt_ts_usec":487975,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8CB5AAEAGejQKCAABrfMAbtlxAbui3tn8AAAAAKACOQgsWAAAAgQFtAQCCAoATNHiAAAAAAEDAwY="}
 00410{"flow_id":39,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":663,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570674,"pkt_ts_usec":499448,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAklAABAGsB2t8wBuCggAAQG72XFdISYDot7Z\/VAS\/\/8cOwAA"}
 00407{"flow_id":39,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":664,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570674,"pkt_ts_usec":500159,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoCB9AAEAGekcKCAABrfMAbtlxAbui3tn9XSEmBFAQOQjjMwAA"}
 00662{"flow_id":39,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":665,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570674,"pkt_ts_usec":600509,"pkt_caplen":241,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":241,"pkt_l4_len":207,"pkt":"ABoRAAACABoRAAABCABFAADjCCBAAEAGeYsKCAABrfMAbtlxAbui3tn9XSEmBFAYOQgu1wAAFgMBALYBAACyAwF10XyjAsAxicBbHHpuW8T0LZqOxOyDfFNTQx6hPM8mVgAAWMAUwAoAOQA4ADcANsAPwAUANcATwAkAMwAyADEAMACaAJkAmACXwA7ABAAvAJbAEcAHwAzAAgAFAATAEsAIABYAEwAQAA3ADcADAAoAFQASAA8ADAAJAP8BAAAxAAsABAMAAQIACgAcABoAFwAZABwAGwAYABoAFgAOAA0ACwAMAAkACgAjAAAADwABAQ=="}
-00732{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":665,"source":"webex.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":4,"flow_first_seen":1444570674487,"flow_last_seen":1444570674600,"flow_tot_l4_data_len":287,"flow_min_l4_data_len":20,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55665,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00743{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":665,"source":"webex.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":4,"flow_first_seen":1444570674487,"flow_last_seen":1444570674600,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":187,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55665,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":39,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":666,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570674,"pkt_ts_usec":600804,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAkpAABAGsByt8wBuCggAAQG72XFdISYEot7auFAQ\/\/8bgQAA"}
 05677{"flow_id":39,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":671,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570675,"pkt_ts_usec":110598,"pkt_caplen":3961,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3961,"pkt_l4_len":3927,"pkt":"ABoRAAACABoRAAABCABFAA9rAk1AABAGoNat8wBuCggAAQG72XFdISYEot7auFAY\/\/\/mtwAAFgMBDz4CAAAtAwFWGmIdHu5dz76\/IuzQTDtiAhUgwLQWfqmTm8g03f1qUAAANQAABf8BAAEACwAPBQAPAgAE6TCCBOUwggPNoAMCAQICECl0ianUHkm+YfeBaUbmIfMwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDAeFw0xNTA0MTAwMDAwMDBaFw0xODA0MTAyMzU5NTlaMHcxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMREwDwYDVQQHDAhTYW4gSm9zZTEcMBoGA1UECgwTQ2lzY28gU3lzdGVtcywgSW5jLjEMMAoGA1UECwwDQ1NHMRQwEgYDVQQDDAsqLndlYmV4LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ14yGFLwwhhZyxegl+wYbyZZp5q4NComRXAz+k8ibNrPp+x46qW\/Dt++MdupJ8y605K5KTQVb24unmPF+pZq1par5YBKMjJrJTW2aAI1MtQvRzSDCNhdWyxiP6SkVBm6ZOcLwL+kijn\/nCot5orO1NrHHFG\/HBcSk1aaetoitrjs5BWuMxdYuIZvzSoyViVbo\/w\/LUKXdD0rlOcFmOxtcf+VKb7w1eyku07Jp94m\/\/ILLQS\/jy7ymRyfGFnPLtNqBmUKFg+uAD7JcHZiy8g6quVEhEZdm3O+tUR2wYZ5in9yKcrxqoHwhW0O4X2\/rJ4mNDvikIgaWiSNW7eIoh0NWECAwEAAaOCAWQwggFgMBYGA1UdEQQPMA2CCyoud2ViZXguY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH\/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYDVR0jBBgwFoAUX2DPYZBV34RDFIpgKrL1evRDGO8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Muc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAFNF1YB0fCkEyxRc1VQO7NUZao+PnZuavjgeTnyTKmHl\/4Zxh1Xg\/M\/f\/RHSrGrgUW2xaSZN\/Dwt2hqMtIi\/b\/AgOFeqNKmMxH3nWxf6f1Lr7QoTvApLQGqjeuIT3U6AiRMt4Ksgfx7+1Vbil1AaILo859VgXSMgVJTv4QpUpzg\/EKtUqPwMwq8PvwoTjlewyOt9YbCxNTO91JkKsYuwm7uUeU7Fx+r+rP+wgDwYVbbsUwQXAbj7QOj3dkPLzn+gcrhK1ZlgFf7Ti34xrqj7jNiaMc0dYh\/Ns3KCHMTs5rVCGLIk7lEgovwLDbJtuuQTlvaHoeZIGVPqROi5Bl\/WxAgAFPDCCBTgwggQgoAMCAQICEFE\/uXQ4cLc0QEGNMJMGmf8wDQYJKoZIhvcNAQELBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MB4XDTEzMTAzMTAwMDAwMFoXDTIzMTAzMDIzNTk1OVowfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLYBcocdC21F1Y5xUpSCZboS9gM8WifmkIoYsOlMFN+VRGCWwN6DS\/heQTJtJZ3GYEBlFn5vPd6mSeCLbeD3Vonf7IDepxTJelIH0ZPyJ0p+L55Vvb3\/dk6aNqLS4IzQRLDyDzM1pZ6hCEaIgQDJxeLHGhhkw8OUYAzHbS1zut+0GKs7rN7AXTvaTXrytU9qe6XmMqNqkQOJZlKFZakzm0CVB8qaibiBjpjSKy0TNF1k1D\/Ey\/W2uHGGPWfySVd8wA63iZNtCkJzQ89I28WSoEW+\/KDEMO41thVMj3xvQ+9jFKVShaXelIhY3UvFvnEZr71tQnY\/ycAzUR8b0s\/sPcCAwEAAaOCAWMwggFfMBIGA1UdEwEB\/wQIMAYBAf8CAQAwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNiLmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vczIuc3ltY2IuY29tMGsGA1UdIARkMGIwYAYKYIZIAYb4RQEHNjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMB8GA1UdIwQYMBaAFH\/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBCwUAA4IBAQBelFZJ3Y4tZfXBNlG2A+PannMZ8h9Zq1h+bCYFLPqB11wjFyIsN5P3huyF5rCj\/R\/iMqhFb+HZ+7mv0nCgMkJlv4T+FiqPP8Wm1qOTfUPpdCGRNSj0Y+ku7ff1XH9LmrUg6Qq94EUQDBSUml2l40uR6CSbRkBl9CJyzZn4iBH183\/mM4LmqMV+\/tAI4iVYCHFo5s2i5hTeTlIkLf3leRNT514vLU0bbUAVUiv3h4l4EoFu2U2qLXjUwiw9CF+HkZ4fDrDeMFJkhomqnWacDnYMgPJ02Cr4uDrO19YPEb5rqxT1vUGgImOJ8boPbyljZi0\/rIxyxfvH5NQP8jtPjCnHAATUMIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ\/XxrcgxiV0i6CqqpkKzj\/i5Vbext0uz\/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6\/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn\/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4\/VBEnkjWNHiDxpg8v+R70rfk\/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10\/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH\/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB\/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW\/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3\/DgAAAA=="}
-01111{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":671,"source":"webex.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":6,"flow_first_seen":1444570674487,"flow_last_seen":1444570675110,"flow_tot_l4_data_len":4234,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":705,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55665,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01122{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":671,"source":"webex.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":6,"flow_first_seen":1444570674487,"flow_last_seen":1444570675110,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":4094,"flow_avg_l4_payload_len":682,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55665,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00408{"flow_id":39,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":676,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570675,"pkt_ts_usec":113353,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoCCFAAEAGekUKCAABrfMAbtlxAbui3tq4XSE1R1AQTE+\/7gAA"}
 00853{"flow_id":39,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":677,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570675,"pkt_ts_usec":163959,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFuCCJAAEAGeP4KCAABrfMAbtlxAbui3tq4XSE1R1AYTE\/9iwAAFgMBAQYQAAECAQADqEbmbhNsumkBtAw0L1FiNOhiWgRZUZ55aPV5j4qSX6CJmn4f8ibzLJBlBGsAtgVCMqb3u\/bkEAwuWi3+E7uYNezIwjTe6uWtAYnXIHiRx75nDApJ9g3cbSfyo\/qsdlUxQzwGUMwRXI\/KZ5gpdEwezEGeP4EkEUeNRGvOTWNA1b6isLsNGEPVow6vZOJCaTzDuZ0FoMc5Ae\/GMdYxQvd4tmk3HlTvEaGZw3K85jUAIaU9PyIqcSNZBrfjNzLy5+n81AmqdPFIWfsMUUQ+n\/CXyELkuNfob4CA5H3XcX196Fn0C7YJybKnDxfalCnXJ4srNt6p3fhw2czhca2\/nB2uFAMBAAEBFgMBADAifxZQCOeUA1lSfy0VO6Pq3JMmDH1y+Vy7Vcl3lTQRhhGehcW0+Ylu3FQ0gSzj5pE="}
 00410{"flow_id":39,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":678,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570675,"pkt_ts_usec":164264,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAlBAABAGsBat8wBuCggAAQG72XFdITVHot7b\/lAQ\/\/8K+AAA"}
@@ -580,24 +580,24 @@
 00410{"flow_id":39,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":692,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570675,"pkt_ts_usec":475056,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAldAABAGsA+t8wBuCggAAQG72XFdITWCot7eFlAQ\/\/8IpQAA"}
 00545{"flow_id":39,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":694,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570675,"pkt_ts_usec":475825,"pkt_caplen":152,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":152,"pkt_l4_len":118,"pkt":"ABoRAAACABoRAAABCABFAACKCCVAAEAGed8KCAABrfMAbtlxAbui3t4WXSE1glAYTE\/UtQAAmHVEYbuqOyCrxFJu6n22Og77DMpB20n4QmoYUJth1X+w3z6u9DIZFjIBQ2eHYidmx2WtmuC+Q+hUoiqkcZsL5JNP7gopOvzrK7EqC7vXk\/VlCpBDIvGFCmQRzVhLLhBg0rE="}
 00410{"flow_id":39,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":695,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570675,"pkt_ts_usec":476003,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAllAABAGsA2t8wBuCggAAQG72XFdITWCot7eeFAQ\/\/8IQwAA"}
-00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":736,"source":"webex.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1444570675941,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51833,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":736,"source":"webex.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1444570675941,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51833,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":40,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":736,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570675,"pkt_ts_usec":941714,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8SaRAAEAGwwMKCAABPm3lnsp5AbteGJvVAAAAAKACOQhIBAAAAgQFtAQCCAoATNJxAAAAAAEDAwY="}
 00409{"flow_id":40,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":737,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570675,"pkt_ts_usec":945842,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAm5AABAGOk4+beWeCggAAQG7ynmh52QqXhib1lAS\/\/+1iAAA"}
 00407{"flow_id":40,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":739,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570675,"pkt_ts_usec":946782,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoSaVAAEAGwxYKCAABPm3lnsp5AbteGJvWoedkK1AQOQh8gQAA"}
 00663{"flow_id":40,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":740,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570675,"pkt_ts_usec":997260,"pkt_caplen":241,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":241,"pkt_l4_len":207,"pkt":"ABoRAAACABoRAAABCABFAADjSaZAAEAGwloKCAABPm3lnsp5AbteGJvWoedkK1AYOQjWkQAAFgMBALYBAACyAwEHq+X4OM58pZkulReYFtDW\/RDKtfBfQqv2TASThhAOCAAAWMAUwAoAOQA4ADcANsAPwAUANcATwAkAMwAyADEAMACaAJkAmACXwA7ABAAvAJbAEcAHwAzAAgAFAATAEsAIABYAEwAQAA3ADcADAAoAFQASAA8ADAAJAP8BAAAxAAsABAMAAQIACgAcABoAFwAZABwAGwAYABoAFgAOAA0ACwAMAAkACgAjAAAADwABAQ=="}
-00733{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":740,"source":"webex.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":4,"flow_first_seen":1444570675941,"flow_last_seen":1444570675997,"flow_tot_l4_data_len":287,"flow_min_l4_data_len":20,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51833,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00744{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":740,"source":"webex.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":4,"flow_first_seen":1444570675941,"flow_last_seen":1444570675997,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":187,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51833,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":40,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":741,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570675,"pkt_ts_usec":997731,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAnBAABAGOkw+beWeCggAAQG7ynmh52QrXhickVAQ\/\/+0zgAA"}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":821,"source":"webex.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1444570679512,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55669,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":821,"source":"webex.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1444570679512,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55669,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":41,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":821,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570679,"pkt_ts_usec":512700,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8dLdAAEAGDZsKCAABrfMAbtl1Abugj6duAAAAAKACOQhfOgAAAgQFtAQCCAoATNPZAAAAAAEDAwY="}
 00409{"flow_id":41,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":822,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570679,"pkt_ts_usec":516479,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAphAABAGr86t8wBuCggAAQG72XVfcFiRoI+nb1AS\/\/8cNwAA"}
 00407{"flow_id":41,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":823,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570679,"pkt_ts_usec":516623,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAodLhAAEAGDa4KCAABrfMAbtl1Abugj6dvX3BYklAQOQjjLwAA"}
 00664{"flow_id":41,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":824,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570679,"pkt_ts_usec":526515,"pkt_caplen":241,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":241,"pkt_l4_len":207,"pkt":"ABoRAAACABoRAAABCABFAADjdLlAAEAGDPIKCAABrfMAbtl1Abugj6dvX3BYklAYOQi67gAAFgMBALYBAACyAwE3afvT656oHHNlOl3\/S5vQra3qbarVhBS8TCkcXn\/60QAAWMAUwAoAOQA4ADcANsAPwAUANcATwAkAMwAyADEAMACaAJkAmACXwA7ABAAvAJbAEcAHwAzAAgAFAATAEsAIABYAEwAQAA3ADcADAAoAFQASAA8ADAAJAP8BAAAxAAsABAMAAQIACgAcABoAFwAZABwAGwAYABoAFgAOAA0ACwAMAAkACgAjAAAADwABAQ=="}
-00732{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":824,"source":"webex.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":4,"flow_first_seen":1444570679512,"flow_last_seen":1444570679526,"flow_tot_l4_data_len":287,"flow_min_l4_data_len":20,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55669,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00743{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":824,"source":"webex.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":4,"flow_first_seen":1444570679512,"flow_last_seen":1444570679526,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":187,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55669,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":41,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":825,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570679,"pkt_ts_usec":526722,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAplAABAGr82t8wBuCggAAQG72XVfcFiSoI+oKlAQ\/\/8bfQAA"}
 02277{"flow_id":41,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":844,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570680,"pkt_ts_usec":79755,"pkt_caplen":1434,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1434,"pkt_l4_len":1400,"pkt":"ABoRAAACABoRAAABCABFAAWMAqNAABAGql+t8wBuCggAAQG72XVfcFiSoI+oKlAY\/\/9YtQAAFgMBDz4CAAAtAwFWGmIhpdMClixxGH1P3IzNWjym1oz\/Vm0EP84\/FROoyAAANQAABf8BAAEACwAPBQAPAgAE6TCCBOUwggPNoAMCAQICECl0ianUHkm+YfeBaUbmIfMwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDAeFw0xNTA0MTAwMDAwMDBaFw0xODA0MTAyMzU5NTlaMHcxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMREwDwYDVQQHDAhTYW4gSm9zZTEcMBoGA1UECgwTQ2lzY28gU3lzdGVtcywgSW5jLjEMMAoGA1UECwwDQ1NHMRQwEgYDVQQDDAsqLndlYmV4LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ14yGFLwwhhZyxegl+wYbyZZp5q4NComRXAz+k8ibNrPp+x46qW\/Dt++MdupJ8y605K5KTQVb24unmPF+pZq1par5YBKMjJrJTW2aAI1MtQvRzSDCNhdWyxiP6SkVBm6ZOcLwL+kijn\/nCot5orO1NrHHFG\/HBcSk1aaetoitrjs5BWuMxdYuIZvzSoyViVbo\/w\/LUKXdD0rlOcFmOxtcf+VKb7w1eyku07Jp94m\/\/ILLQS\/jy7ymRyfGFnPLtNqBmUKFg+uAD7JcHZiy8g6quVEhEZdm3O+tUR2wYZ5in9yKcrxqoHwhW0O4X2\/rJ4mNDvikIgaWiSNW7eIoh0NWECAwEAAaOCAWQwggFgMBYGA1UdEQQPMA2CCyoud2ViZXguY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH\/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYDVR0jBBgwFoAUX2DPYZBV34RDFIpgKrL1evRDGO8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Muc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAFNF1YB0fCkEyxRc1VQO7NUZao+PnZuavjgeTnyTKmHl\/4Zxh1Xg\/M\/f\/RHSrGrgUW2xaSZN\/Dwt2hqMtIi\/b\/AgOFeqNKmMxH3nWxf6f1Lr7QoTvApLQGqjeuIT3U6AiRMt4Ksgfx7+1Vbil1AaILo859VgXSMgVJTv4QpUpzg\/EKtUqPwMwq8PvwoTjlewyOt9YbCxNTO91JkKsYuwm7uUeU7Fx+r+rP+wgDwYVbbsUwQXAbj7QOj3dkPLzn+gcrhK1ZlgFf7Ti34xrqj7jNiaMc0dYh\/Ns3KCHMTs5rVCGLIk7lEgovwLDbJtuuQTlvaHoeZIGVPqROi5Bl\/WxAgAFPDCCBTgwggQgoAMCAQICEFE\/uXQ4cLc0QEGNMJMGmf8wDQYJKoZIhvcNAQELBQAwgcoxCzAJBgNV"}
 00406{"flow_id":41,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":845,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570680,"pkt_ts_usec":82130,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAodLpAAEAGDawKCAABrfMAbtl1Abugj6gqX3Bd9lAQQLDVaAAA"}
 03813{"flow_id":41,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":846,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570680,"pkt_ts_usec":91160,"pkt_caplen":2581,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":2581,"pkt_l4_len":2547,"pkt":"ABoRAAACABoRAAABCABFAAoHAqRAABAGpeOt8wBuCggAAQG72XVfcF32oI+oKlAY\/\/+QNAAABAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MB4XDTEzMTAzMTAwMDAwMFoXDTIzMTAzMDIzNTk1OVowfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLYBcocdC21F1Y5xUpSCZboS9gM8WifmkIoYsOlMFN+VRGCWwN6DS\/heQTJtJZ3GYEBlFn5vPd6mSeCLbeD3Vonf7IDepxTJelIH0ZPyJ0p+L55Vvb3\/dk6aNqLS4IzQRLDyDzM1pZ6hCEaIgQDJxeLHGhhkw8OUYAzHbS1zut+0GKs7rN7AXTvaTXrytU9qe6XmMqNqkQOJZlKFZakzm0CVB8qaibiBjpjSKy0TNF1k1D\/Ey\/W2uHGGPWfySVd8wA63iZNtCkJzQ89I28WSoEW+\/KDEMO41thVMj3xvQ+9jFKVShaXelIhY3UvFvnEZr71tQnY\/ycAzUR8b0s\/sPcCAwEAAaOCAWMwggFfMBIGA1UdEwEB\/wQIMAYBAf8CAQAwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNiLmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vczIuc3ltY2IuY29tMGsGA1UdIARkMGIwYAYKYIZIAYb4RQEHNjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMB8GA1UdIwQYMBaAFH\/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBCwUAA4IBAQBelFZJ3Y4tZfXBNlG2A+PannMZ8h9Zq1h+bCYFLPqB11wjFyIsN5P3huyF5rCj\/R\/iMqhFb+HZ+7mv0nCgMkJlv4T+FiqPP8Wm1qOTfUPpdCGRNSj0Y+ku7ff1XH9LmrUg6Qq94EUQDBSUml2l40uR6CSbRkBl9CJyzZn4iBH183\/mM4LmqMV+\/tAI4iVYCHFo5s2i5hTeTlIkLf3leRNT514vLU0bbUAVUiv3h4l4EoFu2U2qLXjUwiw9CF+HkZ4fDrDeMFJkhomqnWacDnYMgPJ02Cr4uDrO19YPEb5rqxT1vUGgImOJ8boPbyljZi0\/rIxyxfvH5NQP8jtPjCnHAATUMIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ\/XxrcgxiV0i6CqqpkKzj\/i5Vbext0uz\/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6\/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn\/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4\/VBEnkjWNHiDxpg8v+R70rfk\/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10\/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH\/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB\/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW\/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3\/DgAAAA=="}
-01111{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":846,"source":"webex.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":8,"flow_first_seen":1444570679512,"flow_last_seen":1444570680091,"flow_tot_l4_data_len":4274,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2547,"flow_avg_l4_data_len":534,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55669,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01122{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":846,"source":"webex.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":8,"flow_first_seen":1444570679512,"flow_last_seen":1444570680091,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2527,"flow_tot_l4_payload_len":4094,"flow_avg_l4_payload_len":511,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55669,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00406{"flow_id":41,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":847,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570680,"pkt_ts_usec":91328,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAodLtAAEAGDasKCAABrfMAbtl1Abugj6gqX3Bn1VAQTvi9QQAA"}
 00853{"flow_id":41,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":848,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570680,"pkt_ts_usec":125739,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFudLxAAEAGDGQKCAABrfMAbtl1Abugj6gqX3Bn1VAYTvgeLgAAFgMBAQYQAAECAQCcgU0dFAydAt1bwWuwgYT6mr2lcaMFB9CDQyxoEtMzoDh1nlnjoxyLJ4He6xCirhE6PRv0yfRCLpmqfZ0WY+2m8X285tczrEBYICsVY\/P9ug8F9h5Z1cEDNvjxGHabdWijgjcENae5p6IhqwMuHn6ZZv+428J69nMnoyodgVGZBmSuRHRXf7qcdYCYNZasn\/un9nq78TLpMsJY\/87ceKuMdUXwPQWp7CyY\/2Qe2ycI9KhK\/kVUuYYzQzMffM6sVjiYTvWWztTdhFw32qEPmFxC3TuxyB8XzdetBA8CbQwuQGvoGSbkRv6JvrBjnubCbVhquLbCDwILUKbSdSGMvZcUFAMBAAEBFgMBADCARA4xmCv92PXDY+qlt41SoJf\/Uwd33ZXkWGsvtwJw5crYqOk3sL8JCzLtHEEFSJY="}
 00410{"flow_id":41,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":849,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570680,"pkt_ts_usec":125976,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAqVAABAGr8Gt8wBuCggAAQG72XVfcGfVoI+pcFAQ\/\/8K9AAA"}
@@ -608,15 +608,15 @@
 00408{"flow_id":40,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1002,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570690,"pkt_ts_usec":937763,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoSadAAEAGwxQKCAABPm3lnsp5AbteGJyRoedkK1AROQh7xQAA"}
 00410{"flow_id":40,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1003,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570690,"pkt_ts_usec":940377,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAvNAABAGOck+beWeCggAAQG7ynmh52QrXhicklAQ\/\/+0zQAA"}
 00410{"flow_id":40,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1004,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570690,"pkt_ts_usec":940588,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAvRAABAGOcg+beWeCggAAQG7ynmh52QrXhicklAR\/\/+0zAAA"}
-00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1058,"source":"webex.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1444570693238,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55671,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1058,"source":"webex.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1444570693238,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55671,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00437{"flow_id":42,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1058,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570693,"pkt_ts_usec":238349,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8LOJAAEAGVXAKCAABrfMAbtl3AbsPD\/XWAAAAAKACOQic9QAAAgQFtAQCCAoATNk0AAAAAAEDAwY="}
 00411{"flow_id":42,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1059,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570693,"pkt_ts_usec":244944,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAxBAABAGr1at8wBuCggAAQG72Xfw8AopDw\/111AS\/\/8cNQAA"}
 00409{"flow_id":42,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1060,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570693,"pkt_ts_usec":245402,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoLONAAEAGVYMKCAABrfMAbtl3AbsPD\/XX8PAKKlAQOQjjLQAA"}
 00664{"flow_id":42,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1063,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570693,"pkt_ts_usec":297839,"pkt_caplen":241,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":241,"pkt_l4_len":207,"pkt":"ABoRAAACABoRAAABCABFAADjLORAAEAGVMcKCAABrfMAbtl3AbsPD\/XX8PAKKlAYOQjZZAAAFgMBALYBAACyAwFP3AbhLhTWOx1T12yIPxjjHHkav2YDbjvETRMnoVMoSgAAWMAUwAoAOQA4ADcANsAPwAUANcATwAkAMwAyADEAMACaAJkAmACXwA7ABAAvAJbAEcAHwAzAAgAFAATAEsAIABYAEwAQAA3ADcADAAoAFQASAA8ADAAJAP8BAAAxAAsABAMAAQIACgAcABoAFwAZABwAGwAYABoAFgAOAA0ACwAMAAkACgAjAAAADwABAQ=="}
-00733{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1063,"source":"webex.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":4,"flow_first_seen":1444570693238,"flow_last_seen":1444570693297,"flow_tot_l4_data_len":287,"flow_min_l4_data_len":20,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55671,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00744{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1063,"source":"webex.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":4,"flow_first_seen":1444570693238,"flow_last_seen":1444570693297,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":187,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55671,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00411{"flow_id":42,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1064,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570693,"pkt_ts_usec":298648,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAxJAABAGr1St8wBuCggAAQG72Xfw8AoqDw\/2klAQ\/\/8bewAA"}
 05678{"flow_id":42,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1074,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570693,"pkt_ts_usec":766903,"pkt_caplen":3961,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3961,"pkt_l4_len":3927,"pkt":"ABoRAAACABoRAAABCABFAA9rAxdAABAGoAyt8wBuCggAAQG72Xfw8AoqDw\/2klAY\/\/\/4DQAAFgMBDz4CAAAtAwFWGmIvr2fkKd74YByGbdYdmpDL9Iax2YS7H6drFqqYhQAANQAABf8BAAEACwAPBQAPAgAE6TCCBOUwggPNoAMCAQICECl0ianUHkm+YfeBaUbmIfMwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDAeFw0xNTA0MTAwMDAwMDBaFw0xODA0MTAyMzU5NTlaMHcxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMREwDwYDVQQHDAhTYW4gSm9zZTEcMBoGA1UECgwTQ2lzY28gU3lzdGVtcywgSW5jLjEMMAoGA1UECwwDQ1NHMRQwEgYDVQQDDAsqLndlYmV4LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ14yGFLwwhhZyxegl+wYbyZZp5q4NComRXAz+k8ibNrPp+x46qW\/Dt++MdupJ8y605K5KTQVb24unmPF+pZq1par5YBKMjJrJTW2aAI1MtQvRzSDCNhdWyxiP6SkVBm6ZOcLwL+kijn\/nCot5orO1NrHHFG\/HBcSk1aaetoitrjs5BWuMxdYuIZvzSoyViVbo\/w\/LUKXdD0rlOcFmOxtcf+VKb7w1eyku07Jp94m\/\/ILLQS\/jy7ymRyfGFnPLtNqBmUKFg+uAD7JcHZiy8g6quVEhEZdm3O+tUR2wYZ5in9yKcrxqoHwhW0O4X2\/rJ4mNDvikIgaWiSNW7eIoh0NWECAwEAAaOCAWQwggFgMBYGA1UdEQQPMA2CCyoud2ViZXguY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH\/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYDVR0jBBgwFoAUX2DPYZBV34RDFIpgKrL1evRDGO8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Muc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAFNF1YB0fCkEyxRc1VQO7NUZao+PnZuavjgeTnyTKmHl\/4Zxh1Xg\/M\/f\/RHSrGrgUW2xaSZN\/Dwt2hqMtIi\/b\/AgOFeqNKmMxH3nWxf6f1Lr7QoTvApLQGqjeuIT3U6AiRMt4Ksgfx7+1Vbil1AaILo859VgXSMgVJTv4QpUpzg\/EKtUqPwMwq8PvwoTjlewyOt9YbCxNTO91JkKsYuwm7uUeU7Fx+r+rP+wgDwYVbbsUwQXAbj7QOj3dkPLzn+gcrhK1ZlgFf7Ti34xrqj7jNiaMc0dYh\/Ns3KCHMTs5rVCGLIk7lEgovwLDbJtuuQTlvaHoeZIGVPqROi5Bl\/WxAgAFPDCCBTgwggQgoAMCAQICEFE\/uXQ4cLc0QEGNMJMGmf8wDQYJKoZIhvcNAQELBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MB4XDTEzMTAzMTAwMDAwMFoXDTIzMTAzMDIzNTk1OVowfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLYBcocdC21F1Y5xUpSCZboS9gM8WifmkIoYsOlMFN+VRGCWwN6DS\/heQTJtJZ3GYEBlFn5vPd6mSeCLbeD3Vonf7IDepxTJelIH0ZPyJ0p+L55Vvb3\/dk6aNqLS4IzQRLDyDzM1pZ6hCEaIgQDJxeLHGhhkw8OUYAzHbS1zut+0GKs7rN7AXTvaTXrytU9qe6XmMqNqkQOJZlKFZakzm0CVB8qaibiBjpjSKy0TNF1k1D\/Ey\/W2uHGGPWfySVd8wA63iZNtCkJzQ89I28WSoEW+\/KDEMO41thVMj3xvQ+9jFKVShaXelIhY3UvFvnEZr71tQnY\/ycAzUR8b0s\/sPcCAwEAAaOCAWMwggFfMBIGA1UdEwEB\/wQIMAYBAf8CAQAwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNiLmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vczIuc3ltY2IuY29tMGsGA1UdIARkMGIwYAYKYIZIAYb4RQEHNjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMB8GA1UdIwQYMBaAFH\/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBCwUAA4IBAQBelFZJ3Y4tZfXBNlG2A+PannMZ8h9Zq1h+bCYFLPqB11wjFyIsN5P3huyF5rCj\/R\/iMqhFb+HZ+7mv0nCgMkJlv4T+FiqPP8Wm1qOTfUPpdCGRNSj0Y+ku7ff1XH9LmrUg6Qq94EUQDBSUml2l40uR6CSbRkBl9CJyzZn4iBH183\/mM4LmqMV+\/tAI4iVYCHFo5s2i5hTeTlIkLf3leRNT514vLU0bbUAVUiv3h4l4EoFu2U2qLXjUwiw9CF+HkZ4fDrDeMFJkhomqnWacDnYMgPJ02Cr4uDrO19YPEb5rqxT1vUGgImOJ8boPbyljZi0\/rIxyxfvH5NQP8jtPjCnHAATUMIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ\/XxrcgxiV0i6CqqpkKzj\/i5Vbext0uz\/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6\/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn\/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4\/VBEnkjWNHiDxpg8v+R70rfk\/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10\/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH\/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB\/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW\/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3\/DgAAAA=="}
-01112{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1074,"source":"webex.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":6,"flow_first_seen":1444570693238,"flow_last_seen":1444570693766,"flow_tot_l4_data_len":4234,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":705,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55671,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01123{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1074,"source":"webex.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":6,"flow_first_seen":1444570693238,"flow_last_seen":1444570693766,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":4094,"flow_avg_l4_payload_len":682,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55671,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00410{"flow_id":42,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1075,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570693,"pkt_ts_usec":768368,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoLOVAAEAGVYEKCAABrfMAbtl3AbsPD\/aS8PAZbVAQTE+\/6AAA"}
 00857{"flow_id":42,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1077,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570693,"pkt_ts_usec":870805,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFuLOZAAEAGVDoKCAABrfMAbtl3AbsPD\/aS8PAZbVAYTE\/xSQAAFgMBAQYQAAECAQB\/lMfcOyzSFtvzhiCHyEEFZaSghx7hULTQzfehcdy6HOZtxb9XEHObkFwD\/OTotTo\/mupVjmxXBO2XEP2UV9WRGEDwyJkhJ4H7Fd4yE8ifc0BzjThXupi9ISSYN+tbMHwotLlhwLF6L4sHCv+nvWDz0QZVlIQ1qBiDGLdyutJBTMLjphMyLgJmPJiX\/MoAFmyEC7w1qWfX+kih2HM\/efeJ+juxKLLRhBIXkEmnw3JQn6dynGsA6pb822R6gmGe1iSr+D8kGx\/CXbkS3LrtMUV839q0yIurqTrLlspkPnvvUYrN1XSrxCngNummT0SDhG9jyoy9RALgsa2veN1LGbZ0FAMBAAEBFgMBADDSiUb2ExE\/e85k2zmYmEm0g\/y2LQmKn2pvdJyMJY9vhF1b5CRrYvY9FhFEHUCyDxY="}
 00411{"flow_id":42,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1078,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570693,"pkt_ts_usec":871619,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAxlAABAGr02t8wBuCggAAQG72Xfw8BltDw\/32FAQ\/\/8K8gAA"}
@@ -626,42 +626,42 @@
 00412{"flow_id":42,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1090,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570694,"pkt_ts_usec":180703,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAx9AABAGr0et8wBuCggAAQG72Xfw8BmoDw\/58FAQ\/\/8InwAA"}
 00548{"flow_id":42,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1091,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570694,"pkt_ts_usec":180852,"pkt_caplen":152,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":152,"pkt_l4_len":118,"pkt":"ABoRAAACABoRAAABCABFAACKLOlAAEAGVRsKCAABrfMAbtl3AbsPD\/nw8PAZqFAYTE9+QQAAYMNllA45YOg7s\/V3FNa7TcKbtucZ8mvaPzrduR8d4GOdPqB\/Vc6yLiClDb4SGaF+XNqtCApbbDmZaYfIgYFlBwQ7D6G\/lqVhg2mTSJR1UkuX0hBLl1qumaY21EsSl3Eo2JI="}
 00412{"flow_id":42,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1092,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570694,"pkt_ts_usec":181039,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAyBAABAGr0at8wBuCggAAQG72Xfw8BmoDw\/6UlAQ\/\/8IPQAA"}
-00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1112,"source":"webex.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1444570694561,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51839,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1112,"source":"webex.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1444570694561,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51839,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00437{"flow_id":43,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1112,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570694,"pkt_ts_usec":561618,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA802lAAEAGOT4KCAABPm3lnsp\/AbubwQrQAAAAAKACOQiUEgAAAgQFtAQCCAoATNm5AAAAAAEDAwY="}
 00410{"flow_id":43,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1113,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570694,"pkt_ts_usec":564407,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAytAABAGOZE+beWeCggAAQG7yn9kPvUvm8EK0VAS\/\/+1ggAA"}
 00409{"flow_id":43,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1114,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570694,"pkt_ts_usec":564543,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo02pAAEAGOVEKCAABPm3lnsp\/AbubwQrRZD71MFAQOQh8ewAA"}
 00665{"flow_id":43,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1115,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570694,"pkt_ts_usec":614759,"pkt_caplen":241,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":241,"pkt_l4_len":207,"pkt":"ABoRAAACABoRAAABCABFAADj02tAAEAGOJUKCAABPm3lnsp\/AbubwQrRZD71MFAYOQigvgAAFgMBALYBAACyAwGiAbZfNeJzK4ep+8FP1757rfliUbGs5JPyfYBIT\/aU1QAAWMAUwAoAOQA4ADcANsAPwAUANcATwAkAMwAyADEAMACaAJkAmACXwA7ABAAvAJbAEcAHwAzAAgAFAATAEsAIABYAEwAQAA3ADcADAAoAFQASAA8ADAAJAP8BAAAxAAsABAMAAQIACgAcABoAFwAZABwAGwAYABoAFgAOAA0ACwAMAAkACgAjAAAADwABAQ=="}
-00734{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1115,"source":"webex.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":4,"flow_first_seen":1444570694561,"flow_last_seen":1444570694614,"flow_tot_l4_data_len":287,"flow_min_l4_data_len":20,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51839,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00745{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1115,"source":"webex.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":4,"flow_first_seen":1444570694561,"flow_last_seen":1444570694614,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":187,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51839,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00410{"flow_id":43,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1116,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570694,"pkt_ts_usec":615065,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAyxAABAGOZA+beWeCggAAQG7yn9kPvUwm8ELjFAQ\/\/+0yAAA"}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1230,"source":"webex.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1444570699074,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.241.32.14","src_port":46211,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1230,"source":"webex.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1444570699074,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.241.32.14","src_port":46211,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":44,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1230,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":74033,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8OjpAAEAGn3oKCAABNvEgDrSDAbvRQeFHAAAAAKACOQhpXwAAAgQFtAQCCAoATNt9AAAAAAEDAwY="}
 00409{"flow_id":44,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1231,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":77509,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA2VAABAGBmQ28SAOCggAAQG7tIMuvh640UHhSFAS\/\/+YiwAA"}
 00407{"flow_id":44,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1232,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":77833,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoOjtAAEAGn40KCAABNvEgDrSDAbvRQeFILr4euVAQOQhfhAAA"}
 00699{"flow_id":44,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1233,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":79240,"pkt_caplen":270,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":270,"pkt_l4_len":236,"pkt":"ABoRAAACABoRAAABCABFAAEAOjxAAEAGnrQKCAABNvEgDrSDAbvRQeFILr4euVAYOQhpTwAAFgMBANMBAADPAwFWGmZLJysQyU55el0fA2qHtq46\/QtJIPLxFEGaenjG8gAARgAEAAUALwA1wALABMAFwAzADsAPwAfACcAKwBHAE8AUADMAOQAyADgACsADwA3ACMASABYAEwAJABUAEgADAAgAFAARAP8BAABgAAAAGAAWAAATYXBpLmNyaXR0ZXJjaXNtLmNvbQALAAQDAAECAAoANAAyAA4ADQAZAAsADAAYAAkACgAWABcACAAGAAcAFAAVAAQABQASABMAAQACAAMADwAQABEAIwAA"}
-00751{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1233,"source":"webex.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":4,"flow_first_seen":1444570699074,"flow_last_seen":1444570699079,"flow_tot_l4_data_len":316,"flow_min_l4_data_len":20,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":79,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.241.32.14","src_port":46211,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"api.crittercism.com","ja3":"54ae5fcb0159e2ddf6a50e149221c7c7","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00762{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1233,"source":"webex.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":4,"flow_first_seen":1444570699074,"flow_last_seen":1444570699079,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":216,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.241.32.14","src_port":46211,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"api.crittercism.com","ja3":"54ae5fcb0159e2ddf6a50e149221c7c7","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":44,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1234,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":79481,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA2ZAABAGBmM28SAOCggAAQG7tIMuvh650UHiIFAQ\/\/+XtAAA"}
-00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1235,"source":"webex.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1444570699096,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"78.46.237.91","src_port":59756,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1235,"source":"webex.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1444570699096,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"78.46.237.91","src_port":59756,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":45,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1235,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":96723,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8731AAEAGBawKCAABTi7tW+lsAFBr3TT9AAAAAKACOQhjAgAAAgQFtAQCCAoATNuAAAAAAAEDAwY="}
 00411{"flow_id":45,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1236,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":101467,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA2dAABAGIddOLu1bCggAAQBQ6WyUIssCa900\/lAS\/\/+AggAA"}
-00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1237,"source":"webex.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_first_seen":1444570699101,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"78.46.237.91","src_port":59757,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1237,"source":"webex.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_first_seen":1444570699101,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"78.46.237.91","src_port":59757,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":46,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1237,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":101872,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8ZgxAAEAGjx0KCAABTi7tW+ltAFASyr2MAAAAAKACOQgzhQAAAgQFtAQCCAoATNuAAAAAAAEDAwY="}
 00410{"flow_id":46,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1238,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":106726,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA2hAABAGIdZOLu1bCggAAQBQ6W3tNUJzEsq9jVAS\/\/+AgQAA"}
 00408{"flow_id":45,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1239,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":107051,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo735AAEAGBb8KCAABTi7tW+lsAFBr3TT+lCLLA1AQOQhHewAA"}
 00408{"flow_id":46,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1240,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":107274,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoZg1AAEAGjzAKCAABTi7tW+ltAFASyr2N7TVCdFAQOQhHegAA"}
 01127{"flow_id":45,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1241,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":201560,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"ABoRAAACABoRAAABCABFAAJA739AAEAGA6YKCAABTi7tW+lsAFBr3TT+lCLLA1AQOQhcTgAAUE9TVCAvanNvbi8xLjMvcmVnaXN0ZXJEZXZpY2UgSFRUUC8xLjENCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vanNvbjsgY2hhcnNldD11dGYtOA0KQ29udGVudC1MZW5ndGg6IDM1OQ0KVXNlci1BZ2VudDogRGFsdmlrLzEuNi4wIChMaW51eDsgVTsgQW5kcm9pZCA0LjQuMjsgTEctRDg1NSBCdWlsZC9LVlQ0OUwuQTE0MTIwODc2NTYpDQpIb3N0OiBjcC5wdXNod29vc2guY29tDQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANCg0KeyJyZXF1ZXN0Ijp7InYiOiIyLjEiLCJ0aW1lem9uZSI6NzIwMCwiYXBwbGljYXRpb24iOiIzNjI0RC0yQkI0MCIsImRldmljZV9uYW1lIjoiUGhvbmUiLCJkZXZpY2VfdHlwZSI6IjMiLCJwdXNoX3Rva2VuIjoiQVBBOTFiSFVIUXFEQTFfVDlpREhzVGhCNFc1UnZBaFlremFoQ2t1b0VhbHVBVzkxYm5ZdFF5S04tRXZaSUNwa2doUmIyODJESDZJbzE1MWNTcFA1UGh4ME5BTGdjdHZYcjY5X2NBd3NIREpNbU92VHJCNjE5cEF1SV9UN0hNRHhGMlN0WFZpXzFlQ2tNWTg5c2FuSGg="}
-00720{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1241,"source":"webex.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":4,"flow_first_seen":1444570699096,"flow_last_seen":1444570699201,"flow_tot_l4_data_len":636,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":159,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"78.46.237.91","src_port":59756,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"cp.pushwoosh.com","url":"cp.pushwoosh.com\/json\/1.3\/registerDevice","code":0,"content_type":"","user_agent":"Dalvik\/1.6.0 (Linux; U; Android 4.4.2; LG-D855 Build\/KVT49L.A1412087656)"}}
+00731{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1241,"source":"webex.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":4,"flow_first_seen":1444570699096,"flow_last_seen":1444570699201,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":536,"flow_tot_l4_payload_len":536,"flow_avg_l4_payload_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"78.46.237.91","src_port":59756,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"cp.pushwoosh.com","url":"cp.pushwoosh.com\/json\/1.3\/registerDevice","code":0,"content_type":"","user_agent":"Dalvik\/1.6.0 (Linux; U; Android 4.4.2; LG-D855 Build\/KVT49L.A1412087656)"}}
 00410{"flow_id":45,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1242,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":201996,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA2lAABAGIdVOLu1bCggAAQBQ6WyUIssDa903FlAQ\/\/9+awAA"}
 00531{"flow_id":45,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1243,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":202178,"pkt_caplen":144,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":144,"pkt_l4_len":110,"pkt":"ABoRAAACABoRAAABCABFAACC74BAAEAGBWMKCAABTi7tW+lsAFBr3TcWlCLLA1AYOQj1VQAAeGdkd3RHcl93ZzFudyIsImxhbmd1YWdlIjoiZW4iLCJhbmRyb2lkX3BhY2thZ2UiOiJjb20uaGFhcmV0eiIsImh3aWQiOiJhMzc1ZGI1N2VmNjJkMWM1In19"}
 00410{"flow_id":45,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1244,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":202486,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA2pAABAGIdROLu1bCggAAQBQ6WyUIssDa903cFAQ\/\/9+EQAA"}
 00859{"flow_id":46,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1245,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":212081,"pkt_caplen":388,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":388,"pkt_l4_len":354,"pkt":"ABoRAAACABoRAAABCABFAAF2Zg5AAEAGjeEKCAABTi7tW+ltAFASyr2N7TVCdFAYOQhiswAAUE9TVCAvanNvbi8xLjMvYXBwbGljYXRpb25PcGVuIEhUVFAvMS4xDQpDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL2pzb247IGNoYXJzZXQ9dXRmLTgNCkNvbnRlbnQtTGVuZ3RoOiA2Nw0KVXNlci1BZ2VudDogRGFsdmlrLzEuNi4wIChMaW51eDsgVTsgQW5kcm9pZCA0LjQuMjsgTEctRDg1NSBCdWlsZC9LVlQ0OUwuQTE0MTIwODc2NTYpDQpIb3N0OiBjcC5wdXNod29vc2guY29tDQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANCg0KeyJyZXF1ZXN0Ijp7Imh3aWQiOiJhMzc1ZGI1N2VmNjJkMWM1IiwiYXBwbGljYXRpb24iOiIzNjI0RC0yQkI0MCJ9fQ=="}
-00721{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1245,"source":"webex.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":4,"flow_first_seen":1444570699101,"flow_last_seen":1444570699212,"flow_tot_l4_data_len":434,"flow_min_l4_data_len":20,"flow_max_l4_data_len":354,"flow_avg_l4_data_len":108,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"78.46.237.91","src_port":59757,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"cp.pushwoosh.com","url":"cp.pushwoosh.com\/json\/1.3\/applicationOpen","code":0,"content_type":"","user_agent":"Dalvik\/1.6.0 (Linux; U; Android 4.4.2; LG-D855 Build\/KVT49L.A1412087656)"}}
+00731{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1245,"source":"webex.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":4,"flow_first_seen":1444570699101,"flow_last_seen":1444570699212,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":334,"flow_tot_l4_payload_len":334,"flow_avg_l4_payload_len":83,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"78.46.237.91","src_port":59757,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"cp.pushwoosh.com","url":"cp.pushwoosh.com\/json\/1.3\/applicationOpen","code":0,"content_type":"","user_agent":"Dalvik\/1.6.0 (Linux; U; Android 4.4.2; LG-D855 Build\/KVT49L.A1412087656)"}}
 00411{"flow_id":46,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1246,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":212387,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA2tAABAGIdNOLu1bCggAAQBQ6W3tNUJ0Esq+21AQ\/\/9\/NAAA"}
 01078{"flow_id":45,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1247,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":445643,"pkt_caplen":551,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":551,"pkt_l4_len":517,"pkt":"ABoRAAACABoRAAABCABFAAIZA2xAABAGH+FOLu1bCggAAQBQ6WyUIssDa903cFAY\/\/\/YHgAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuNi4zDQpEYXRlOiBTdW4sIDExIE9jdCAyMDE1IDEzOjM4OjI1IEdNVA0KQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9qc29uOyBjaGFyc2V0PXV0ZjgNClRyYW5zZmVyLUVuY29kaW5nOiBjaHVua2VkDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpYLVBvd2VyZWQtQnk6IHBocERhZW1vbi8xLjAtYmV0YTMNCkFjY2Vzcy1Db250cm9sLUFsbG93LU9yaWdpbjogKg0KQWNjZXNzLUNvbnRyb2wtQWxsb3ctSGVhZGVyczogT3JpZ2luLCBYLVJlcXVlc3RlZC1XaXRoLCBDb250ZW50LVR5cGUsIEFjY2VwdA0KQWNjZXNzLUNvbnRyb2wtQWxsb3ctTWV0aG9kczogR0VULCBQT1NULCBQVVQsIE9QVElPTlMNClgtUFctQ2x1c3Rlci1Ob2RlOiBhcGktMjcNClgtUFctRnJvbnQtTm9kZTogZnJvbnQtMDYNCg0KMzkNCnsic3RhdHVzX2NvZGUiOjIwMCwic3RhdHVzX21lc3NhZ2UiOiJPSyIsInJlc3BvbnNlIjpudWxsfQ0KMA0KDQo="}
 00409{"flow_id":45,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1248,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":446597,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo74FAAEAGBbwKCAABTi7tW+lsAFBr3TdwlCLM9FAQPLg\/aAAA"}
 01078{"flow_id":46,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1249,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":469003,"pkt_caplen":551,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":551,"pkt_l4_len":517,"pkt":"ABoRAAACABoRAAABCABFAAIZA21AABAGH+BOLu1bCggAAQBQ6W3tNUJ0Esq+21AY\/\/\/ZQQAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuNi4zDQpEYXRlOiBTdW4sIDExIE9jdCAyMDE1IDEzOjM4OjI1IEdNVA0KQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9qc29uOyBjaGFyc2V0PXV0ZjgNClRyYW5zZmVyLUVuY29kaW5nOiBjaHVua2VkDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpYLVBvd2VyZWQtQnk6IHBocERhZW1vbi8xLjAtYmV0YTMNCkFjY2Vzcy1Db250cm9sLUFsbG93LU9yaWdpbjogKg0KQWNjZXNzLUNvbnRyb2wtQWxsb3ctSGVhZGVyczogT3JpZ2luLCBYLVJlcXVlc3RlZC1XaXRoLCBDb250ZW50LVR5cGUsIEFjY2VwdA0KQWNjZXNzLUNvbnRyb2wtQWxsb3ctTWV0aG9kczogR0VULCBQT1NULCBQVVQsIE9QVElPTlMNClgtUFctQ2x1c3Rlci1Ob2RlOiBhcGktMjcNClgtUFctRnJvbnQtTm9kZTogZnJvbnQtMDYNCg0KMzkNCnsic3RhdHVzX2NvZGUiOjIwMCwic3RhdHVzX21lc3NhZ2UiOiJPSyIsInJlc3BvbnNlIjpudWxsfQ0KMA0KDQo="}
 00408{"flow_id":46,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1250,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":469610,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoZg9AAEAGjy4KCAABTi7tW+ltAFASyr7b7TVEZVAQPLhAiwAA"}
 02277{"flow_id":44,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1251,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":636393,"pkt_caplen":1436,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1436,"pkt_l4_len":1402,"pkt":"ABoRAAACABoRAAABCABFAAWOA25AABAGAPU28SAOCggAAQG7tIMuvh650UHiIFAY\/\/9jGQAAFgMBADUCAAAxAwH\/zw1+R1s0KR\/IbYZc2PfwME+dJgV6XwqJg7QSDec4RwAABAAACf8BAAEAACMAABYDARUwCwAVLAAVKQAFXzCCBVswggRDoAMCAQICEQCdQkMK1N5I61mRiSe3ehiVMA0GCSqGSIb3DQEBCwUAMIGQMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDE2MDQGA1UEAxMtQ09NT0RPIFJTQSBEb21haW4gVmFsaWRhdGlvbiBTZWN1cmUgU2VydmVyIENBMB4XDTE1MDExNDAwMDAwMFoXDTIwMDExMzIzNTk1OVowXjEhMB8GA1UECxMYRG9tYWluIENvbnRyb2wgVmFsaWRhdGVkMR0wGwYDVQQLExRQb3NpdGl2ZVNTTCBXaWxkY2FyZDEaMBgGA1UEAxQRKi5jcml0dGVyY2lzbS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAA3Xo3VrVGoNjyfTAnteqZvMRorFsBcUmNRAU6O+fIOFTL2HBerzVacL6iN\/3e7tpoDj2G0w99h2ljpFbJOOs\/5LDXbOzMiiK8em0O4stpmdJ9XRPPsl84S9c28oFVY\/CA7mcBU9DG82SqcJZfVXMNJurlcwFqncer+B2cLhO1Q9vNeDwrd\/08ONxH63Sc\/9e7XYbjGiq6U9Xfe2sGRd48e5GR+\/P5VKk5mkWAf53\/POZofrKGaVDhb8CMN4vf32VkZ40mYSlZEqJ3t2185CGnvcQKrLsr1Vyfu+NpjHbnnm6UL5ga+eAf8pLU8s43gOdvEzjgjDHC3KGqzfgebXLAgMBAAGjggHfMIIB2zAfBgNVHSMEGDAWgBSQr2o6lFoL2JDqElZz30O0Oija5zAdBgNVHQ4EFgQU4uzEA450c3G1fzDal95D9y1zepQwDgYDVR0PAQH\/BAQDAgWgMAwGA1UdEwEB\/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCME8GA1UdIARIMEYwOgYLKwYBBAGyMQECAgcwKzApBggrBgEFBQcCARYdaHR0cHM6Ly9zZWN1cmUuY29tb2RvLmNvbS9DUFMwCAYGZ4EMAQIBMFQGA1UdHwRNMEswSaBHoEWGQ2h0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET1JTQURvbWFpblZhbGlkYXRpb25TZWN1cmVTZXJ2ZXJDQS5jcmwwgYUGCCsGAQUFBwEBBHkwdzBPBggrBgEFBQcwAoZDaHR0cDovL2NydC5jb21vZG9jYS5jb20vQ09NT0RPUlNBRG9tYWluVmFsaWRhdGlvblNlY3VyZVNlcnZlckNBLmNydDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMC0GA1UdEQQmMCSCESouY3JpdHRlcmNpc20uY29tgg9jcml0dGVyY2lzbS5jb20wDQYJKoZIhvcNAQELBQADggEBAGq+UkpuPRjjFDs3mpC\/SrlpIrR8BTQFY+VlXzJ3FX8SYeKu4JQrG5GVN2SPnUZPHTl6bX8+4KbBOefRuHnFyExESoW58HeEYPo2e\/W8kKD0oCcIQsoegVwoq4oYnrSDEc+UOu15CKOMua55zVMl\/zRWRhX6eCTgJerJ43IB5UT+hQVZ+iWm7VBfNbh8pq4a59nca5ROC\/fSVCgTnwYTaD3QU4MXaIj\/7sFjaL8IgbDAVIFM\/bdNLqIMYozSbFQ="}
-00795{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1251,"source":"webex.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":6,"flow_first_seen":1444570699074,"flow_last_seen":1444570699636,"flow_tot_l4_data_len":1738,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1402,"flow_avg_l4_data_len":289,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.241.32.14","src_port":46211,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"api.crittercism.com","ja3":"54ae5fcb0159e2ddf6a50e149221c7c7","ja3s":"c800cea031c10ffe47e1d72c9264577a","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
+00806{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1251,"source":"webex.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":6,"flow_first_seen":1444570699074,"flow_last_seen":1444570699636,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1382,"flow_tot_l4_payload_len":1598,"flow_avg_l4_payload_len":266,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.241.32.14","src_port":46211,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"api.crittercism.com","ja3":"54ae5fcb0159e2ddf6a50e149221c7c7","ja3s":"c800cea031c10ffe47e1d72c9264577a","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
 00408{"flow_id":44,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1252,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":636941,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoOj1AAEAGn4sKCAABNvEgDrSDAbvRQeIgLr4kH1AQQMhRhgAA"}
 00502{"flow_id":44,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1253,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":639844,"pkt_caplen":120,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":120,"pkt_l4_len":86,"pkt":"ABoRAAACABoRAAABCABFAABqA29AABAGBhg28SAOCggAAQG7tIMuviQf0UHiIFAY\/\/8nAwAALf4SsU2uf+VDXLMYtuAd7dAVY\/\/f85YQR3m3nhkc31shlW7dCqbyxdX2SoNIiptQr2Xh1S2KleiqoE0ylHUWfmYp"}
 00408{"flow_id":44,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1254,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":640368,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoOj5AAEAGn4oKCAABNvEgDrSDAbvRQeIgLr4kYVAQQMhRRAAA"}
@@ -670,22 +670,22 @@
 02282{"flow_id":44,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1257,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":643002,"pkt_caplen":1436,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1436,"pkt_l4_len":1402,"pkt":"ABoRAAACABoRAAABCABFAAWOA3FAABAGAPI28SAOCggAAQG7tIMuvioJ0UHiIFAY\/\/\/EHAAAQHuIWe0O3azSd4I03AaVAtiQ+S3qN9UaYNBnINfYQgtFr4Jo3t1mJDeQKZQZRhkluIDXy9SGKGpEcCYjYqmfhm+\/upBw0lZ3hXjv6iWpF85QcowAOqrj22M0n\/gGcQHigiDU\/m+9sQAFeDCCBXQwggRcoAMCAQICECdm7lbrSfOOq9dwovyE3iIwDQYJKoZIhvcNAQEMBQAwbzELMAkGA1UEBhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5hbCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9vdDAeFw0wMDA1MzAxMDQ4MzhaFw0yMDA1MzAxMDQ4MzhaMIGFMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDErMCkGA1UEAxMiQ09NT0RPIFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJHoVJLSClaxrA0k3cXPRGd0mSs3o30jcABxvFPfxPoqEo9LfxBWvZ9wcrdhf8lLDxenPeOwBGHu\/xGXx\/SGPgr6Plz5k+Y0etkUa+ecs4Wggnp2r3GQ1+z9DfqcbPrfsIL0FH75vsSmL09\/mX+1\/GdDcr0MANaJ62ss0+2PmBwUq37l42782KjkkiTaQ2tiuFX96sG8bLaL8w6NmuSbbGmZ+HhIMEXVreENPEVg\/DKWUSe8Z8PKLrZr6kbHxyCgsR9l3kgIuqROqfKDRjeE6+jMgUhDZ05yKptcvUwbKIpcInu0q5jZ7uBRg8MJRk5tPpn6lRfafDNXQTyNUe0LtlyvLGMa31fIP7zpXcSbr0WZ4qNaJLS6qVY9z2+q\/0lYvvCo\/\/S4rek3+7q49As6+ehDQh6J2ITLE\/HZu+GJYLiMKFasFB2cCudx688O3T2plqFIvTz3r7UNIkzAEYHsVjv206LiW7eyBCJSlYCTaeiOTGXxkQMtcHQC6otnFSlpUgK7199QalVGv6CjKGF\/cNDDoqosIapHziicBkV2v4IYJ7TVrrTLUOZr9EyGcTDppt8WhuDY\/0Dd+9BCiH+jMzouXB5BEYFjzhhxayvspoq3MVw6akfgw3lZ1iAar\/JqmKpyvFdK0kuduxD8sExB5e0dPV4onZzMv7NR2qdH5YRTAgMBAAGjgfQwgfEwHwYDVR0jBBgwFoAUrb2YejS0Jvf6xCZU7wO94CTLVBowHQYDVR0OBBYEFLuvfgI9+qbxPISOre44mOzZMjLUMA4GA1UdDwEB\/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH\/MBEGA1UdIAQKMAgwBgYEVR0gADBEBgNVHR8EPTA7MDmgN6A1hjNodHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vQWRkVHJ1c3RFeHRlcm5hbENBUm9vdC5jcmwwNQYIKwYBBQUHAQEEKTAnMCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3QuY29tMA0GCSqGSIb3DQEBDAUAA4IBAQBkv4PxX5qF0M24oSlXDeha99HpPvJ2BG7xUnC7Hjz\/TQ10asyBgiXTw6AqXUz1uouhbcRUCXXH4ycOXYR5N0ATd\/W0rBzQO6sXEtbvNBh+K+l506tXRQyvKPrQ2+VQlYi734VXaX2S2FLKc4G\/HPPmuG5mEQWzHpQtf5GVklnxTM6jkXE="}
 00409{"flow_id":44,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1258,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":643521,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoOkBAAEAGn4gKCAABNvEgDrSDAbvRQeIgLr4vb1AQWoAsfgAA"}
 02053{"flow_id":44,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1259,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":643969,"pkt_caplen":1272,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1272,"pkt_l4_len":1238,"pkt":"ABoRAAACABoRAAABCABFAATqA3JAABAGAZU28SAOCggAAQG7tIMuvi9v0UHiIFAY\/\/8ORAAATHxHDDsLGfahsWyGPlyqxC6Cy\/kHlrpITZDylMipc6LrBnsjnd6i801Vn3phRZgYaMdeQGsj9Xl674y1a4u3b0b0e\/E9SwTYk4BZWuBBJB2yjxVgWEfb725G\/RX12V+as9vYuORAs82XOa6Fux2OvNyHm9Gm7\/E7bxA4bwAEOjCCBDYwggMeoAMCAQICAQEwDQYJKoZIhvcNAQEFBQAwbzELMAkGA1UEBhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5hbCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9vdDAeFw0wMDA1MzAxMDQ4MzhaFw0yMDA1MzAxMDQ4MzhaMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRUcnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsxIjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC39xoz5vIABC054E5b7R+8bA\/Ntfojts7emxEzl6QpTH2Tn71KvJPtAxrjj8\/lbVBa1pcplFqAsEl62y6V\/bjKvzc4LR4+kUGtcFbH8E8\/6DKedMrIkFTpxl8PeJ2aQDwOrGGqXhSPnoehalDc15pOrwWzpnGUnHGzUGAKxxOdOAeGAqjpqGkmGJCrTLBPI6s6T4TY386f4Wlvu9dC12tE5Met7m1BX3JacQg3s3llpFmglDf3AC8NwpJy2tA4ctsUqEXEXSp9t7TWxO6szRNEt8kr3UMAJfphuWlqWCMRt6czj1Z1WfXNKddGtworZbbTQm8Vsrh7++\/pXVPVNFonAgMBAAGjgdwwgdkwHQYDVR0OBBYEFK29mHo0tCb3+sQmVO8DveAky1QaMAsGA1UdDwQEAwIBBjAPBgNVHRMBAf8EBTADAQH\/MIGZBgNVHSMEgZEwgY6AFK29mHo0tCb3+sQmVO8DveAky1QaoXOkcTBvMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290ggEBMA0GCSqGSIb3DQEBBQUAA4IBAQCwm+CFJcLWI+IPlgaSnUGYnNmEeYHZHlsUByM2ZY+w2He7rEFsR2CDUbD5Mj3n\/PYmE8eAFqW\/WvyHz3h5iSGa4kwHCoY1vPLeUcTSlrfcfk7ucP0cOesMAlEULY69FuDB30Z15ySt7PRCtIWTcBBnup0GNUoY0yt6zFFCoXpj0ea7ocUrwja+Ew3mvWN+eXunCQ1Aq2rdj4rD9vaMGkIFUdRF9Z+nYiFoFSBDPJnnfL0k2KmRF3OIP1YbMTgYtHEPms3IDp6OLhvhjJiDyx8x8URMxgRzSXZgD8f4vReAay7pzEwOWpp5DyAKLtWeYyYeVZKU2IIXWnvQvMePToYEFgMBAAQOAAAA"}
-01134{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1259,"source":"webex.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":14,"flow_first_seen":1444570699074,"flow_last_seen":1444570699643,"flow_tot_l4_data_len":6012,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1468,"flow_avg_l4_data_len":429,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.241.32.14","src_port":46211,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"api.crittercism.com","server_names":"*.crittercism.com,crittercism.com","ja3":"54ae5fcb0159e2ddf6a50e149221c7c7","ja3s":"c800cea031c10ffe47e1d72c9264577a","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5","issuerDN":"C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA","issuerDN":"OU=Domain Control Validated, OU=PositiveSSL Wildcard, CN=*.crittercism.com","fingerprint":"68:8B:FC:77:1E:CA:80:33:0C:A9:0E:29:A6:E4:0D:FC:3A:AE:43:18"}}
+01145{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1259,"source":"webex.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":14,"flow_first_seen":1444570699074,"flow_last_seen":1444570699643,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":5712,"flow_avg_l4_payload_len":408,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.241.32.14","src_port":46211,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"api.crittercism.com","server_names":"*.crittercism.com,crittercism.com","ja3":"54ae5fcb0159e2ddf6a50e149221c7c7","ja3s":"c800cea031c10ffe47e1d72c9264577a","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5","issuerDN":"C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA","issuerDN":"OU=Domain Control Validated, OU=PositiveSSL Wildcard, CN=*.crittercism.com","fingerprint":"68:8B:FC:77:1E:CA:80:33:0C:A9:0E:29:A6:E4:0D:FC:3A:AE:43:18"}}
 00409{"flow_id":44,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1260,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":644152,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoOkFAAEAGn4cKCAABNvEgDrSDAbvRQeIgLr40MVAQZdAcbAAA"}
 00408{"flow_id":34,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1263,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":864721,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoO9tAAEAGNl4KCAABUEpuRILnAbv7vABcBEQAfVAROQgouAAA"}
 00410{"flow_id":34,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1264,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":864930,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA3RAABAGnsVQSm5ECggAAQG7gucERAB9+7wAXVAQ\/\/9hwAAA"}
 00410{"flow_id":34,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1265,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":865096,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA3VAABAGnsRQSm5ECggAAQG7gucERAB9+7wAXVAR\/\/9hvwAA"}
 00442{"flow_id":35,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1266,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":915340,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"ABoRAAACABoRAAABCABFAAA\/smlAAEAGv7gKCAABUEpuRILoAbtZhnl8pnmKQlAYPLgY5AAAFQMBABJgV68LS6YLMRfC0ydf82IUCbU="}
 00411{"flow_id":35,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1267,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":915568,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA3ZAABAGnsNQSm5ECggAAQG7guimeYpCWYZ5k1AQ\/\/9exAAA"}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1271,"source":"webex.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_first_seen":1444570699916,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33551,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1271,"source":"webex.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_first_seen":1444570699916,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33551,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":47,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1271,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":916083,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8M+lAAEAGPjwKCAABUEpuRIMPAbsBc+gmAAAAAKACOQj74QAAAgQFtAQCCAoATNvPAAAAAAEDAwY="}
 00411{"flow_id":47,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1272,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":917636,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA3lAABAGnsBQSm5ECggAAQG7gw\/+jBfZAXPoJ1AS\/\/9icAAA"}
 00409{"flow_id":47,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1273,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":917753,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoM+pAAEAGPk8KCAABUEpuRIMPAbsBc+gn\/owX2lAQOQgpaQAA"}
 00705{"flow_id":47,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1274,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":968023,"pkt_caplen":270,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":270,"pkt_l4_len":236,"pkt":"ABoRAAACABoRAAABCABFAAEAM+tAAEAGPXYKCAABUEpuRIMPAbsBc+gn\/owX2lAYOQhMegAAFgMBANMBAADPAwFWGmZL3uOMxVToaE\/p7S\/f3l0TPSF72MmK+MgBnG9FXiBKAAAAOC7EJ2lJH7mDuj6DaIBXRCqOxY\/AVNJYEqB0IgBGAAQABQAvADXAAsAEwAXADMAOwA\/AB8AJwArAEcATwBQAMwA5ADIAOAAKwAPADcAIwBIAFgATAAkAFQASAAMACAAUABEA\/wEAAEAACwAEAwABAgAKADQAMgAOAA0AGQALAAwAGAAJAAoAFgAXAAgABgAHABQAFQAEAAUAEgATAAEAAgADAA8AEAAR"}
-00719{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1274,"source":"webex.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":4,"flow_first_seen":1444570699916,"flow_last_seen":1444570699968,"flow_tot_l4_data_len":316,"flow_min_l4_data_len":20,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":79,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33551,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00730{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1274,"source":"webex.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":4,"flow_first_seen":1444570699916,"flow_last_seen":1444570699968,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":216,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33551,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00412{"flow_id":47,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1275,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570699,"pkt_ts_usec":968436,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA3pAABAGnr9QSm5ECggAAQG7gw\/+jBfaAXPo\/1AQ\/\/9hmQAA"}
 00589{"flow_id":47,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1282,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":123146,"pkt_caplen":183,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":183,"pkt_l4_len":149,"pkt":"ABoRAAACABoRAAABCABFAACpA35AABAGnjpQSm5ECggAAQG7gw\/+jBfaAXPo\/1AY\/\/+wJAAAFgMBAFECAABNAwFWGmZs4HEvkRp5CPDyrBD1d5FN0QkfcyNSvyMimX2MYiBKAAAAOC7EJ2lJH7mDuj6DaIBXRCqOxY\/AVNJYEqB0IgAEAAAF\/wEAAQAUAwEAAQEWAwEAIHCqMV4qXgoAjYY8C2uGvdRpugsaOBkKyyR+wqee4vc5"}
-00760{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1282,"source":"webex.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":6,"flow_first_seen":1444570699916,"flow_last_seen":1444570700123,"flow_tot_l4_data_len":485,"flow_min_l4_data_len":20,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":80,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33551,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6dfe5eb347aa509fc445e5628d467a2b","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
+00771{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1282,"source":"webex.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":6,"flow_first_seen":1444570699916,"flow_last_seen":1444570700123,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":216,"flow_tot_l4_payload_len":345,"flow_avg_l4_payload_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33551,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6dfe5eb347aa509fc445e5628d467a2b","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
 00410{"flow_id":47,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1283,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":123390,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoM+xAAEAGPk0KCAABUEpuRIMPAbsBc+j\/\/owYW1AQPLgkYAAA"}
 00472{"flow_id":47,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1284,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":174042,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":97,"pkt_l4_len":63,"pkt":"ABoRAAACABoRAAABCABFAABTM+1AAEAGPiEKCAABUEpuRIMPAbsBc+j\/\/owYW1AYPLii3QAAFAMBAAEBFgMBACD\/OJPkF4mrRi\/eVp7fdXJ6ptt9f9Xyrl80jGyqqpclXg=="}
 00411{"flow_id":47,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1285,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":174449,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA39AABAGnrpQSm5ECggAAQG7gw\/+jBhbAXPpKlAQ\/\/9g7QAA"}
@@ -695,24 +695,24 @@
 00412{"flow_id":47,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1289,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":175680,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA4FAABAGnrhQSm5ECggAAQG7gw\/+jBhbAXPrmVAQ\/\/9efgAA"}
 00875{"flow_id":47,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1290,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":427964,"pkt_caplen":396,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":396,"pkt_l4_len":362,"pkt":"ABoRAAACABoRAAABCABFAAF+A4JAABAGnWFQSm5ECggAAQG7gw\/+jBhbAXPrmVAY\/\/\/EXwAAFwMBAQIK4F6naWXIdaW7I8Z58oqr4pe2aGe1khnn8cReqBpHVVeIRWJgqEdVTEv70\/At78M3MinIEB4V2DdA1+GtZMig4vQvEUrRCRgn+IK5uD2tYZpQdkXPY8l+HHTYDzw7s2WhMTVlDu61pqkG5cPIBlrdh2DGx10lkgxqd2I19aauAuLJp5MnLHEEKDOM+pMiGMiisODAMF8YSBSarxawY5qMg4D1VtwD28kRBv1uweOCrytT7E3Yn6XfLzbcBA8F2K2+Rip2TtVqoW0R1CPB7U7kXDK3wEghFEbW2tKTzMiQ6GTMXnvFlwH4EkJGyDXZwtwvNblo3aEBHFM52kiqB9sT6skXAwEASmNURClRk13EjF96Y9CTxyDn9xd2qeHhNjzFJbBfkblji5C0fbT5UIkvSSHkXM\/saSoul2\/swhTjbFKe+FIqNDIwRG19wgN4uriR"}
 00444{"flow_id":47,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1295,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":459128,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"ABoRAAACABoRAAABCABFAAA\/M\/BAAEAGPjIKCAABUEpuRIMPAbsBc+uZ\/owZsVAYQOj7XQAAFQMBABKp7I2jaOZ4+TM20Luobgcl8wI="}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1302,"source":"webex.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1444570700561,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33553,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1302,"source":"webex.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1444570700561,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33553,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":48,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1302,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":561150,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8d7ZAAEAG+m4KCAABUEpuRIMRAbsN6aumAAAAAKACOQgrqQAAAgQFtAQCCAoATNwQAAAAAAEDAwY="}
 00410{"flow_id":48,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1303,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":563231,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA4lAABAGnrBQSm5ECggAAQG7gxHyFlRZDemrp1AS\/\/9ibgAA"}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1304,"source":"webex.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1444570700563,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33554,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1304,"source":"webex.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1444570700563,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33554,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":49,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1304,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":563368,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8CyVAAEAGZwAKCAABUEpuRIMSAbsmf9c3AAAAAKACOQjnfgAAAgQFtAQCCAoATNwSAAAAAAEDAwY="}
 00411{"flow_id":49,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1305,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":565210,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA4pAABAGnq9QSm5ECggAAQG7gxLZgCjIJn\/XOFAS\/\/9ibQAA"}
 00408{"flow_id":48,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1306,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":565371,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAod7dAAEAG+oEKCAABUEpuRIMRAbsN6aun8hZUWlAQOQgpZwAA"}
 00408{"flow_id":49,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1307,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":565470,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoCyZAAEAGZxMKCAABUEpuRIMSAbsmf9c42YAoyVAQOQgpZgAA"}
 00703{"flow_id":48,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1308,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":615658,"pkt_caplen":270,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":270,"pkt_l4_len":236,"pkt":"ABoRAAACABoRAAABCABFAAEAd7hAAEAG+agKCAABUEpuRIMRAbsN6aun8hZUWlAYOQiQtAAAFgMBANMBAADPAwFWGmZMED4A5Nh17gO7bSCRkq5lMHNAG46Z4njZWjB\/3CBKAAAAOC7EJ2lJH7mDuj6DaIBXRCqOxY\/AVNJYEqB0IgBGAAQABQAvADXAAsAEwAXADMAOwA\/AB8AJwArAEcATwBQAMwA5ADIAOAAKwAPADcAIwBIAFgATAAkAFQASAAMACAAUABEA\/wEAAEAACwAEAwABAgAKADQAMgAOAA0AGQALAAwAGAAJAAoAFgAXAAgABgAHABQAFQAEAAUAEgATAAEAAgADAA8AEAAR"}
-00719{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1308,"source":"webex.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":4,"flow_first_seen":1444570700561,"flow_last_seen":1444570700615,"flow_tot_l4_data_len":316,"flow_min_l4_data_len":20,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":79,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33553,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00730{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1308,"source":"webex.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":4,"flow_first_seen":1444570700561,"flow_last_seen":1444570700615,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":216,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33553,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00410{"flow_id":48,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1309,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":615826,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA4tAABAGnq5QSm5ECggAAQG7gxHyFlRaDemsf1AQ\/\/9hlwAA"}
 00703{"flow_id":49,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1310,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":616161,"pkt_caplen":270,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":270,"pkt_l4_len":236,"pkt":"ABoRAAACABoRAAABCABFAAEACydAAEAGZjoKCAABUEpuRIMSAbsmf9c42YAoyVAYOQhPIgAAFgMBANMBAADPAwFWGmZMUiXWlfiAkM3TLt+8m\/rKGRmXBLOAMg7wv4yATyBKAAAAOC7EJ2lJH7mDuj6DaIBXRCqOxY\/AVNJYEqB0IgBGAAQABQAvADXAAsAEwAXADMAOwA\/AB8AJwArAEcATwBQAMwA5ADIAOAAKwAPADcAIwBIAFgATAAkAFQASAAMACAAUABEA\/wEAAEAACwAEAwABAgAKADQAMgAOAA0AGQALAAwAGAAJAAoAFgAXAAgABgAHABQAFQAEAAUAEgATAAEAAgADAA8AEAAR"}
-00719{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1310,"source":"webex.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":4,"flow_first_seen":1444570700563,"flow_last_seen":1444570700616,"flow_tot_l4_data_len":316,"flow_min_l4_data_len":20,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":79,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33554,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00730{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1310,"source":"webex.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":4,"flow_first_seen":1444570700563,"flow_last_seen":1444570700616,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":216,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33554,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00411{"flow_id":49,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1311,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":616245,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA4xAABAGnq1QSm5ECggAAQG7gxLZgCjJJn\/YEFAQ\/\/9hlgAA"}
 00587{"flow_id":48,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1312,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":767052,"pkt_caplen":183,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":183,"pkt_l4_len":149,"pkt":"ABoRAAACABoRAAABCABFAACpA41AABAGnitQSm5ECggAAQG7gxHyFlRaDemsf1AY\/\/9HpQAAFgMBAFECAABNAwFWGmZsTnqkZUSl5NRIyBNUjvkakGhXOc4JYCEZKcugqyBKAAAAOC7EJ2lJH7mDuj6DaIBXRCqOxY\/AVNJYEqB0IgAEAAAF\/wEAAQAUAwEAAQEWAwEAINDUobyLhy7qsYKa7pQfKNg2A0RpIAZr2PLAT+0SGUWY"}
-00760{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1312,"source":"webex.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":6,"flow_first_seen":1444570700561,"flow_last_seen":1444570700767,"flow_tot_l4_data_len":485,"flow_min_l4_data_len":20,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":80,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33553,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6dfe5eb347aa509fc445e5628d467a2b","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
+00771{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1312,"source":"webex.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":6,"flow_first_seen":1444570700561,"flow_last_seen":1444570700767,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":216,"flow_tot_l4_payload_len":345,"flow_avg_l4_payload_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33553,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6dfe5eb347aa509fc445e5628d467a2b","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
 00590{"flow_id":49,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1313,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":767240,"pkt_caplen":183,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":183,"pkt_l4_len":149,"pkt":"ABoRAAACABoRAAABCABFAACpA45AABAGnipQSm5ECggAAQG7gxLZgCjJJn\/YEFAY\/\/\/8lwAAFgMBAFECAABNAwFWGmZsSZTLsQmRXOA9BIEe6tiHL133I9vGXpYkt5mn6yBKAAAAOC7EJ2lJH7mDuj6DaIBXRCqOxY\/AVNJYEqB0IgAEAAAF\/wEAAQAUAwEAAQEWAwEAIMu5\/8GpZLkiWJOsiQMnmQk6hTa1OPQQyiJKhIZUJS16"}
-00760{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1313,"source":"webex.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":6,"flow_first_seen":1444570700563,"flow_last_seen":1444570700767,"flow_tot_l4_data_len":485,"flow_min_l4_data_len":20,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":80,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33554,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6dfe5eb347aa509fc445e5628d467a2b","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
+00771{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1313,"source":"webex.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":6,"flow_first_seen":1444570700563,"flow_last_seen":1444570700767,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":216,"flow_tot_l4_payload_len":345,"flow_avg_l4_payload_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33554,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6dfe5eb347aa509fc445e5628d467a2b","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
 00409{"flow_id":48,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1314,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":767503,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAod7lAAEAG+n8KCAABUEpuRIMRAbsN6ax\/8hZU21AQPLgkXgAA"}
 00408{"flow_id":49,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1315,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":767565,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoCyhAAEAGZxEKCAABUEpuRIMSAbsmf9gQ2YApSlAQPLgkXQAA"}
 00471{"flow_id":48,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1316,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570700,"pkt_ts_usec":817960,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":97,"pkt_l4_len":63,"pkt":"ABoRAAACABoRAAABCABFAABTd7pAAEAG+lMKCAABUEpuRIMRAbsN6ax\/8hZU21AYPLhIQQAAFAMBAAEBFgMBACD134W\/9WTwbFl0+qIZUJuaE\/5h61bUXkkGmkRjO5HGhQ=="}
@@ -736,29 +736,29 @@
 00409{"flow_id":43,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1404,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570709,"pkt_ts_usec":696086,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo02xAAEAGOU8KCAABPm3lnsp\/AbubwQuMZD71MFAROQh7vwAA"}
 00410{"flow_id":43,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1405,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570709,"pkt_ts_usec":696919,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA7hAABAGOQQ+beWeCggAAQG7yn9kPvUwm8ELjVAQ\/\/+0xwAA"}
 00410{"flow_id":43,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1406,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570709,"pkt_ts_usec":697460,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA7lAABAGOQM+beWeCggAAQG7yn9kPvUwm8ELjVAR\/\/+0xgAA"}
-00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1408,"source":"webex.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1444570712008,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55687,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1408,"source":"webex.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1444570712008,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55687,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00434{"flow_id":50,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1408,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570712,"pkt_ts_usec":8198,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8BPxAAEAGfVYKCAABrfMAbtmHAbtwYOR3AAAAAKACOQhFnAAAAgQFtAQCCAoATOCLAAAAAAEDAwY="}
 00409{"flow_id":50,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1409,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570712,"pkt_ts_usec":12584,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA7pAABAGrqyt8wBuCggAAQG72YePnxuIcGDkeFAS\/\/8cJQAA"}
 00407{"flow_id":50,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1410,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570712,"pkt_ts_usec":13209,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoBP1AAEAGfWkKCAABrfMAbtmHAbtwYOR4j58biVAQOQjjHQAA"}
 00665{"flow_id":50,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1411,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570712,"pkt_ts_usec":16521,"pkt_caplen":241,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":241,"pkt_l4_len":207,"pkt":"ABoRAAACABoRAAABCABFAADjBP5AAEAGfK0KCAABrfMAbtmHAbtwYOR4j58biVAYOQiiYgAAFgMBALYBAACyAwGU3Odz\/vfsiokT464lK0c\/\/ta9zx7QCCoXHtBhwwrAhAAAWMAUwAoAOQA4ADcANsAPwAUANcATwAkAMwAyADEAMACaAJkAmACXwA7ABAAvAJbAEcAHwAzAAgAFAATAEsAIABYAEwAQAA3ADcADAAoAFQASAA8ADAAJAP8BAAAxAAsABAMAAQIACgAcABoAFwAZABwAGwAYABoAFgAOAA0ACwAMAAkACgAjAAAADwABAQ=="}
-00733{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1411,"source":"webex.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":4,"flow_first_seen":1444570712008,"flow_last_seen":1444570712016,"flow_tot_l4_data_len":287,"flow_min_l4_data_len":20,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55687,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00744{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1411,"source":"webex.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":4,"flow_first_seen":1444570712008,"flow_last_seen":1444570712016,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":187,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55687,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00409{"flow_id":50,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1412,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570712,"pkt_ts_usec":16964,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA7tAABAGrqut8wBuCggAAQG72YePnxuJcGDlM1AQ\/\/8bawAA"}
 00442{"flow_id":49,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1414,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570713,"pkt_ts_usec":705974,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"ABoRAAACABoRAAABCABFAAA\/CyxAAEAGZvYKCAABUEpuRIMSAbsmf9p02YApSlAYPLgiMwAAFQMBABLzO3uKwLUa5N0D96wcS3I69kA="}
 00412{"flow_id":49,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1415,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570713,"pkt_ts_usec":706775,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA7xAABAGnn1QSm5ECggAAQG7gxLZgClKJn\/ai1AQ\/\/9emgAA"}
 05679{"flow_id":50,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1416,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570713,"pkt_ts_usec":707778,"pkt_caplen":3961,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3961,"pkt_l4_len":3927,"pkt":"ABoRAAACABoRAAABCABFAA9rA71AABAGn2at8wBuCggAAQG72YePnxuJcGDlM1AY\/\/8jQQAAFgMBDz4CAAAtAwFWGmJDfb\/\/PzlIsaqgIFL8HT\/M2cJoPrWmeJ5ySmjuzwAANQAABf8BAAEACwAPBQAPAgAE6TCCBOUwggPNoAMCAQICECl0ianUHkm+YfeBaUbmIfMwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDAeFw0xNTA0MTAwMDAwMDBaFw0xODA0MTAyMzU5NTlaMHcxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMREwDwYDVQQHDAhTYW4gSm9zZTEcMBoGA1UECgwTQ2lzY28gU3lzdGVtcywgSW5jLjEMMAoGA1UECwwDQ1NHMRQwEgYDVQQDDAsqLndlYmV4LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ14yGFLwwhhZyxegl+wYbyZZp5q4NComRXAz+k8ibNrPp+x46qW\/Dt++MdupJ8y605K5KTQVb24unmPF+pZq1par5YBKMjJrJTW2aAI1MtQvRzSDCNhdWyxiP6SkVBm6ZOcLwL+kijn\/nCot5orO1NrHHFG\/HBcSk1aaetoitrjs5BWuMxdYuIZvzSoyViVbo\/w\/LUKXdD0rlOcFmOxtcf+VKb7w1eyku07Jp94m\/\/ILLQS\/jy7ymRyfGFnPLtNqBmUKFg+uAD7JcHZiy8g6quVEhEZdm3O+tUR2wYZ5in9yKcrxqoHwhW0O4X2\/rJ4mNDvikIgaWiSNW7eIoh0NWECAwEAAaOCAWQwggFgMBYGA1UdEQQPMA2CCyoud2ViZXguY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH\/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYDVR0jBBgwFoAUX2DPYZBV34RDFIpgKrL1evRDGO8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Muc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAFNF1YB0fCkEyxRc1VQO7NUZao+PnZuavjgeTnyTKmHl\/4Zxh1Xg\/M\/f\/RHSrGrgUW2xaSZN\/Dwt2hqMtIi\/b\/AgOFeqNKmMxH3nWxf6f1Lr7QoTvApLQGqjeuIT3U6AiRMt4Ksgfx7+1Vbil1AaILo859VgXSMgVJTv4QpUpzg\/EKtUqPwMwq8PvwoTjlewyOt9YbCxNTO91JkKsYuwm7uUeU7Fx+r+rP+wgDwYVbbsUwQXAbj7QOj3dkPLzn+gcrhK1ZlgFf7Ti34xrqj7jNiaMc0dYh\/Ns3KCHMTs5rVCGLIk7lEgovwLDbJtuuQTlvaHoeZIGVPqROi5Bl\/WxAgAFPDCCBTgwggQgoAMCAQICEFE\/uXQ4cLc0QEGNMJMGmf8wDQYJKoZIhvcNAQELBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MB4XDTEzMTAzMTAwMDAwMFoXDTIzMTAzMDIzNTk1OVowfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLYBcocdC21F1Y5xUpSCZboS9gM8WifmkIoYsOlMFN+VRGCWwN6DS\/heQTJtJZ3GYEBlFn5vPd6mSeCLbeD3Vonf7IDepxTJelIH0ZPyJ0p+L55Vvb3\/dk6aNqLS4IzQRLDyDzM1pZ6hCEaIgQDJxeLHGhhkw8OUYAzHbS1zut+0GKs7rN7AXTvaTXrytU9qe6XmMqNqkQOJZlKFZakzm0CVB8qaibiBjpjSKy0TNF1k1D\/Ey\/W2uHGGPWfySVd8wA63iZNtCkJzQ89I28WSoEW+\/KDEMO41thVMj3xvQ+9jFKVShaXelIhY3UvFvnEZr71tQnY\/ycAzUR8b0s\/sPcCAwEAAaOCAWMwggFfMBIGA1UdEwEB\/wQIMAYBAf8CAQAwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNiLmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vczIuc3ltY2IuY29tMGsGA1UdIARkMGIwYAYKYIZIAYb4RQEHNjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMB8GA1UdIwQYMBaAFH\/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBCwUAA4IBAQBelFZJ3Y4tZfXBNlG2A+PannMZ8h9Zq1h+bCYFLPqB11wjFyIsN5P3huyF5rCj\/R\/iMqhFb+HZ+7mv0nCgMkJlv4T+FiqPP8Wm1qOTfUPpdCGRNSj0Y+ku7ff1XH9LmrUg6Qq94EUQDBSUml2l40uR6CSbRkBl9CJyzZn4iBH183\/mM4LmqMV+\/tAI4iVYCHFo5s2i5hTeTlIkLf3leRNT514vLU0bbUAVUiv3h4l4EoFu2U2qLXjUwiw9CF+HkZ4fDrDeMFJkhomqnWacDnYMgPJ02Cr4uDrO19YPEb5rqxT1vUGgImOJ8boPbyljZi0\/rIxyxfvH5NQP8jtPjCnHAATUMIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ\/XxrcgxiV0i6CqqpkKzj\/i5Vbext0uz\/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6\/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn\/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4\/VBEnkjWNHiDxpg8v+R70rfk\/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10\/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH\/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB\/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW\/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3\/DgAAAA=="}
-01112{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1416,"source":"webex.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":6,"flow_first_seen":1444570712008,"flow_last_seen":1444570713707,"flow_tot_l4_data_len":4234,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":705,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55687,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
-00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1425,"source":"webex.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1444570713719,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33559,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+01123{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1416,"source":"webex.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":6,"flow_first_seen":1444570712008,"flow_last_seen":1444570713707,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":4094,"flow_avg_l4_payload_len":682,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55687,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1425,"source":"webex.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1444570713719,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33559,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00437{"flow_id":51,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1425,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570713,"pkt_ts_usec":719932,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8m55AAEAG1oYKCAABUEpuRIMXAbuTJntGAAAAAKACOQjR\/QAAAgQFtAQCCAoATODYAAAAAAEDAwY="}
 00410{"flow_id":51,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1426,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570713,"pkt_ts_usec":727956,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA8NAABAGnnZQSm5ECggAAQG7gxds2YS5kyZ7R1AS\/\/9iaAAA"}
 00409{"flow_id":50,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1427,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570713,"pkt_ts_usec":729259,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoBP9AAEAGfWcKCAABrfMAbtmHAbtwYOUzj58qzFAQTE+\/2AAA"}
 00408{"flow_id":51,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1428,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570713,"pkt_ts_usec":730352,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAom59AAEAG1pkKCAABUEpuRIMXAbuTJntHbNmEulAQOQgpYQAA"}
 00702{"flow_id":51,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1429,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570713,"pkt_ts_usec":734065,"pkt_caplen":270,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":270,"pkt_l4_len":236,"pkt":"ABoRAAACABoRAAABCABFAAEAm6BAAEAG1cAKCAABUEpuRIMXAbuTJntHbNmEulAYOQhTzAAAFgMBANMBAADPAwFWGmZZuBzwgmCJdcmTjbwZnC8oKUidI7QzbitGwcbpgSBKAAAAOC7EJ2lJH7mDuj6DaIBXRCqOxY\/AVNJYEqB0IgBGAAQABQAvADXAAsAEwAXADMAOwA\/AB8AJwArAEcATwBQAMwA5ADIAOAAKwAPADcAIwBIAFgATAAkAFQASAAMACAAUABEA\/wEAAEAACwAEAwABAgAKADQAMgAOAA0AGQALAAwAGAAJAAoAFgAXAAgABgAHABQAFQAEAAUAEgATAAEAAgADAA8AEAAR"}
-00719{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1429,"source":"webex.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":4,"flow_first_seen":1444570713719,"flow_last_seen":1444570713734,"flow_tot_l4_data_len":316,"flow_min_l4_data_len":20,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":79,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33559,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00730{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1429,"source":"webex.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":4,"flow_first_seen":1444570713719,"flow_last_seen":1444570713734,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":216,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33559,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00410{"flow_id":51,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1430,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570713,"pkt_ts_usec":734643,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA8RAABAGnnVQSm5ECggAAQG7gxds2YS6kyZ8H1AQ\/\/9hkQAA"}
 00850{"flow_id":50,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1431,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570713,"pkt_ts_usec":820220,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFuBQBAAEAGfCAKCAABrfMAbtmHAbtwYOUzj58qzFAYTE8rqgAAFgMBAQYQAAECAQCWmAWectP+J0A5Z2E+tnU97CXr2FOrN+LZS8Vb9mt4CS85xnRMgnqdJ6+5bSTKY5+sKvD0uOf1\/W+RCAJKPf9jm1ZTqZ2Gfv4lNIMODzPmzr684HM+3meSGcQ8DxxKLdTe20+g5alQAPFfi6wh4AaLxCFXTcKKjU5ppmYA3lLabZTHgExRfPxWxrCIGH9cHAZwlD62tlSeJJ6Bj5suxXonXbcjTyTgz+8mv2YaroIm3XFBu247nShRyixb0vMsQybAOZdQyfLJ65phnYoR3sg3UTZdBTdKtLs72nU1ZcxYMM\/SRxfYlGHyI81qJK3cDBVnA0qVgWMM2Nph8o4B07yMFAMBAAEBFgMBADAj5FDOpEuOjNf0skw9zVzK1F2d+LsHA3YiiFiktoj052qwNVAhJb7qOp5xJoHV4\/s="}
 00410{"flow_id":50,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1432,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570713,"pkt_ts_usec":820671,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA8VAABAGrqGt8wBuCggAAQG72YePnyrMcGDmeVAQ\/\/8K4gAA"}
 00588{"flow_id":51,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1433,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570715,"pkt_ts_usec":238965,"pkt_caplen":183,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":183,"pkt_l4_len":149,"pkt":"ABoRAAACABoRAAABCABFAACpA8ZAABAGnfJQSm5ECggAAQG7gxds2YS6kyZ8H1AY\/\/8Z7AAAFgMBAFECAABNAwFWGmZ7j4touJYuyExL4xTp2XN88sUNliawBCgTpqIwUCBKAAAAOC7EJ2lJH7mDuj6DaIBXRCqOxY\/AVNJYEqB0IgAEAAAF\/wEAAQAUAwEAAQEWAwEAIGHRs+Sg8bWNqolu8prJr20w\/iFuAjz6TMIW1wLUxZ5c"}
-00760{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1433,"source":"webex.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":6,"flow_first_seen":1444570713719,"flow_last_seen":1444570715238,"flow_tot_l4_data_len":485,"flow_min_l4_data_len":20,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":80,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33559,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6dfe5eb347aa509fc445e5628d467a2b","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
+00771{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1433,"source":"webex.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":6,"flow_first_seen":1444570713719,"flow_last_seen":1444570715238,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":216,"flow_tot_l4_payload_len":345,"flow_avg_l4_payload_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33559,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6dfe5eb347aa509fc445e5628d467a2b","unsafe_cipher":2,"cipher":"TLS_RSA_WITH_RC4_128_MD5"}}
 00408{"flow_id":51,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1434,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570715,"pkt_ts_usec":290000,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAom6FAAEAG1pcKCAABUEpuRIMXAbuTJnwfbNmFO1AQPLgkWAAA"}
 00468{"flow_id":51,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1435,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570715,"pkt_ts_usec":290624,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":97,"pkt_l4_len":63,"pkt":"ABoRAAACABoRAAABCABFAABTm6JAAEAG1msKCAABUEpuRIMXAbuTJnwfbNmFO1AYPLgnbAAAFAMBAAEBFgMBACAR8oB0o3Rds9SbYBXls93X3wUnTf47baRWW+9Ugy3q0g=="}
 00410{"flow_id":51,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1436,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570715,"pkt_ts_usec":291226,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA8dAABAGnnJQSm5ECggAAQG7gxds2YU7kyZ8SlAQ\/\/9g5QAA"}
@@ -772,15 +772,15 @@
 00411{"flow_id":50,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1444,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570715,"pkt_ts_usec":661967,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA8tAABAGrput8wBuCggAAQG72YePnysHcGDokVAQ\/\/8IjwAA"}
 00544{"flow_id":50,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1445,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570715,"pkt_ts_usec":662503,"pkt_caplen":152,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":152,"pkt_l4_len":118,"pkt":"ABoRAAACABoRAAABCABFAACKBQNAAEAGfQEKCAABrfMAbtmHAbtwYOiRj58rB1AYTE+XDgAA8n0K26HazNKgkc4Dl3hoP4WguocQuzfWhRw7Y9nJnNR7PrvGp96hPUjOpoXrA9sB65wlWNk5C82ZpqUzOqi4+lE7pRaZSuJvJaTS1h7ZZ7sXSutlTUhm3UIjLVg0bO258xM="}
 00411{"flow_id":50,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1446,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570715,"pkt_ts_usec":663092,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA8xAABAGrpqt8wBuCggAAQG72YePnysHcGDo81AQ\/\/8ILQAA"}
-00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1454,"source":"webex.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1444570716599,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51857,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1454,"source":"webex.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1444570716599,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51857,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":52,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1454,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570716,"pkt_ts_usec":599098,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8ldZAAEAGdtEKCAABPm3lnsqRAbsgVHeCAAAAAKACOQiaIAAAAgQFtAQCCAoATOJUAAAAAAEDAwY="}
 00410{"flow_id":52,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1455,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570716,"pkt_ts_usec":603330,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA9FAABAGOOs+beWeCggAAQG7ypHfq4h9IFR3g1AS\/\/+1cAAA"}
 00408{"flow_id":52,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1456,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570716,"pkt_ts_usec":604060,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAolddAAEAGduQKCAABPm3lnsqRAbsgVHeD36uIflAQOQh8aQAA"}
 00665{"flow_id":52,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1457,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570716,"pkt_ts_usec":610502,"pkt_caplen":241,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":241,"pkt_l4_len":207,"pkt":"ABoRAAACABoRAAABCABFAADjldhAAEAGdigKCAABPm3lnsqRAbsgVHeD36uIflAYOQieBgAAFgMBALYBAACyAwH2mTMdHJrmw7XGFaYthT2kGUSX+T\/uNQ3U\/xVLblVUyQAAWMAUwAoAOQA4ADcANsAPwAUANcATwAkAMwAyADEAMACaAJkAmACXwA7ABAAvAJbAEcAHwAzAAgAFAATAEsAIABYAEwAQAA3ADcADAAoAFQASAA8ADAAJAP8BAAAxAAsABAMAAQIACgAcABoAFwAZABwAGwAYABoAFgAOAA0ACwAMAAkACgAjAAAADwABAQ=="}
-00734{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1457,"source":"webex.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":4,"flow_first_seen":1444570716599,"flow_last_seen":1444570716610,"flow_tot_l4_data_len":287,"flow_min_l4_data_len":20,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51857,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00745{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1457,"source":"webex.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":4,"flow_first_seen":1444570716599,"flow_last_seen":1444570716610,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":187,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51857,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00410{"flow_id":52,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1458,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570716,"pkt_ts_usec":610944,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA9JAABAGOOo+beWeCggAAQG7ypHfq4h+IFR4PlAQ\/\/+0tgAA"}
 05676{"flow_id":52,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1460,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570717,"pkt_ts_usec":923568,"pkt_caplen":3961,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3961,"pkt_l4_len":3927,"pkt":"ABoRAAACABoRAAABCABFAA9rA9NAABAGKaY+beWeCggAAQG7ypHfq4h+IFR4PlAY\/\/9eFgAAFgMBDz4CAAAtAwFWGmZj69h90cfTm0P8hJdpnTrybQ92MkqiMy7IoJ+Y8wAALwAABf8BAAEACwAPBQAPAgAE6TCCBOUwggPNoAMCAQICECl0ianUHkm+YfeBaUbmIfMwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDAeFw0xNTA0MTAwMDAwMDBaFw0xODA0MTAyMzU5NTlaMHcxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMREwDwYDVQQHDAhTYW4gSm9zZTEcMBoGA1UECgwTQ2lzY28gU3lzdGVtcywgSW5jLjEMMAoGA1UECwwDQ1NHMRQwEgYDVQQDDAsqLndlYmV4LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ14yGFLwwhhZyxegl+wYbyZZp5q4NComRXAz+k8ibNrPp+x46qW\/Dt++MdupJ8y605K5KTQVb24unmPF+pZq1par5YBKMjJrJTW2aAI1MtQvRzSDCNhdWyxiP6SkVBm6ZOcLwL+kijn\/nCot5orO1NrHHFG\/HBcSk1aaetoitrjs5BWuMxdYuIZvzSoyViVbo\/w\/LUKXdD0rlOcFmOxtcf+VKb7w1eyku07Jp94m\/\/ILLQS\/jy7ymRyfGFnPLtNqBmUKFg+uAD7JcHZiy8g6quVEhEZdm3O+tUR2wYZ5in9yKcrxqoHwhW0O4X2\/rJ4mNDvikIgaWiSNW7eIoh0NWECAwEAAaOCAWQwggFgMBYGA1UdEQQPMA2CCyoud2ViZXguY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH\/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYDVR0jBBgwFoAUX2DPYZBV34RDFIpgKrL1evRDGO8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Muc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAFNF1YB0fCkEyxRc1VQO7NUZao+PnZuavjgeTnyTKmHl\/4Zxh1Xg\/M\/f\/RHSrGrgUW2xaSZN\/Dwt2hqMtIi\/b\/AgOFeqNKmMxH3nWxf6f1Lr7QoTvApLQGqjeuIT3U6AiRMt4Ksgfx7+1Vbil1AaILo859VgXSMgVJTv4QpUpzg\/EKtUqPwMwq8PvwoTjlewyOt9YbCxNTO91JkKsYuwm7uUeU7Fx+r+rP+wgDwYVbbsUwQXAbj7QOj3dkPLzn+gcrhK1ZlgFf7Ti34xrqj7jNiaMc0dYh\/Ns3KCHMTs5rVCGLIk7lEgovwLDbJtuuQTlvaHoeZIGVPqROi5Bl\/WxAgAFPDCCBTgwggQgoAMCAQICEFE\/uXQ4cLc0QEGNMJMGmf8wDQYJKoZIhvcNAQELBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MB4XDTEzMTAzMTAwMDAwMFoXDTIzMTAzMDIzNTk1OVowfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLYBcocdC21F1Y5xUpSCZboS9gM8WifmkIoYsOlMFN+VRGCWwN6DS\/heQTJtJZ3GYEBlFn5vPd6mSeCLbeD3Vonf7IDepxTJelIH0ZPyJ0p+L55Vvb3\/dk6aNqLS4IzQRLDyDzM1pZ6hCEaIgQDJxeLHGhhkw8OUYAzHbS1zut+0GKs7rN7AXTvaTXrytU9qe6XmMqNqkQOJZlKFZakzm0CVB8qaibiBjpjSKy0TNF1k1D\/Ey\/W2uHGGPWfySVd8wA63iZNtCkJzQ89I28WSoEW+\/KDEMO41thVMj3xvQ+9jFKVShaXelIhY3UvFvnEZr71tQnY\/ycAzUR8b0s\/sPcCAwEAAaOCAWMwggFfMBIGA1UdEwEB\/wQIMAYBAf8CAQAwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNiLmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vczIuc3ltY2IuY29tMGsGA1UdIARkMGIwYAYKYIZIAYb4RQEHNjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMB8GA1UdIwQYMBaAFH\/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBCwUAA4IBAQBelFZJ3Y4tZfXBNlG2A+PannMZ8h9Zq1h+bCYFLPqB11wjFyIsN5P3huyF5rCj\/R\/iMqhFb+HZ+7mv0nCgMkJlv4T+FiqPP8Wm1qOTfUPpdCGRNSj0Y+ku7ff1XH9LmrUg6Qq94EUQDBSUml2l40uR6CSbRkBl9CJyzZn4iBH183\/mM4LmqMV+\/tAI4iVYCHFo5s2i5hTeTlIkLf3leRNT514vLU0bbUAVUiv3h4l4EoFu2U2qLXjUwiw9CF+HkZ4fDrDeMFJkhomqnWacDnYMgPJ02Cr4uDrO19YPEb5rqxT1vUGgImOJ8boPbyljZi0\/rIxyxfvH5NQP8jtPjCnHAATUMIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ\/XxrcgxiV0i6CqqpkKzj\/i5Vbext0uz\/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6\/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn\/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4\/VBEnkjWNHiDxpg8v+R70rfk\/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10\/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH\/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB\/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW\/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3\/DgAAAA=="}
-01113{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1460,"source":"webex.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":6,"flow_first_seen":1444570716599,"flow_last_seen":1444570717923,"flow_tot_l4_data_len":4234,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":705,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51857,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"4192c0a946c5bd9b544b4656d9f624a4","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_128_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01124{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1460,"source":"webex.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":6,"flow_first_seen":1444570716599,"flow_last_seen":1444570717923,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":4094,"flow_avg_l4_payload_len":682,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51857,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"64ea4359ad4b496db653a3f30f7073e6","ja3s":"4192c0a946c5bd9b544b4656d9f624a4","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_128_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00408{"flow_id":52,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1461,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570717,"pkt_ts_usec":977160,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoldlAAEAGduIKCAABPm3lnsqRAbsgVHg+36uXwVAQTE9ZJAAA"}
 00855{"flow_id":52,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1462,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570717,"pkt_ts_usec":994686,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFuldpAAEAGdZsKCAABPm3lnsqRAbsgVHg+36uXwVAYTE92+gAAFgMBAQYQAAECAQALQTz6KcI35KZoeIMPbSyR9X\/eQZe0OFECu7tGpF4u8y0Tf27yrhCes\/lWu6UUOwvCZOrTt+l7NYdz+F5Kg4sFCzKSQSkF+Pz2ZNz1yaKwIgy7ofI09FWdJCMTe\/dWYf9mkbyadXXlp\/S1oVFZjZvt8ID0UvRqUuq3x+2ecyYuwXI8gCnO3oqtxZYcjA8A454LlBxbfcbrYjKWzLpcYGX0Kq8ET9iLhWyabhSdhxvrc+ZTb5CB2P+RSRNNnEfk2xolxyM9TiWdrb+LURVubG2zJzd37R7KSXD7vV9vIcqy2j\/c44eLXw84KKaeuE+avzkup6LZsPN\/2ltvD7\/B27soFAMBAAEBFgMBADCITsX0Z6PHJRemeFZdpRYu2msNx0v0szSQu5cLy\/Pv+yhBVyqJL4JaAbGREyH8Z9o="}
 00410{"flow_id":52,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1463,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570717,"pkt_ts_usec":995012,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA9RAABAGOOg+beWeCggAAQG7ypHfq5fBIFR5hFAQ\/\/+kLQAA"}
@@ -790,12 +790,12 @@
 00411{"flow_id":52,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1467,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570718,"pkt_ts_usec":194410,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA9ZAABAGOOY+beWeCggAAQG7ypHfq5f8IFR5zlAQ\/\/+jqAAA"}
 00464{"flow_id":52,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1469,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570718,"pkt_ts_usec":323959,"pkt_caplen":91,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":91,"pkt_l4_len":57,"pkt":"ABoRAAACABoRAAABCABFAABNA9dAABAGOMA+beWeCggAAQG7ypHfq5f8IFR5zlAY\/\/\/9uAAAFwMBACDYAlMgEXMNwMH0NIax0mFWDC9k9dpAvLzJWEoRTbcCMA=="}
 00409{"flow_id":52,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1470,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570718,"pkt_ts_usec":374937,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAold1AAEAGdt4KCAABPm3lnsqRAbsgVHnO36uYIVAQTE9XNAAA"}
-00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1483,"source":"webex.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1444570718801,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51772,"dst_port":9000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1483,"source":"webex.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1444570718801,"flow_last_seen":0,"flow_min_l4_payload_len":8,"flow_max_l4_payload_len":8,"flow_tot_l4_payload_len":8,"flow_avg_l4_payload_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51772,"dst_port":9000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00404{"flow_id":53,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1483,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570718,"pkt_ts_usec":801686,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"pkt":"ABoRAAACABoRAAABCABFAAAk4zFAAEARKYMKCAABPm3lnso8IygAEONTAQAAAAAAAAE="}
 00404{"flow_id":53,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1484,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570718,"pkt_ts_usec":921691,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"pkt":"ABoRAAACABoRAAABCABFAAAkA95AABARONc+beWeCggAASMoyjwAEESbAgAAAAC4nQE="}
 00404{"flow_id":53,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1485,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570718,"pkt_ts_usec":924198,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"pkt":"ABoRAAACABoRAAABCABFAAAk4zJAAEARKYIKCAABPm3lnso8IygAEONTAQAAAAAAAAE="}
 00403{"flow_id":53,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1486,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570719,"pkt_ts_usec":39150,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"pkt":"ABoRAAACABoRAAABCABFAAAkA99AABARONY+beWeCggAASMoyjwAEEObAgAAAAC4ngE="}
-00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1491,"source":"webex.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1444570719041,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51859,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1491,"source":"webex.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1444570719041,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51859,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":54,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1491,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570719,"pkt_ts_usec":41198,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8mB5AAEAGdIkKCAABPm3lnsqTAbu3\/XtaAAAAAKACOQj9rAAAAgQFtAQCCAoATONEAAAAAAEDAwY="}
 00410{"flow_id":54,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1492,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570719,"pkt_ts_usec":47347,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA+JAABAGONo+beWeCggAAQG7ypNIAoSlt\/17W1AS\/\/+1bgAA"}
 00448{"flow_id":53,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1493,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570719,"pkt_ts_usec":47596,"pkt_caplen":84,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":84,"pkt_l4_len":50,"pkt":"ABoRAAACABoRAAABCABFAABG4zNAAEARKV8KCAABPm3lnso8IygAMvEjBgAAAAAAAAAh0jAhjOUQAAAB+4D\/bwAAAAQAGwMBAAAAAgAAAAAAAAAA"}
@@ -810,7 +810,7 @@
 00449{"flow_id":53,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1513,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570727,"pkt_ts_usec":75663,"pkt_caplen":84,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":84,"pkt_l4_len":50,"pkt":"ABoRAAACABoRAAABCABFAABG4ztAAEARKVcKCAABPm3lnso8IygAMvEjBgAAAAAAAAAh0jAhjOUQAAAB+4D\/bwAAAAQAGwMBAAAAAgAAAAAAAAAA"}
 00449{"flow_id":53,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1515,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570729,"pkt_ts_usec":75623,"pkt_caplen":84,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":84,"pkt_l4_len":50,"pkt":"ABoRAAACABoRAAABCABFAABG4zxAAEARKVYKCAABPm3lnso8IygAMvEjBgAAAAAAAAAh0jAhjOUQAAAB+4D\/bwAAAAQAGwMBAAAAAgAAAAAAAAAA"}
 00449{"flow_id":53,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1516,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570730,"pkt_ts_usec":75669,"pkt_caplen":84,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":84,"pkt_l4_len":50,"pkt":"ABoRAAACABoRAAABCABFAABG4z1AAEARKVUKCAABPm3lnso8IygAMvEjBgAAAAAAAAAh0jAhjOUQAAAB+4D\/bwAAAAQAGwMBAAAAAgAAAAAAAAAA"}
-00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1527,"source":"webex.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":1,"flow_first_seen":1444570732086,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51190,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1527,"source":"webex.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":1,"flow_first_seen":1444570732086,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51190,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":55,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1527,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570732,"pkt_ts_usec":86555,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8h\/tAAEAGidIKCAABPm3geMf2AbvHvWEvAAAAAKACOQgMSwAAAgQFtAQCCAoATObUAAAAAAEDAwY="}
 00410{"flow_id":55,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1528,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570732,"pkt_ts_usec":90067,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA+tAABAGPfc+beB4CggAAQG7x\/Y4Qp7Qx71hMFAS\/\/+9MQAA"}
 00436{"flow_id":55,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1531,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570733,"pkt_ts_usec":95720,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8h\/xAAEAGidEKCAABPm3geMf2AbvHvWEvAAAAAKACOQgL5wAAAgQFtAQCCAoATOc4AAAAAAEDAwY="}
@@ -819,23 +819,23 @@
 00411{"flow_id":55,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1534,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570733,"pkt_ts_usec":111880,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA+1AABAGPfU+beB4CggAAQG7x\/Y4Qp7Qx71hMFAS\/\/+9MQAA"}
 00409{"flow_id":55,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1535,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570733,"pkt_ts_usec":112182,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoh\/5AAEAGieMKCAABPm3geMf2AbvHvWEwOEKe0VAQOQiEKgAA"}
 00495{"flow_id":55,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1536,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570733,"pkt_ts_usec":112697,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnh\/9AAEAGiaMKCAABPm3geMf2AbvHvWEwOEKe0VAYOQhGawAAFgMBADoBAAA2AwHVO4NHpduGJEZF49hflO7g+gMWTzynDfqMtHMiTtpV9QAABAA1AP8BAAAJACMAAAAPAAEB"}
-00733{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1536,"source":"webex.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":8,"flow_first_seen":1444570732086,"flow_last_seen":1444570733112,"flow_tot_l4_data_len":283,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51190,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00742{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1536,"source":"webex.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":8,"flow_first_seen":1444570732086,"flow_last_seen":1444570733112,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":7,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51190,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00411{"flow_id":55,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1537,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570733,"pkt_ts_usec":113293,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA+5AABAGPfQ+beB4CggAAQG7x\/Y4Qp7Rx71hb1AQ\/\/+88wAA"}
 00409{"flow_id":55,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1539,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570734,"pkt_ts_usec":115626,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoiABAAEAGieEKCAABPm3geMf2AbvHvWFvOEKe0VAQOQiD6wAA"}
 00409{"flow_id":55,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1540,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570734,"pkt_ts_usec":115956,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoiAFAAEAGieAKCAABPm3geMf2AbvHvWFvOEKe0VAQOQiD6wAA"}
-00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1544,"source":"webex.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":1,"flow_first_seen":1444570738415,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51194,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1544,"source":"webex.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":1,"flow_first_seen":1444570738415,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51194,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":56,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1544,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570738,"pkt_ts_usec":415965,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8pZ5AAEAGbC8KCAABPm3geMf6AbsEHk9CAAAAAKACOQjdywAAAgQFtAQCCAoATOrcAAAAAAEDAwY="}
 00411{"flow_id":56,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1545,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570738,"pkt_ts_usec":418908,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA+9AABAGPfM+beB4CggAAQG7x\/r74bC9BB5PQ1AS\/\/+9LQAA"}
-00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1546,"source":"webex.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":1,"flow_first_seen":1444570738419,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51195,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1546,"source":"webex.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":1,"flow_first_seen":1444570738419,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51195,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00436{"flow_id":57,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1546,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570738,"pkt_ts_usec":419074,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8eOlAAEAGmOQKCAABPm3geMf7AbvAYZI1AAAAAKACOQjekwAAAgQFtAQCCAoATOrcAAAAAAEDAwY="}
 00413{"flow_id":57,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1547,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570738,"pkt_ts_usec":422538,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA\/BAABAGPfI+beB4CggAAQG7x\/s\/nm3KwGGSNlAS\/\/+9LAAA"}
 00408{"flow_id":56,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1548,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570738,"pkt_ts_usec":422731,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAopZ9AAEAGbEIKCAABPm3geMf6AbsEHk9D++GwvlAQOQiEJgAA"}
 00408{"flow_id":57,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1549,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570738,"pkt_ts_usec":422892,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoeOpAAEAGmPcKCAABPm3geMf7AbvAYZI2P55ty1AQOQiEJQAA"}
 00496{"flow_id":56,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1550,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570738,"pkt_ts_usec":424345,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABnpaBAAEAGbAIKCAABPm3geMf6AbsEHk9D++GwvlAYOQh\/zQAAFgMBADoBAAA2AwHh7e2VL35m23t1WU\/32VTucYT8nOT5NyMFMmtQATYTFwAABAA1AP8BAAAJACMAAAAPAAEB"}
-00733{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1550,"source":"webex.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":4,"flow_first_seen":1444570738415,"flow_last_seen":1444570738424,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51194,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00743{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1550,"source":"webex.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":4,"flow_first_seen":1444570738415,"flow_last_seen":1444570738424,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51194,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00412{"flow_id":56,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1551,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570738,"pkt_ts_usec":424731,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA\/FAABAGPfE+beB4CggAAQG7x\/r74bC+BB5PglAQ\/\/+87wAA"}
 00496{"flow_id":57,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1552,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570738,"pkt_ts_usec":426143,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"ABoRAAACABoRAAABCABFAABneOtAAEAGmLcKCAABPm3geMf7AbvAYZI2P55ty1AYOQia+QAAFgMBADoBAAA2AwFlZ\/2gy5EJcUBexsWY6X0\/hsP+2A782vGEfEVj8EbqUwAABAA1AP8BAAAJACMAAAAPAAEB"}
-00733{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1552,"source":"webex.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":4,"flow_first_seen":1444570738419,"flow_last_seen":1444570738426,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51195,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
+00743{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1552,"source":"webex.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":4,"flow_first_seen":1444570738419,"flow_last_seen":1444570738426,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51195,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
 00413{"flow_id":57,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1553,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570738,"pkt_ts_usec":426631,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA\/JAABAGPfA+beB4CggAAQG7x\/s\/nm3LwGGSdVAQ\/\/+87gAA"}
 00408{"flow_id":46,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1556,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570740,"pkt_ts_usec":247906,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoZhBAAEAGjy0KCAABTi7tW+ltAFASyr7b7TVEZVARPLhAigAA"}
 00411{"flow_id":46,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1557,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570740,"pkt_ts_usec":248214,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA\/NAABAGIUtOLu1bCggAAQBQ6W3tNURlEsq+3FAQ\/\/99QgAA"}
@@ -844,7 +844,7 @@
 00412{"flow_id":45,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1560,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570740,"pkt_ts_usec":249618,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA\/VAABAGIUlOLu1bCggAAQBQ6WyUIsz0a903cVAQ\/\/98HwAA"}
 00412{"flow_id":45,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1561,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570740,"pkt_ts_usec":249861,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA\/ZAABAGIUhOLu1bCggAAQBQ6WyUIsz0a903cVAR\/\/98HgAA"}
 05678{"flow_id":56,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1562,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570740,"pkt_ts_usec":300724,"pkt_caplen":3961,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3961,"pkt_l4_len":3927,"pkt":"ABoRAAACABoRAAABCABFAA9rA\/dAABAGLqg+beB4CggAAQG7x\/r74bC+BB5PglAY\/\/87kQAAFgMBDz4CAAAtAwFWGmZ5tsqn+YAQZXvK+RxU4fExf6dY82QyqwsxQ76ZVQAANQAABf8BAAEACwAPBQAPAgAE6TCCBOUwggPNoAMCAQICECl0ianUHkm+YfeBaUbmIfMwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDAeFw0xNTA0MTAwMDAwMDBaFw0xODA0MTAyMzU5NTlaMHcxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMREwDwYDVQQHDAhTYW4gSm9zZTEcMBoGA1UECgwTQ2lzY28gU3lzdGVtcywgSW5jLjEMMAoGA1UECwwDQ1NHMRQwEgYDVQQDDAsqLndlYmV4LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ14yGFLwwhhZyxegl+wYbyZZp5q4NComRXAz+k8ibNrPp+x46qW\/Dt++MdupJ8y605K5KTQVb24unmPF+pZq1par5YBKMjJrJTW2aAI1MtQvRzSDCNhdWyxiP6SkVBm6ZOcLwL+kijn\/nCot5orO1NrHHFG\/HBcSk1aaetoitrjs5BWuMxdYuIZvzSoyViVbo\/w\/LUKXdD0rlOcFmOxtcf+VKb7w1eyku07Jp94m\/\/ILLQS\/jy7ymRyfGFnPLtNqBmUKFg+uAD7JcHZiy8g6quVEhEZdm3O+tUR2wYZ5in9yKcrxqoHwhW0O4X2\/rJ4mNDvikIgaWiSNW7eIoh0NWECAwEAAaOCAWQwggFgMBYGA1UdEQQPMA2CCyoud2ViZXguY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH\/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYDVR0jBBgwFoAUX2DPYZBV34RDFIpgKrL1evRDGO8wKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Muc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Muc3ltY2IuY29tL3NzLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAFNF1YB0fCkEyxRc1VQO7NUZao+PnZuavjgeTnyTKmHl\/4Zxh1Xg\/M\/f\/RHSrGrgUW2xaSZN\/Dwt2hqMtIi\/b\/AgOFeqNKmMxH3nWxf6f1Lr7QoTvApLQGqjeuIT3U6AiRMt4Ksgfx7+1Vbil1AaILo859VgXSMgVJTv4QpUpzg\/EKtUqPwMwq8PvwoTjlewyOt9YbCxNTO91JkKsYuwm7uUeU7Fx+r+rP+wgDwYVbbsUwQXAbj7QOj3dkPLzn+gcrhK1ZlgFf7Ti34xrqj7jNiaMc0dYh\/Ns3KCHMTs5rVCGLIk7lEgovwLDbJtuuQTlvaHoeZIGVPqROi5Bl\/WxAgAFPDCCBTgwggQgoAMCAQICEFE\/uXQ4cLc0QEGNMJMGmf8wDQYJKoZIhvcNAQELBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDIwMDYgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc1MB4XDTEzMTAzMTAwMDAwMFoXDTIzMTAzMDIzNTk1OVowfjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMS8wLQYDVQQDEyZTeW1hbnRlYyBDbGFzcyAzIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLYBcocdC21F1Y5xUpSCZboS9gM8WifmkIoYsOlMFN+VRGCWwN6DS\/heQTJtJZ3GYEBlFn5vPd6mSeCLbeD3Vonf7IDepxTJelIH0ZPyJ0p+L55Vvb3\/dk6aNqLS4IzQRLDyDzM1pZ6hCEaIgQDJxeLHGhhkw8OUYAzHbS1zut+0GKs7rN7AXTvaTXrytU9qe6XmMqNqkQOJZlKFZakzm0CVB8qaibiBjpjSKy0TNF1k1D\/Ey\/W2uHGGPWfySVd8wA63iZNtCkJzQ89I28WSoEW+\/KDEMO41thVMj3xvQ+9jFKVShaXelIhY3UvFvnEZr71tQnY\/ycAzUR8b0s\/sPcCAwEAAaOCAWMwggFfMBIGA1UdEwEB\/wQIMAYBAf8CAQAwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNiLmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vczIuc3ltY2IuY29tMGsGA1UdIARkMGIwYAYKYIZIAYb4RQEHNjBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMB8GA1UdIwQYMBaAFH\/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEBCwUAA4IBAQBelFZJ3Y4tZfXBNlG2A+PannMZ8h9Zq1h+bCYFLPqB11wjFyIsN5P3huyF5rCj\/R\/iMqhFb+HZ+7mv0nCgMkJlv4T+FiqPP8Wm1qOTfUPpdCGRNSj0Y+ku7ff1XH9LmrUg6Qq94EUQDBSUml2l40uR6CSbRkBl9CJyzZn4iBH183\/mM4LmqMV+\/tAI4iVYCHFo5s2i5hTeTlIkLf3leRNT514vLU0bbUAVUiv3h4l4EoFu2U2qLXjUwiw9CF+HkZ4fDrDeMFJkhomqnWacDnYMgPJ02Cr4uDrO19YPEb5rqxT1vUGgImOJ8boPbyljZi0\/rIxyxfvH5NQP8jtPjCnHAATUMIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4\/TANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ\/XxrcgxiV0i6CqqpkKzj\/i5Vbext0uz\/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6\/WhkcIzSdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn\/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4\/VBEnkjWNHiDxpg8v+R70rfk\/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10\/NIeWiu5T6CUVAgMBAAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH\/MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB\/wQEAwIBBjA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUAA4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5KlCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZtOxFNfeKW\/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3\/DgAAAA=="}
-01113{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1562,"source":"webex.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":6,"flow_first_seen":1444570738415,"flow_last_seen":1444570740300,"flow_tot_l4_data_len":4110,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":685,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51194,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
+01124{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1562,"source":"webex.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":6,"flow_first_seen":1444570738415,"flow_last_seen":1444570740300,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":3970,"flow_avg_l4_payload_len":661,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51194,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.webex.com","ja3":"7cb93b2404a98399e9f84c74fef1fb8f","ja3s":"91589ea825a2ee41810c85fab06d2ef6","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 Secure Server CA - G4","issuerDN":"C=us, ST=California, L=San Jose, O=Cisco Systems, Inc., OU=CSG, CN=*.webex.com","fingerprint":"61:C9:DE:EE:FA:AE:DC:17:A0:36:B9:68:F9:17:F6:5A:90:7B:14:E1"}}
 00408{"flow_id":56,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1563,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570740,"pkt_ts_usec":301052,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAopaFAAEAGbEAKCAABPm3geMf6AbsEHk+C++HAAVAQTE9hXQAA"}
 00851{"flow_id":56,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1564,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570740,"pkt_ts_usec":351829,"pkt_caplen":380,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":380,"pkt_l4_len":346,"pkt":"ABoRAAACABoRAAABCABFAAFupaJAAEAGavkKCAABPm3geMf6AbsEHk+C++HAAVAYTE+z5QAAFgMBAQYQAAECAQATAu9JlSz2mcBnZF6FyDc4l5o7MmSm75vaOWMxu6J\/xXqUWdERh1j55WiYOkmYsMbV6S1x837iYkFuSJxKmaHeWMvHGlorqANUqgqRUA\/8pvykXicX6ayIp5ANf7G+9nkXqwdwx4HAH\/BwLHizsvIhJlIXkd65DMZ5N1WqBy4JfSsGkYkC0XemW589pxubQbilumEFDfNkogY1lB8CMuQdf3LiCxZchU74i1w6NjXFhit6TTZBwpAcP8CuFNWLL2n9HT6bQf3JeQiGLpyTVG4iOmrsX6jRQKlqvvePpRZWJDUTOHuQaL+8SXK1QLrt\/BNu8p2lAKfXfRownjty9wuqFAMBAAEBFgMBADDuNh9IWMmDPtrCDmmT81sajsGqsm3XvIxN2aFX5es+KtJpI3hDQkVEiz1Kr06p49Q="}
 00412{"flow_id":56,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1565,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570740,"pkt_ts_usec":352317,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoA\/hAABAGPeo+beB4CggAAQG7x\/r74cABBB5QyFAQ\/\/+sZgAA"}
@@ -854,66 +854,66 @@
 00637{"flow_id":56,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1569,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570740,"pkt_ts_usec":706421,"pkt_caplen":219,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":219,"pkt_l4_len":185,"pkt":"ABoRAAACABoRAAABCABFAADNA\/tAABAGPUI+beB4CggAAQG7x\/r74cA8BB5SolAY\/\/+2rwAAFwMBAKD59UDZ7S7geJrVoYTOnjjAElM7mgEB5SfOzss2AtHnIjs7wJRjidoZeLKCsZK3Kzs5xW13JL+ljy2vDIr\/MQmdsFHjUqVYXgzVTVCkmtV8WnZlS3Vb17A2+NAprTG7USXVPvkyuUIRRNg3TVuSGRd3HbKWs4zo22fg7N+B9r+UJZyyPOKqBA1GZbAHLaPDnooAlMupSDk92KNoV3z+SqJ4"}
 00409{"flow_id":56,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1570,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570740,"pkt_ts_usec":757122,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAopaRAAEAGbD0KCAABPm3geMf6AbsEHlKi++HA4VAQatU+1wAA"}
 12191{"flow_id":56,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1571,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570741,"pkt_ts_usec":261271,"pkt_caplen":8739,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":8739,"pkt_l4_len":8705,"pkt":"ABoRAAACABoRAAABCABFACIVA\/xAABAGG\/k+beB4CggAAQG7x\/r74cDhBB5SolAY\/\/82VAAAFwMBA8DFCTPOqzHwefYO9IhXr6OycdJGxl9DrzQx7TPYR+5D0QIOdbKIQnT70cPdijZrY60a86ffRhoATUhUhmwVqJbbVptIwtp4kvlQc6BxvAR3T6EO7nu1H+Cnlfy\/aSn0jlc5gDRFdzjDVuqJ5QZYNQpcf7Op5wDmxG\/cGTQ+KdLz8uFCL1MAmL7GrXw6soCUITfjQRwx4qSXRD7\/AyAIjhrwPKX9BtFOJVIhWMWLXtGo+bqwBKhVidPVQiwqFmrlyKAu9Sh2BW9N71u284Y8PJSYOxpcHUyHqCdGUDzViDtJVmahEy7qiSCSMtgmuRbkxYkwBS930S1Q074Bpkev1um645QUG02+88BRWeVZf+XphGor+qT54lnjHHPN\/FA3s6GMy2X1YRbCehewPowO8B6mC0mqmqEPG5ePujfTSNt7mbyBR8haGUDyp9VXTvZTd9aLAgwqLgVSgGZkizR+XFrKBKBO1TANRAh6\/sxU5hoo8x3FpueO42Jkg9bn3srQhK14KuTCvXjnOqYFoUKchLTKCBRdnwFYIId7OIEYpV57dk9ujYQGopw1y6SlI\/lKmLbVypKTByPUk2vIBesX4hlFB+fuvd9IXmk71D4vhG3sOvI3LV0vwz8yxir2VzBVbMq7x2osfpDTQei1T7Kh+SvQuKWsD7VLgADhbnVXtdJar3hT23RCnKpB8b0BhtZLPpKAZVgDJkPeK\/bMzbDFpW2cDtjPLqqrFOu1YtlU709XWlxxwW6S\/oXWOaRHO1XT0aRo8LKbtzMAvGbldj2rwUcnpOuAKPmESQ7fd0slunZXgyar0jdF4YT8Tiip+f\/efvpv+y73zK3eJ+RP\/xiAedxSVwmXW9e74jhjYhm+0P7otEZ6fWopLe0cEj+rW4xO0A6zmTLx+Y2M9ohomP+X\/ezgpDzB8I7Zap7FrxsGlSLAvwNHtX4WYu0sAeNfBOQP\/Xbl4H08DP1lGA7coPwae8RL0BtckiIcgP1eXF2dRzJETME07tPHp+tcpR0Ge3VaEFH1Qh7juQLkSVuTsXHYVQIk2ARHEquyvtHMpF+k2GZJDbuEwwvDXvUt0kx7WusonzvQR3ilNakYRrUmP4m\/y3inqVuBXiXPojpihmbrRYvDTxp8aFnCyLBD+4UudbNOTqA21FGiferbFljS4nJOyZ+\/L8tMJAdLDjbsojYZbqbFcXRas3rDliHRvuklu+zvjcUpimDzI1xEQNTSlyH7\/vZZj\/onFT1qPlAwhdK1abHRZTkUvSdYZK0VWve9J1pr\/W8XAwEAkNi411iQFkFYC1KpEPslN0Rq3AZTauftU0I2nfn3JJzv1tjP+UMG5O4ZQEJikGPqavG\/Cjl9XQJi7R4KHJNlc89Ehhuin1YLVtmaqBPDBwCeib6B\/Js4yaNtGBIIfA2BEqTn+zDkU2usRQMZNV5ZUoM2DKUuB1LwjyQ1pfy4w3u\/+H6pB+\/5oY85lj42IFrX6hcDAQBwA6+ZllICNLIYqudd6LnzQzO5vZMvavoO8gNeyfTP+O2TNyPOuHuf9ojNmlZq8+IQ+TGZ0fN8ndel7SA9gUuvvHui3AObULuaFAc8Jf0hVWll++5Dd3VH6rqn6Aezt7kgWAQbbBnNgnWa3OdoSWW1BBcDAQVg7Lb1JcqrwNT6xvkeBAHh\/hN7djvs4KyVjydiL1Wu\/pFKydj\/pydJkY6YcrhaCq0+uP5DSyCKGMjvOJM\/B05PMa\/d6ug9QynNE9IIk6ABU2coZim4xt7TU\/7mSHuQmSYFaHxyKp1zFYgTqQN2amxZmir5vm0M4t3V8TlzNXMhI3yExAj4UW2qlseL24V9ZFbb5cNZCT7BwSp3LwFLnvPn9IUvcnfgHi4G3ZgP1AIFUj4EvzJltMjbp5k6DQ3lBs65TEcTavZIrYa7mkFXf1Fml4qzZFGl9iWoSGOIRh4XHRV6onhR20SD8yGwythnz9fiiafXn1aF2soWuGwmReSWWLMp9C7C55sBXOrVMsMFQofRH54pvfHP4cUksbMJYLEefHowVK0UWQEHsgJYZi\/7QuQBPNGjRTaYNM2ac5Si\/r+yeHXuh57iACOZ69SiMcOCVnhofkBWzx5oq5G+uJ47crOUddlLPHnP1DTIhQx+2o62cZgWNhPLWqYSsmjXntCVAKTqyEwqgenOy\/x+OrFV7wLOsGcSbrXD3n8FTZYNY7nK5gBmMXiN0KCSgmeqQRL9uKdt0PWc4Gpad3Kwon\/A66BxDFU7qHU4+5H0O9nogl2GQeeRL9wC4vHLUgQMWIqxBSj7joNbsiCEAdFlorBI5JoGS0yFbARFc+bT+Egl3Kwm62m2HWrM8YW1EsaV9BSCDTscqD8\/iWhH\/6LLLgtij\/NUDZQaeyF5\/mofnuayDAsqRaUzuWTbKoC7dqEFjw8EHFUjwldO6aN54JN7vGdmLVCNXIBCva\/FdA+FRBUlttuYvsbqg0xbu3c0N90\/7\/7xCL8yn5+Nfb77o\/LOt4ryiv4eGp2S9OQlPpMftEb8lMdu3Cprlx8YWXTsmWlSXX\/RB+cFUP\/o\/IyuEEhOIpdFGhlfvG6ZqCcqVrrh1IQXSaUN9iRc3R6L81nLxFHs6\/sjMUv8+euHyocu9Lvu8\/1naIk6oAdk+MQsvJhLZyzk5YnUHizhYyyh5Nkj2+1Rr1N13uphu9K5jFMAs3c9hKactfTQ1nwsdGlhPirovhC\/GQPu6WuhcZr71nynvcJG3xcqiPYmUUa7h5ZdF2+z7vsI9Z8\/NYNKQrjnj9KX0CU9RWY+n7u\/+90NA\/II2YdUcve2LgAyfdF4JBD8\/DXsiCOcR5lyY5ts6ZFQdFP2slvwDrWaKEaeWbJsK\/fDvKaqnMrkXqi10m7lt6Ziarw6rVyBFmkYy6qzuwR3v5bulTeEXcl3jcmwlmTJzfvIrdiwDn9Uz9091sz24BLoX7CUh76QnMpMn\/z23d5PwsLHoG9\/cINkcD7+ZVBjuFvgrhuowWg4fSdgx9m2Ow\/9UEwODiOs7SSTSMcCCZ+ez3IanpDDx7W98OLFKHgAmcqavSmyJXdP6mvUgxF114\/jIi8qjdwBT8Oer50BfzfPMyEFnmqEGpNbUDwf0qS\/qzMoJxM2vt411Z3EqWJSc4jjEry846kiFJPkgztpVak1GXaNDWXutXky+gG\/PW\/xmGExsvHMwxanpv2dTw79q1DecdGLdbvxUWge686Yv2\/mwyUgagHAZ6srcmr+Z7Vx0DM1F8MVBdsGhq2w5SQeHiUnTg\/K3Og2uSjGrwu4k4Eep1CfYTcQXx6Mm4u01mB\/SOEa4iEKKuHDD+ENPUZeltQcLPp8Myq+jq39k60D95NYdiKV6MFw+Qf7P+aDiHf9vHHYHfGkVM8MWZTWZcsanzsgAd9Y5Es7XQyzNNOIXk+a5xJs1VRHlVgeSS7n4+bdTHhueX34ZQfEAVlcEkgw4ghOazh2s\/GBExA0KFXUYDmb1temqca4BSYXAwEFYNeQA1Amz7L1rzXo3zwpLwXGFCMYG38r+wWI1Pw1FIW\/tuFms\/l4VDIzJ4hUEVkmJHn\/maLf4OfIEbXAP3Yj3VyQn0gifCDr6yrUlzTImU\/n9LgwUo3BI91s8laFzAh9QndCoH13rjABj0S7SsFVmLYo7BkPeASkDGOZwZeVCvsTCoJ0537I8dBUFz0q348Skw0bvOiDHnaJuIPpPh7KV8kHHsgWxuZTEvkf4YZOhodQOJOTfsDiZTf1TiPtlRJOAVTXJz6XMPc98AEOllLji9euCAtO5Gz+0S9kSsCS\/XqcYeB1j0auHx\/b6YgQ6HkHbHK8hRWbiTSTroR7rTwHVZJG8jWEfhMHjbgrBcd231La6ireUD1FCfYfXLAqgmLeP1RbgmijDCFvgRWd5oJCdFomJ57\/VZsQNTtRka0cpiic4FqJRYCm4v1z9E\/g8+DeWm\/vGBHrZEDMKR4Gslauug\/TXTaK9bTax3JvcqF1kKGwGjnrvnBNK2uVCe5Sc3xE+fMcoQCAG9M6m96e4yV4VzQ1Oi8r0UxjYqzM\/Zpf+KN+QxrTJ0Fu55gkpjzQd0ikM1RDfB\/nK7hQ0KvrjTP4i5euhF6PN\/xKqJkbiLRMTuzkY1tiZSyKuaLY5wubOh5u1kfdClpTFlbO2UHhZ+FOxS5w27UQ6RJrYYRlgn27IS5KxlydzYobRXoUF0bgCAg5Eg7zH8vPREHuJvx\/oolzM8C6bH1VIpT5v+vrxLnrb8E2W4miZuZaeq5RrzVE6HRJyV7y1yoNDkeHY6JVltLiRtVB5cTzuNUz3QUHLUZkG3Ic2okiUVSsAkwUmOCzEuB2fZp4q51Oq407YXlwgEYWqyQhsc3pgj2vtCAh6QVXHZXBITzz01RjeHwzJfUgNP4xQ+WZp6XeYYSszB+2F7JqAgJs2TGIC5T3QQdD1Jm1mW68nEcMDg6q7tY2eaqp3LtoLUII7kI++P471z9aV1YKecsZZjAYjDZX+7pbqC+IR0WltOVRFtA3H5KQ\/KoRxgr3TD5fkcFdGA0RWrGttrCvIZ5i2YXWLODtTPITrOR\/yYfsFYJdJBhay\/y7ZDB2mj8Y34T0Ik0vUs8PUwW54Q4hBlBq6KekUmgwL3tiP9KxRt4XNk9iMaWcsS0pYENanKfYoa7JCrRXxmt+jFE\/6woYQxe3qG5O\/0U0R\/ZVEENVZyvfaxh5gaAzzOb0JHt91IVjprRvfpCvxukai3VHsDSZRcn69qeRhKU0N6++kqOIe3rwVRNKB9YZBkEjecbUc7Eh0Mj1TsJe2D9N+9Gv1ExxueKlesmPPZBCmNZSMo0AE1DSXXbKGSHWbyJbTEru3zvJipiIuUlskEJFvBEtuH+yFTjLksyh28CYZlnAboOVCf7BRl8ZF2WA1zw5bd5nZUoe1oMZMQhKckEFFrGIsZz+T5pJdyBTVCaC84bgn3eoRB++Lv\/4e6M9PyvGFoYYg6CyykA4ryrhKsTdd0fkALMM32msGKLqQ0PV4o8NqoWeraJCfLNojnG48scWkah9a\/G1n\/5XT9tnWe6UKSpqWSivu0aE+BOvyHQisWcBCwWBCRemUhE6OGFygMDtjl5\/84EFaK44VMf8TookbNeN\/drvO\/XqtePlhACLd8RmE7vz2fVj\/UIm1BykuYuXhy5NW2nndr89\/H+R8JOrOuuOFxTXynBwXqbnmDa2\/ayvJLprBMvjSjIOK41fhicG8GXZBAN55ZwcgdU1SqFf12NK6VwLJQC\/63WB0Mmhl6oemEBnvAOfWCSRvxIqEI11RS1V0tJTDaQMOH4l9g0rzpb7p3R01pvQr8LaF8ygfM8TOdAQ7iv2FwMBBWAhy0xDKsHFlIlnzuoyK5SargP7jlOmU\/bwO0pca8kuNygxpWiVvmfv3sRMIIGiWyg\/\/NLfsnKPzTpHjtWjF78L+o1F01lM7dApDUjR1AFGSuX3obSNZgvPQP0rAd1z60nd739vtftgYqf95LLPO8R8uM7fQ\/vV3yXCAayTRefOF\/By315dYNgFkFvNkV9\/9da2jUHDAxnyqI64At1ebYtagwS6jgMXmasEIRT9vjbHtwWsXzLgDypDWwT0V\/rpnKMmOs524Ur2Gi78lnuZi6xxS+fZeFS27ie7ajM4er2waCw69YK1hxR9CeO+9qF40ioRuYFTqxn2xFNR6O3N5m82+dA4uXugmx0KHHyC1XZR7VXAHwTOsQ0i+CWVyo68sWlJc\/HOYVLI4tBZrauBFmBEBJi8l7cZddoqYddBXsiSF4W3DIUVYK4OEVeUcb3KStn8akIeaqWucRxrZ9j7grx66s9WbO2n\/90aoYvi+2CSbh7kZWhbQIz7lnJVhLT28Yswx8MbwDLNuNVIAnoYDVoxmvai65z1FddzT17SUSob\/c+PVOcruNKBwhLr4AWnlh8iNRqYu9faqrMzBPqr1ySaBHnJFbcaXCwkNiuxixF4zNnalDZ4J+c9O\/5a5onbZmaWDxbH\/xWupeNBtt4dtwywZ+SH++az1dIpmYOjhMHe57dPNtsnJOfP6Fa93Nw+6ZnDb3mTlWTmrzGanHZmEVu6uhYgzM3Vi0RSYxqsMZcd7Jii8tjicvvedKUoTX5Yq1Z6GtE1+BvDXNG\/otFyQ+yawhu5a\/ghw56tdP7uJdK5YXIVLq7vfibMedfjqZQtTcBp6Y2yq1mzUYUHOp4+2sI28OGLJFBPhQblGEofGFxds3g0iAz0DuVYRQ8+RXQpdiMLlmeLDTi+2pMcwm8eLV2eXksj4G+NpQ0kLcL24ZXc\/gkEGgGuN3rI2ff6m2+FDbwe7+Dsz5smvShZxdw84dpBtfRSC5\/7VVaIGDDWVyIU37OUZ8Wmh2my1KPG5p3Qt5RswlEj868bmDr0yL0xcWFdG1GaktWDOBzf\/qFD2oUW7QZ\/mC5RD10Ph4MnjlFq8Y7d7+btrC3SplH+ZWjn7CsOnfTFOlmjG3OnhLkLMn5HJIK\/XAMgz+SljnIIGmnZQpHnlckscShqABNpH02G5sfTymrDYrAmKSwb5j8s3bpLYFjHX3OtY1Pxg7BO5McFq6yfkW\/vw6uF4oC+nLIwjia3odaYXXV5Tqhwx9xaMJCPWfeduOTWnu1T1z1rNl\/VNpFKyXk\/YsbYmSPEoNhqm2VCWaCbsswHZo78\/+OvSad8tm91u00BmjSNKCpCs6LrjNdhek6RT4HVRKJ8uXqK9jN1M4uZyBql+dPr7XVu4nI9fUxa2tl4llG64Qr1HqedRFLQreHPMvzM3QyOMxhnWj7eS7t8BIGhiurOf8Mc9NlYgSV4KuftVt+kHBgeNPw+CSLWDqaWLBFcQxdcymvf890lBvTTWsivZAio+J9FGqt4DLOy3seM16lMDHWlw+g5b69sAreSQU7jxqwLsEvxo7uSDYItdUjERPrnTmYHquTXeZ4sJeK+o0ryd1nGqhIMmMInZsZSvod9lzOJV\/RRRur\/42Dj8rpJ7rJwCBAF3LbQFDg\/WGjdRpXqHDNIv0mftuotwrnUjFLwWMM\/XYa4jVaz58KEIQQCY+lq6SGehaT1MckNzem1Ljms3384mzm4TuHzHbb+Hxuf9NrSf8GZPkMDUDaxOCbFfdBxrine+0rM4bedtXKgvGJw62rRLXuKIhvVc7kR7wV891X2WounnBJISxBgBARbdP8wM53Hx2PVlBcDAQVgVQ8wbgcYEb1o5lZDD08EkRS+7JcR\/qUEd+T\/AYBnG2A3M4eoBRAeGICxLex\/PUQfr+FCmQzvdwERaroBnzC03J7d629z6gyTa4CcDvMUDdzKd9F7SGJzyAI8ZwBXJBBIiOQJhFIUuXsHaU5jfdMT017bTrRwNzmKlvC\/mqSjOz6tZPPRHeNcoX10Y4LAFDLKinF4FXWZH0GwcSbV8UPdW+9t1mZ7JKQCNTSyM76CmNxGORxa\/NF90sL+5QXrVrX6BkP4SRc8MhNBpO5dcRUEj4xAWjNbFAk38vVnItPw6AVMXK1WnaqzTMfRzDZSmzxv0JxdIt32zW1o7xZLHjxLiszCKV41yUYJ88X1+6i7mFpA0iQKNFuBpeI9bIB5Ch7rykSP1zPljsNRu\/7CfPAxdUbdYgsqo1AN+7mTUms1xmo8aMKLniqN1tLugH63OF\/OTHM9Hch7b7MBINBP57MLDVuVAdOerMl1NhMsMq5B4PzzXWGAwoRblzlWjdGWaEJQAwiXvay0g\/VBdTAUhF5YzbhhRGUAygNeKPqX+Z3BjGbuEVxfOuxyhB3SjsUH72aE2w7uC5bHcPDFGaLHZ6xKVBeIe391engCad8zqo5SKJuopRyg5grgUHr1o2KaIhArDwBNyYsIE7lWK7eWVy921xbIjZ5KhlDwJwQwwxkw\/EKmJ3S3ofgT5LNLKoJ+CB7rUT5EQ6lhvLJjouxdeiomKcRMKhZL3W42ltK4gRFDiNRmaE\/28fsw7tjDP\/Ky1leYZ6tgoTJYRnL7o4H7xqQczQcy+rK4b2G9i511UDp\/UXwIUeBBX6ZJMVKRV+nESRD\/uj\/lEnJCjri84eVbpQNHNIQhyWG2kKHokRsOFgLkhgPrAzrS\/ZBtLeq0MIsD1i576x2CXVCwB3y\/Z09uVygY1PIog13y+P\/dRMX\/FIz+lIjb6gqnN5SJAT4+apbOPty4bbJ2k7EX4Izov1NuHz49a6aybV5+Zi4hPUEHIOtDOng24pmURtEb8QslPUevMPCnRQN9npcPf9r3i5imItyaa18QouJHhH8VU68Z7Ba5cLj3ihPQzBUh7YpvhuLQY4Mr\/1WpSRrwKG5YyAQPEUJ\/a+CGraThOSAPr9DvJa\/cs+Gp8qYFixe+UvMBuC7u6OgfUvlDzxaeiER\/mtBXTxlo4PpwKK4jWDYiZxPmVq7pmfGUToPvQ+GttK+ZN\/SNvKOsmLdloN6mjepuFDNKNLE5iUc1QWcWxXp9DS1DDGj83M3n1r+GiWbkbEnoo5dnbiJWRqsBn+Dd25LYBa+t1zjR5q6iY\/fN6\/On+h7jJfmi65LCNyMrn6OTwrUV4okhFcmlo0usnJ0XuQFW85znaiaJk7hcq3RbaYSeNVx24JSNHXu8CoZHRXov5eFa55n5zCOP+JQCgyDkHrilQAxGdTaA8LsisYCWwdzrrn4Crf0GGWS2LAFtEF6EorU\/Ven2u2Dpb+wzNW9tXYXaxMWH34ZK1YuzR4aZFKs2FWFw+yVvId\/AZKTtp3UUpImKNQwa27CzyQKR3XzSE3uj2WX3FqGjgLr2pcbwvPzqw1VfZveicv9tMSgeDIDpk1crGaYay17YEbM0U0DEN4QWq2M7pvt\/lU2BSvWEKT6enLdz8AI1Sqg4pxSx8Q+ZTMYTqzs6Dr9K5hShgZJO4V6sJ6U3bgyJGq+DSRog9\/37Pg0lD4KtOUQgmQLwLvjVtLxQBkr1DSuOELSZPX+SKNghCreMZf62oInc8sDtoUzX1w519L6GH9225kk7ERGFQBlg6jhV6eYwtDiQy7GLogpRaRCFYmqYRKccgA12DIgWjLYHay2znREXAwEFYHD\/3FlE6PNaQkI9jkDDEvLXLqt3yuM\/DbjpOd\/rivjc4m5QwP9yh\/qNnBixgwGJjZ33cwl5\/H1skfiS07TQlMftVlirB6g4ic1YzHNJAKiYhqNqMVLrXoIwvhAJ4AajUxNN3\/13K7SZfPLTcD+oGZ7N9J96cisFRjDeLxXBMgqOyqWwFeRoWmBTT\/Kr2DRQPaWcomO3Lcbo\/Jed3BMsxWYC0iY2VRuZsmxbqCyqBRncRQv4\/7AEq5tShfZvASQgciFkGowyd+wRqWwxj\/h\/q9PZcNaioWUTfA3S71OxuScsIcEnw0sARxyMXTpIF5dyHA6lC7YiAfmZ3KJVKh8IrS1dNm+WhkAAzAFMHX3kZIOG6rIqT869XsbhjVmftjO2ois9R7AtITzqVns2hjq0bC52m4fmlKb3zdUiWkHqImzs3bzbuNFEEHZiwe8CrOW1dVcbYOIDiho4bo585XIyRrWsDPkGdwiQlc3ambCtvPTa+yj54rfet97m0ryB8qZT3jbHNf7M6\/Kqc+cdZMuUfOmycpV0\/R39H6DTe\/NkdXMRBO8yNb9iTNzcuqpEJPIuXcELVWg7JUOMm87XFdhpiRLUJLb\/sUOIusvW+BKjXeDnqRiHLbm79ZK0dq3CGRkLJdyfhwKcUw3aHpmrklnBU4X\/HvNmCzWI0QZyCL6Z2uLsw2Guaiyq\/V0CpwtAHsaxgb54kEs4qDx229b6m70NGQfkXqY1RKtfGZSRbL+oZgZ+Uag69IefeZWoBSyPzRjgG1M2tMtviVxsTiKzMApy1E6FUmzePD2XKFPiAHrBB5y2dE0xnphCGtkwZeMFjw\/gKdK3ECxyVG2rGUJi9\/CPMj4mZz+uLk3jmBO9u3SOX4zopLWT0IgNPpRAFEtRutSSLjXiPZ+0U32AHj6RPMmZu5\/8B4+oWCqqyQO6AUWhC636zyhK0LD3GzB8ivAW7zyjb4R9gtrMNIsksLEVp6fa5NHU8q9M5FJF\/h1T3jvlOXbXEnvOKFNDqHgBBBDdvWZlnDzpdXCFV2xLToJ4CxM0yf3UCxSJXvpscawrSyZ3QUjX8YmGmhGW9rfxp9AfPy2QDKGGsprT7PQCxFwSugPyDhgG\/LH2jK3sbB6zGZeZ9FMVw5ZaEsB3JXVanm4e7XXRPAHj3YKBzGG9Tw5HL2\/K0+CUpul23ZbjIRQM8\/tSnGY1ywFpNkX7Y1W2IfpOBI7KFzX9TF9VEE7PiDZcqvaTGOA4\/eAqtZT\/mGDprJvxjtckxk0JG8v8QRDJy8KNfPTjc4QpDfs6Oz\/MwuNBAiX7sjydWiv1kh4EtmXd3F+GDn1LUiNUVH\/yyzN+QQ96afTLdR5WGWtc\/WSyk4vVlWB9c7pLCJnW\/fny7WR52RR2v9lJCX68IUfz9ErFMTMNCrkoPripWrysQ6Bz\/OttAUCFDIQ3fQoiYRGj\/o+W\/Q0r7B+CMBFZ7CPUGQ6JglNQspEF\/YLez96AJ6\/nntxg7Ju7n1hVFYLfu8vZbxi932IxeY2qfSOY38UdnSr4Fv2m25lrAx\/h6D9O7RzacHd9kgbadWYZjzM3RSo1dZWHycOVLtzAe7vN9GA2wkokhf19rIIzNnCKbb7Ostce+7Ig1jGmUwLMPHeqgUj8qXHy28dFIiBlzuxGJMG5IZfZqsFdlQVNfPGYBCxvf7lNtn8m43kEj6JM+gqJTxBTuW7RWVebiykN4P14YQmOzKROtWy0TaivfUujEmxzwopbWj+FFA4dXElDjq+c+NCv6WwTqq2KnLkFRFiARsdydwSEGV9y3eEwMldP1z1MxliNuwp6DmHENall7EIFfhZ+z4YTES\/JnHEnFwMBAiBBF1uurGrByHr+4t1R1epIcy52Sce2ujuiKlqZvktniP+SSVsTbZRDkgTt9DtdSBdB8lCxsJQSk8qREy0Icl0tKFuBqJWB5KbqbAkIhRoCjCOZrDu8O974BQDSrAex3T0Xlz2QFMk+5rcWAwMpfy7bSk2mI33hjWvxh6Tl3YXYjgJPKtttznSUbUUDVmk+8uMamP3d4XddjMSmHicrjVVWHaikYUC4Cd9OFoiw8yyNTJwDOywE9D9M606m6jnht3dfx08Xu73+7eSpMeU+a0tdeU72VVHgpvrzR3RLW5QFqA7xs+BlqVm6x0N3G0zBh51CXes6jDIrSZB6oi9fs5DGqxL9FN7g2BCwKDtn5C8qwSaH\/GB5CRIEOI\/eqfmXXanpQUJCZuH\/5JKpVOhos9OVPHLiFvCRZ9l+vvkL0zUxS\/Pi02ztJ27gUXRUCpnldKr0Gf3uTV+YigWxsPihOmMCrIaMVWHMyGXFUXtlqChxrwXlAFaCyqQGRzXy40DsDIWvyb\/I6LDg9EcyMXNbilu6yjukH9p4A13\/6PvZgTxX8QJRsS7TQAOhuTCtLX2tbD67bo+P1d8WPWTKqG51Uw3LrBhwofzD4sUgwmhbnftTdCfMd4n8vAfsVHzQm1uCfTyYir8wxb78lR\/gPHuXOouI7xOffJZNd85yU3DlsLHF6yN1QmXFlEk2q6fW2JtMrsgWoL5xNmj741B0E1bu6APf"}
-00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":12,"flow_first_seen":1444570699096,"flow_last_seen":1444570740249,"flow_tot_l4_data_len":1383,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":115,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"78.46.237.91","src_port":59756,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":10,"flow_first_seen":1444570699101,"flow_last_seen":1444570740248,"flow_tot_l4_data_len":1051,"flow_min_l4_data_len":20,"flow_max_l4_data_len":517,"flow_avg_l4_data_len":105,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"78.46.237.91","src_port":59757,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":22,"flow_first_seen":1444570637191,"flow_last_seen":1444570733113,"flow_tot_l4_data_len":14608,"flow_min_l4_data_len":664,"flow_max_l4_data_len":664,"flow_avg_l4_data_len":664,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"172.16.1.75","src_port":64538,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":15,"flow_first_seen":1444570636264,"flow_last_seen":1444570640345,"flow_tot_l4_data_len":4707,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3959,"flow_avg_l4_data_len":313,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.99","src_port":55969,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":17,"flow_first_seen":1444570636155,"flow_last_seen":1444570639261,"flow_tot_l4_data_len":4715,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2547,"flow_avg_l4_data_len":277,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.204.49","src_port":51646,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00484{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":11,"flow_first_seen":1444570640298,"flow_last_seen":1444570645704,"flow_tot_l4_data_len":323,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.204.49","src_port":51676,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":14,"flow_first_seen":1444570636160,"flow_last_seen":1444570639259,"flow_tot_l4_data_len":7320,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":522,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"209.197.222.159","src_port":47498,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":8,"flow_first_seen":1444570675941,"flow_last_seen":1444570690940,"flow_tot_l4_data_len":367,"flow_min_l4_data_len":20,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51833,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":8,"flow_first_seen":1444570694561,"flow_last_seen":1444570709697,"flow_tot_l4_data_len":367,"flow_min_l4_data_len":20,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51839,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":50,"flow_first_seen":1444570716599,"flow_last_seen":1444570737975,"flow_tot_l4_data_len":8660,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51857,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":3,"flow_first_seen":1444570719041,"flow_last_seen":1444570720045,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51859,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"}}
-00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":3,"flow_first_seen":1444570719041,"flow_last_seen":1444570720045,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51859,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":16,"flow_first_seen":1444570636180,"flow_last_seen":1444570636961,"flow_tot_l4_data_len":7424,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2547,"flow_avg_l4_data_len":464,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.231.3","src_port":45814,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":15,"flow_first_seen":1444570636259,"flow_last_seen":1444570640345,"flow_tot_l4_data_len":4707,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3959,"flow_avg_l4_data_len":313,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.100","src_port":52219,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":11,"flow_first_seen":1444570636270,"flow_last_seen":1444570640346,"flow_tot_l4_data_len":4210,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":382,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.200.11","src_port":47841,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00484{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":8,"flow_first_seen":1444570636151,"flow_last_seen":1444570638237,"flow_tot_l4_data_len":243,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.213.212","src_port":41726,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":11,"flow_first_seen":1444570640284,"flow_last_seen":1444570645701,"flow_tot_l4_data_len":323,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.213.212","src_port":41757,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00515{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":16,"flow_first_seen":1444570718801,"flow_last_seen":1444570739041,"flow_tot_l4_data_len":627,"flow_min_l4_data_len":13,"flow_max_l4_data_len":50,"flow_avg_l4_data_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51772,"dst_port":9000,"l4_proto":"udp","ndpi": {"proto":"Webex","breed":"Acceptable","category":"VoIP"}}
-00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":16,"flow_first_seen":1444570718801,"flow_last_seen":1444570739041,"flow_tot_l4_data_len":627,"flow_min_l4_data_len":13,"flow_max_l4_data_len":50,"flow_avg_l4_data_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51772,"dst_port":9000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00519{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_first_seen":1444570631058,"flow_last_seen":1444570631059,"flow_tot_l4_data_len":72,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":24,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"107.20.242.44","src_port":59447,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
-00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_first_seen":1444570631058,"flow_last_seen":1444570631059,"flow_tot_l4_data_len":72,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":24,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"107.20.242.44","src_port":59447,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":17,"flow_first_seen":1444570636255,"flow_last_seen":1444570639258,"flow_tot_l4_data_len":7412,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2940,"flow_avg_l4_data_len":436,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.4.76","src_port":52730,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00507{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":5,"flow_first_seen":1444570640346,"flow_last_seen":1444570640407,"flow_tot_l4_data_len":147,"flow_min_l4_data_len":20,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":29,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"80.74.110.68","src_port":33459,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
-00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":5,"flow_first_seen":1444570640346,"flow_last_seen":1444570640407,"flow_tot_l4_data_len":147,"flow_min_l4_data_len":20,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":29,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"80.74.110.68","src_port":33459,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":17,"flow_first_seen":1444570636248,"flow_last_seen":1444570639255,"flow_tot_l4_data_len":7391,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2599,"flow_avg_l4_data_len":434,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.104.140","src_port":44492,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00506{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_first_seen":1444570630272,"flow_last_seen":1444570630272,"flow_tot_l4_data_len":72,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":24,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"185.63.147.10","src_port":54651,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
-00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_first_seen":1444570630272,"flow_last_seen":1444570630272,"flow_tot_l4_data_len":72,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":24,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"185.63.147.10","src_port":54651,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":14,"flow_first_seen":1444570632436,"flow_last_seen":1444570633205,"flow_tot_l4_data_len":4726,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2923,"flow_avg_l4_data_len":337,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"23.44.253.243","src_port":49048,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":17,"flow_first_seen":1444570638225,"flow_last_seen":1444570642072,"flow_tot_l4_data_len":5797,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3717,"flow_avg_l4_data_len":341,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"216.58.208.40","src_port":43433,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":16,"flow_first_seen":1444570636359,"flow_last_seen":1444570639256,"flow_tot_l4_data_len":6555,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2599,"flow_avg_l4_data_len":409,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.97","src_port":51370,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":11,"flow_first_seen":1444570640330,"flow_last_seen":1444570670371,"flow_tot_l4_data_len":323,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51134,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":11,"flow_first_seen":1444570640338,"flow_last_seen":1444570670373,"flow_tot_l4_data_len":323,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51135,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":105,"flow_first_seen":1444570669736,"flow_last_seen":1444570738301,"flow_tot_l4_data_len":15716,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":149,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51154,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":513,"flow_first_seen":1444570669745,"flow_last_seen":1444570732084,"flow_tot_l4_data_len":326644,"flow_min_l4_data_len":20,"flow_max_l4_data_len":29662,"flow_avg_l4_data_len":636,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51155,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":22,"flow_first_seen":1444570674487,"flow_last_seen":1444570675890,"flow_tot_l4_data_len":5807,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":263,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55665,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":23,"flow_first_seen":1444570679512,"flow_last_seen":1444570680667,"flow_tot_l4_data_len":5859,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2547,"flow_avg_l4_data_len":254,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55669,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":22,"flow_first_seen":1444570693238,"flow_last_seen":1444570694561,"flow_tot_l4_data_len":5807,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":263,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55671,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":11,"flow_first_seen":1444570732086,"flow_last_seen":1444570734115,"flow_tot_l4_data_len":343,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51190,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":22,"flow_first_seen":1444570712008,"flow_last_seen":1444570716597,"flow_tot_l4_data_len":5807,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":263,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55687,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":8,"flow_first_seen":1444570640382,"flow_last_seen":1444570699865,"flow_tot_l4_data_len":396,"flow_min_l4_data_len":20,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33511,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":24,"flow_first_seen":1444570738415,"flow_last_seen":1444570742172,"flow_tot_l4_data_len":35072,"flow_min_l4_data_len":20,"flow_max_l4_data_len":14339,"flow_avg_l4_data_len":1461,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51194,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":18,"flow_first_seen":1444570640385,"flow_last_seen":1444570699915,"flow_tot_l4_data_len":1360,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33512,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":5,"flow_first_seen":1444570738419,"flow_last_seen":1444570738426,"flow_tot_l4_data_len":183,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51195,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":18,"flow_first_seen":1444570636364,"flow_last_seen":1444570640403,"flow_tot_l4_data_len":6595,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3959,"flow_avg_l4_data_len":366,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.98","src_port":37129,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":11,"flow_first_seen":1444570640310,"flow_last_seen":1444570645707,"flow_tot_l4_data_len":323,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.98","src_port":37139,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":21,"flow_first_seen":1444570699916,"flow_last_seen":1444570700460,"flow_tot_l4_data_len":1816,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":86,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33551,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":20,"flow_first_seen":1444570700561,"flow_last_seen":1444570713719,"flow_tot_l4_data_len":1795,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":89,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33553,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":18,"flow_first_seen":1444570700563,"flow_last_seen":1444570713710,"flow_tot_l4_data_len":1360,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33554,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":13,"flow_first_seen":1444570713719,"flow_last_seen":1444570715293,"flow_tot_l4_data_len":1291,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":99,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33559,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":14,"flow_first_seen":1444570636170,"flow_last_seen":1444570639257,"flow_tot_l4_data_len":7320,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":522,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.153","src_port":57647,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":13,"flow_first_seen":1444570636252,"flow_last_seen":1444570640344,"flow_tot_l4_data_len":4250,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2862,"flow_avg_l4_data_len":326,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.202.139","src_port":47116,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":11,"flow_first_seen":1444570640269,"flow_last_seen":1444570645699,"flow_tot_l4_data_len":323,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.202.139","src_port":47135,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":30,"flow_first_seen":1444570699074,"flow_last_seen":1444570740247,"flow_tot_l4_data_len":8548,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1468,"flow_avg_l4_data_len":284,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.241.32.14","src_port":46211,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":95,"flow_first_seen":1444570624853,"flow_last_seen":1444570630376,"flow_tot_l4_data_len":89006,"flow_min_l4_data_len":20,"flow_max_l4_data_len":17700,"flow_avg_l4_data_len":936,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41346,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":56,"flow_first_seen":1444570627404,"flow_last_seen":1444570630162,"flow_tot_l4_data_len":107792,"flow_min_l4_data_len":20,"flow_max_l4_data_len":17986,"flow_avg_l4_data_len":1924,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41348,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":11,"flow_first_seen":1444570628113,"flow_last_seen":1444570628619,"flow_tot_l4_data_len":639,"flow_min_l4_data_len":20,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41350,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":9,"flow_first_seen":1444570628117,"flow_last_seen":1444570628568,"flow_tot_l4_data_len":599,"flow_min_l4_data_len":20,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41351,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":26,"flow_first_seen":1444570631722,"flow_last_seen":1444570633204,"flow_tot_l4_data_len":25500,"flow_min_l4_data_len":20,"flow_max_l4_data_len":8414,"flow_avg_l4_data_len":980,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41354,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":38,"flow_first_seen":1444570633357,"flow_last_seen":1444570635974,"flow_tot_l4_data_len":41190,"flow_min_l4_data_len":20,"flow_max_l4_data_len":8867,"flow_avg_l4_data_len":1083,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41358,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":17,"flow_first_seen":1444570636387,"flow_last_seen":1444570640346,"flow_tot_l4_data_len":7823,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3959,"flow_avg_l4_data_len":460,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41386,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00484{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":11,"flow_first_seen":1444570640319,"flow_last_seen":1444570652361,"flow_tot_l4_data_len":323,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41394,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":14,"flow_first_seen":1444570672215,"flow_last_seen":1444570673280,"flow_tot_l4_data_len":7763,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3959,"flow_avg_l4_data_len":554,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41419,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":12,"flow_first_seen":1444570699096,"flow_last_seen":1444570740249,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":536,"flow_tot_l4_payload_len":1123,"flow_avg_l4_payload_len":93,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"78.46.237.91","src_port":59756,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":10,"flow_first_seen":1444570699101,"flow_last_seen":1444570740248,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":497,"flow_tot_l4_payload_len":831,"flow_avg_l4_payload_len":83,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"78.46.237.91","src_port":59757,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":22,"flow_first_seen":1444570637191,"flow_last_seen":1444570733113,"flow_min_l4_payload_len":656,"flow_max_l4_payload_len":656,"flow_tot_l4_payload_len":14432,"flow_avg_l4_payload_len":656,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"172.16.1.75","src_port":64538,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":15,"flow_first_seen":1444570636264,"flow_last_seen":1444570640345,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3939,"flow_tot_l4_payload_len":4387,"flow_avg_l4_payload_len":292,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.99","src_port":55969,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":17,"flow_first_seen":1444570636155,"flow_last_seen":1444570639261,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2527,"flow_tot_l4_payload_len":4355,"flow_avg_l4_payload_len":256,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.204.49","src_port":51646,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":11,"flow_first_seen":1444570640298,"flow_last_seen":1444570645704,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":5,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.204.49","src_port":51676,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":14,"flow_first_seen":1444570636160,"flow_last_seen":1444570639259,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":7020,"flow_avg_l4_payload_len":501,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"209.197.222.159","src_port":47498,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":8,"flow_first_seen":1444570675941,"flow_last_seen":1444570690940,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":187,"flow_avg_l4_payload_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51833,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":8,"flow_first_seen":1444570694561,"flow_last_seen":1444570709697,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":187,"flow_avg_l4_payload_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51839,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":50,"flow_first_seen":1444570716599,"flow_last_seen":1444570737975,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":7640,"flow_avg_l4_payload_len":152,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51857,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":3,"flow_first_seen":1444570719041,"flow_last_seen":1444570720045,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51859,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"}}
+00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":3,"flow_first_seen":1444570719041,"flow_last_seen":1444570720045,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51859,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":16,"flow_first_seen":1444570636180,"flow_last_seen":1444570636961,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2527,"flow_tot_l4_payload_len":7084,"flow_avg_l4_payload_len":442,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.231.3","src_port":45814,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":15,"flow_first_seen":1444570636259,"flow_last_seen":1444570640345,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3939,"flow_tot_l4_payload_len":4387,"flow_avg_l4_payload_len":292,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.100","src_port":52219,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":11,"flow_first_seen":1444570636270,"flow_last_seen":1444570640346,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":3970,"flow_avg_l4_payload_len":360,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.200.11","src_port":47841,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":8,"flow_first_seen":1444570636151,"flow_last_seen":1444570638237,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":7,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.213.212","src_port":41726,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":11,"flow_first_seen":1444570640284,"flow_last_seen":1444570645701,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":5,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.213.212","src_port":41757,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":16,"flow_first_seen":1444570718801,"flow_last_seen":1444570739041,"flow_min_l4_payload_len":5,"flow_max_l4_payload_len":42,"flow_tot_l4_payload_len":499,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51772,"dst_port":9000,"l4_proto":"udp","ndpi": {"proto":"Webex","breed":"Acceptable","category":"VoIP"}}
+00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":16,"flow_first_seen":1444570718801,"flow_last_seen":1444570739041,"flow_min_l4_payload_len":5,"flow_max_l4_payload_len":42,"flow_tot_l4_payload_len":499,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51772,"dst_port":9000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00527{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_first_seen":1444570631058,"flow_last_seen":1444570631059,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"107.20.242.44","src_port":59447,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
+00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_first_seen":1444570631058,"flow_last_seen":1444570631059,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"107.20.242.44","src_port":59447,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":17,"flow_first_seen":1444570636255,"flow_last_seen":1444570639258,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2920,"flow_tot_l4_payload_len":7052,"flow_avg_l4_payload_len":414,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.4.76","src_port":52730,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":5,"flow_first_seen":1444570640346,"flow_last_seen":1444570640407,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":23,"flow_tot_l4_payload_len":23,"flow_avg_l4_payload_len":4,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"80.74.110.68","src_port":33459,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
+00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":5,"flow_first_seen":1444570640346,"flow_last_seen":1444570640407,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":23,"flow_tot_l4_payload_len":23,"flow_avg_l4_payload_len":4,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"80.74.110.68","src_port":33459,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":17,"flow_first_seen":1444570636248,"flow_last_seen":1444570639255,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2579,"flow_tot_l4_payload_len":7031,"flow_avg_l4_payload_len":413,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.104.140","src_port":44492,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00514{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_first_seen":1444570630272,"flow_last_seen":1444570630272,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"185.63.147.10","src_port":54651,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
+00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_first_seen":1444570630272,"flow_last_seen":1444570630272,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"10.133.206.47","dst_ip":"185.63.147.10","src_port":54651,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":14,"flow_first_seen":1444570632436,"flow_last_seen":1444570633205,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2903,"flow_tot_l4_payload_len":4426,"flow_avg_l4_payload_len":316,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"23.44.253.243","src_port":49048,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":17,"flow_first_seen":1444570638225,"flow_last_seen":1444570642072,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3697,"flow_tot_l4_payload_len":5437,"flow_avg_l4_payload_len":319,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"216.58.208.40","src_port":43433,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":16,"flow_first_seen":1444570636359,"flow_last_seen":1444570639256,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2579,"flow_tot_l4_payload_len":6215,"flow_avg_l4_payload_len":388,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.97","src_port":51370,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":11,"flow_first_seen":1444570640330,"flow_last_seen":1444570670371,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":5,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51134,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":11,"flow_first_seen":1444570640338,"flow_last_seen":1444570670373,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":5,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51135,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":105,"flow_first_seen":1444570669736,"flow_last_seen":1444570738301,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":13596,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51154,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":513,"flow_first_seen":1444570669745,"flow_last_seen":1444570732084,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":29642,"flow_tot_l4_payload_len":316364,"flow_avg_l4_payload_len":616,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51155,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":22,"flow_first_seen":1444570674487,"flow_last_seen":1444570675890,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":5347,"flow_avg_l4_payload_len":243,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55665,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":23,"flow_first_seen":1444570679512,"flow_last_seen":1444570680667,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2527,"flow_tot_l4_payload_len":5379,"flow_avg_l4_payload_len":233,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55669,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":22,"flow_first_seen":1444570693238,"flow_last_seen":1444570694561,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":5347,"flow_avg_l4_payload_len":243,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55671,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":11,"flow_first_seen":1444570732086,"flow_last_seen":1444570734115,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":5,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51190,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":22,"flow_first_seen":1444570712008,"flow_last_seen":1444570716597,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":5347,"flow_avg_l4_payload_len":243,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55687,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":8,"flow_first_seen":1444570640382,"flow_last_seen":1444570699865,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":216,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33511,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":24,"flow_first_seen":1444570738415,"flow_last_seen":1444570742172,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":14319,"flow_tot_l4_payload_len":34572,"flow_avg_l4_payload_len":1440,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51194,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":18,"flow_first_seen":1444570640385,"flow_last_seen":1444570699915,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":536,"flow_tot_l4_payload_len":980,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33512,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":5,"flow_first_seen":1444570738419,"flow_last_seen":1444570738426,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51195,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":18,"flow_first_seen":1444570636364,"flow_last_seen":1444570640403,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3939,"flow_tot_l4_payload_len":6215,"flow_avg_l4_payload_len":345,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.98","src_port":37129,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":11,"flow_first_seen":1444570640310,"flow_last_seen":1444570645707,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":5,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.98","src_port":37139,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":21,"flow_first_seen":1444570699916,"flow_last_seen":1444570700460,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":536,"flow_tot_l4_payload_len":1376,"flow_avg_l4_payload_len":65,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33551,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":20,"flow_first_seen":1444570700561,"flow_last_seen":1444570713719,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":536,"flow_tot_l4_payload_len":1375,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33553,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":18,"flow_first_seen":1444570700563,"flow_last_seen":1444570713710,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":536,"flow_tot_l4_payload_len":980,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33554,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":13,"flow_first_seen":1444570713719,"flow_last_seen":1444570715293,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":536,"flow_tot_l4_payload_len":1011,"flow_avg_l4_payload_len":77,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33559,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":14,"flow_first_seen":1444570636170,"flow_last_seen":1444570639257,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3907,"flow_tot_l4_payload_len":7020,"flow_avg_l4_payload_len":501,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.121.153","src_port":57647,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":13,"flow_first_seen":1444570636252,"flow_last_seen":1444570640344,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2842,"flow_tot_l4_payload_len":3970,"flow_avg_l4_payload_len":305,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.202.139","src_port":47116,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":11,"flow_first_seen":1444570640269,"flow_last_seen":1444570645699,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":5,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"114.29.202.139","src_port":47135,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":30,"flow_first_seen":1444570699074,"flow_last_seen":1444570740247,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":7928,"flow_avg_l4_payload_len":264,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.241.32.14","src_port":46211,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":95,"flow_first_seen":1444570624853,"flow_last_seen":1444570630376,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":17680,"flow_tot_l4_payload_len":87086,"flow_avg_l4_payload_len":916,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41346,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":56,"flow_first_seen":1444570627404,"flow_last_seen":1444570630162,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":17966,"flow_tot_l4_payload_len":106652,"flow_avg_l4_payload_len":1904,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41348,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":11,"flow_first_seen":1444570628113,"flow_last_seen":1444570628619,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":227,"flow_tot_l4_payload_len":399,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41350,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":9,"flow_first_seen":1444570628117,"flow_last_seen":1444570628568,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":227,"flow_tot_l4_payload_len":399,"flow_avg_l4_payload_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41351,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":26,"flow_first_seen":1444570631722,"flow_last_seen":1444570633204,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":8394,"flow_tot_l4_payload_len":24960,"flow_avg_l4_payload_len":960,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41354,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":38,"flow_first_seen":1444570633357,"flow_last_seen":1444570635974,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":8847,"flow_tot_l4_payload_len":40410,"flow_avg_l4_payload_len":1063,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41358,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":17,"flow_first_seen":1444570636387,"flow_last_seen":1444570640346,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3939,"flow_tot_l4_payload_len":7463,"flow_avg_l4_payload_len":439,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41386,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":11,"flow_first_seen":1444570640319,"flow_last_seen":1444570652361,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":63,"flow_avg_l4_payload_len":5,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41394,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":14,"flow_first_seen":1444570672215,"flow_last_seen":1444570673280,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":3939,"flow_tot_l4_payload_len":7463,"flow_avg_l4_payload_len":533,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41419,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test"}