nDPId-test: mimic full nDPId lifecycle

 * generate DAEMON_EVENT_INIT as well as DAEMON_EVENT_SHUTDOWN
 * process remaining flows before shutdown (and generate events)

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 38 insertions, 0 deletions

diff --git a/test/results/whatsapp_login_call.pcap.out b/test/results/whatsapp_login_call.pcap.out
index a87195cc0..d80207f0f 100644
--- a/test/results/whatsapp_login_call.pcap.out
+++ b/test/results/whatsapp_login_call.pcap.out
@@ -1,3 +1,4 @@
+00396{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
 00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1432582222253,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.172.100.70","src_port":49199,"dst_port":993,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00435{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432582222,"pkt_ts_usec":253233,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkAPS5Jrv0CABFAAA0DNdAAEAG9U7AqAIEEaxkRsAvA+GIPSCcUlOPyIAQH\/poTQAAAQEICi36Gt0QlQ1l"}
 00669{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432582222,"pkt_ts_usec":267722,"pkt_caplen":236,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":236,"pkt_l4_len":202,"pkt":"xiwDYGpkAPS5Jrv0CABFAADeU1tAAEAGriDAqAIEEaxkRsAvA+GIPSCcUlOPyIAYIAB\/kgAAAQEICi36GusQlQ1lFwMBACCNqYpymgjJuQNgLA+QJekfsmHWqykdlwnJ8t48lRIpCxcDAQCAv+6eyOO6KHhFdGRnKCRyPqihrwnYLrpV5EXpUrXv8Q2ow7fiZ\/ErfHE9ZAprbeZEb1cjDczzZ9GWtg7wUDK1rjYT+gKbhCMZiNQZ3QlWly2tQPPw5M7rqWdzOWy2ATMXqxCkXOBCTdOBYD70ikDCSIjo2fZ8\/cJDhiGvSnc\/9Rw="}
@@ -510,3 +511,40 @@
 01075{"flow_id":62,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1229,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432582355,"pkt_ts_usec":687697,"pkt_caplen":530,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":530,"pkt_l4_len":496,"pkt":"xiwDYGpkAPS5Jrv0CABFAAIEb8xAAEAGsmjAqAIEEa1CZsA1Abt+ckvSpMYnIVAYQADR\/AAA07qQm4Ep0AfMbjrgKekirE5be9v5Y+Wt1PAp6dI+Z4ARIiX+eLC+79A323Mj0KuVlIUDWrBIBcROtFlN8VfWaN6sa6B4XXFVLwUe0Z6ZpuPy1HV799SBD5vvu55T\/4RCUUJeV7GbDbY6PVaSFFTT\/atC0jn9rxns6y18hbmv204g\/nVtLhL2hXSK9HiYbtGUwLztMxPbS4LvHc9A0b0+bqvvDEt6LkjqI+Lesoe6b62pKL3IKBvorYENnF9qHSxNOwlsPgMzRVlLbyimWNNZrcer1C1CRcGG+V7wbob1Zc+UVhgBegrhOir\/rgKxmBs\/FiTnInvI7cRUb3h\/bi3xfbINMNlah26Uv0uiKT7EWR8k5couZdKk2WeQJlhB1w8YvLDsunijXRN8qDZSMsKf7YZYHjUEAqXOzU5sAtM\/j+dylKKWaW99TJ9g4jbuk9ahXioY6kRV2A4pl\/x\/Xrb2WswFT2Bfy0iDYza1TjQWnW0J5l5uKypI0UPG0FBTQI+k7I9+xQQFSfOk7eagGIZ6Zs9e57jwNDdoJi3JRJJg+B2ZiMgsFQXq+s+nh7MSkUoWNiE5Iy4AvjFRsiVz\/xxUbdH8A05OcaYBow\/2+b462kjuJvVq+zWN4by\/ndM="}
 01184{"flow_id":62,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1230,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432582355,"pkt_ts_usec":688132,"pkt_caplen":610,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":610,"pkt_l4_len":576,"pkt":"xiwDYGpkAPS5Jrv0CABFAAJUH0BAAEAGAqXAqAIEEa1CZsA1Abt+ck2upMYnIVAYQACaaAAAFwMDAidAn5TunsQA5kB6eBA6g9VebaQimygge\/hXxshDmXRvwQVxcO663ZsQaekX+f80ePuR+K9BmrVgK40BYDnAvd76Ifg1Hsr2ur8Ya5z\/7qa+b5\/rMR2QCAm46uYlis8Zy0kaEW82czqkG+fl2OAgiTpTqFnur1H24\/0Z3BSCXUJ294H3IU2S9xMMpwsN66IU6b8DiPQuBLRwhQ0mMGkbHqfOeH\/z7QZyHnmy9a9\/cJAbxn+onX9l7QdoUMt5zp09X0vLmEmPoDCaLpEhVsYaeag8jYxc1E5XNObgOXL99cq82NpNcuXbusdHw3T6PDZ7exko+xpxaFKwt3a5wYM8fe2qiUNDr63QUj1ROaNzmC1xkBO+1jW\/7CUW9lpVcwEAoFcFNgN8O33NHJA8vWZBoZ\/DYapcjdQupgM9e6isfgDmZiKATgDeqypQr+xd5\/LxyU\/RaPY9WOrIA8tPoSbI4N5AzqLxsVTHUngrFvnBCp+sgER84VU63qRZ4itrOD3FYJU3stRdg5YQfis\/d+tEZBlyoYJ4ATDZAj\/kcCuYRT77zCSFHuHOB1KTRYG0hb0q7Z2Ba4CvPQRRk6muSXX0kBVMJLBihtC5xn9TlKS5E5Or5xNT0IVCbJPzjDTyhTW9thsz5mXaXay20wG71jZ8jQuNobEb1Fi+sv60gljhkHSNO1\/hEvCWh2DnTZNjBOW5bAa6jz6\/T2KEhvp9xBSsYVBBh4QxUxKpxw=="}
 00423{"flow_id":62,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1231,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432582355,"pkt_ts_usec":822954,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"APS5Jrv0xiwDYGpkCABFAAAo0+EAAO8G4S4RrUJmwKgCBAG7wDWkxichfnJGDVAQC2k7VAAA"}
+00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":10,"flow_first_seen":1432582271840,"flow_last_seen":1432582331780,"flow_tot_l4_data_len":3080,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":17,"flow_first_seen":1432582222253,"flow_last_seen":1432582223191,"flow_tot_l4_data_len":1420,"flow_min_l4_data_len":32,"flow_max_l4_data_len":202,"flow_avg_l4_data_len":83,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.172.100.70","src_port":49199,"dst_port":993,"l4_proto":"tcp","ndpi": {"proto":"IMAPS.Apple","breed":"Safe","category":"Web"}}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":17,"flow_first_seen":1432582222253,"flow_last_seen":1432582223191,"flow_tot_l4_data_len":1420,"flow_min_l4_data_len":32,"flow_max_l4_data_len":202,"flow_avg_l4_data_len":83,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.172.100.70","src_port":49199,"dst_port":993,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":5,"flow_first_seen":1432582296338,"flow_last_seen":1432582310666,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"173.252.114.1","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":5,"flow_first_seen":1432582296338,"flow_last_seen":1432582310666,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"179.60.192.48","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":2,"flow_first_seen":1432582284805,"flow_last_seen":1432582285047,"flow_tot_l4_data_len":150,"flow_min_l4_data_len":42,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"169.254.166.207","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":3,"flow_first_seen":1432582331561,"flow_last_seen":1432582331825,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.167.142.39","src_port":49197,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Apple","breed":"Safe","category":"Web"}}
+00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":3,"flow_first_seen":1432582331561,"flow_last_seen":1432582331825,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.167.142.39","src_port":49197,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":5,"flow_first_seen":1432582296338,"flow_last_seen":1432582310665,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.79.192","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":20,"flow_first_seen":1432582296339,"flow_last_seen":1432582310668,"flow_tot_l4_data_len":2313,"flow_min_l4_data_len":30,"flow_max_l4_data_len":297,"flow_avg_l4_data_len":115,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.84.48","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":5,"flow_first_seen":1432582296339,"flow_last_seen":1432582310667,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.74.48","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":5,"flow_first_seen":1432582296338,"flow_last_seen":1432582310667,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.90.48","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":5,"flow_first_seen":1432582296337,"flow_last_seen":1432582310664,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.93.48","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":5,"flow_first_seen":1432582296337,"flow_last_seen":1432582310664,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.73.48","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":198,"flow_first_seen":1432582303300,"flow_last_seen":1432582311036,"flow_tot_l4_data_len":23686,"flow_min_l4_data_len":31,"flow_max_l4_data_len":518,"flow_avg_l4_data_len":119,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"91.253.176.65","src_port":52794,"dst_port":9665,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":2,"flow_first_seen":1432582284806,"flow_last_seen":1432582285047,"flow_tot_l4_data_len":150,"flow_min_l4_data_len":42,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::c42c:3ff:fe60:6a64","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00524{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":180,"flow_first_seen":1432582227643,"flow_last_seen":1432582361929,"flow_tot_l4_data_len":18754,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"184.173.179.37","src_port":49202,"dst_port":5222,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
+00509{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":180,"flow_first_seen":1432582227643,"flow_last_seen":1432582361929,"flow_tot_l4_data_len":18754,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"184.173.179.37","src_port":49202,"dst_port":5222,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":12,"flow_first_seen":1432582303186,"flow_last_seen":1432582310134,"flow_tot_l4_data_len":624,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"1.194.90.191","src_port":52794,"dst_port":51727,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":22,"flow_first_seen":1432582228503,"flow_last_seen":1432582353955,"flow_tot_l4_data_len":5178,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":235,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.110.229.14","src_port":49193,"dst_port":5223,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1432582284806,"flow_last_seen":1432582285047,"flow_tot_l4_data_len":150,"flow_min_l4_data_len":42,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":464,"flow_first_seen":1432582258730,"flow_last_seen":1432582268457,"flow_tot_l4_data_len":37144,"flow_min_l4_data_len":30,"flow_max_l4_data_len":491,"flow_avg_l4_data_len":80,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"91.253.176.65","src_port":51518,"dst_port":9344,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1432582227526,"flow_last_seen":1432582227594,"flow_tot_l4_data_len":262,"flow_min_l4_data_len":45,"flow_max_l4_data_len":217,"flow_avg_l4_data_len":131,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"192.168.2.1","src_port":51897,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":24,"flow_first_seen":1432582238792,"flow_last_seen":1432582267974,"flow_tot_l4_data_len":4009,"flow_min_l4_data_len":30,"flow_max_l4_data_len":324,"flow_avg_l4_data_len":167,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.93.48","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":5,"flow_first_seen":1432582238791,"flow_last_seen":1432582267973,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.79.192","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":5,"flow_first_seen":1432582238791,"flow_last_seen":1432582267973,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.91.48","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":5,"flow_first_seen":1432582238792,"flow_last_seen":1432582267975,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.73.48","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":5,"flow_first_seen":1432582238791,"flow_last_seen":1432582267972,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.85.48","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":5,"flow_first_seen":1432582238791,"flow_last_seen":1432582267971,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.64.48","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":5,"flow_first_seen":1432582238791,"flow_last_seen":1432582267970,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.70.48","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":5,"flow_first_seen":1432582238790,"flow_last_seen":1432582267969,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.100.14","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1432582227595,"flow_last_seen":1432582227624,"flow_tot_l4_data_len":212,"flow_min_l4_data_len":42,"flow_max_l4_data_len":170,"flow_avg_l4_data_len":106,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"192.168.2.1","src_port":52190,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00471{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":10,"flow_first_seen":1432582267983,"flow_last_seen":1432582311138,"flow_tot_l4_data_len":360,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"91.253.176.65","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15}
+00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":2,"flow_first_seen":1432582284805,"flow_last_seen":1432582285047,"flow_tot_l4_data_len":150,"flow_min_l4_data_len":42,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::da30:62ff:fe56:1c","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":15,"flow_first_seen":1432582258587,"flow_last_seen":1432582267438,"flow_tot_l4_data_len":780,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"1.194.90.191","src_port":51518,"dst_port":60312,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":32,"flow_first_seen":1432582355253,"flow_last_seen":1432582356195,"flow_tot_l4_data_len":8617,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":269,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.173.66.102","src_port":49205,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00141{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test"}