summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.gitmodules2
-rw-r--r--CMakeLists.txt27
-rw-r--r--README.md22
m---------libnDPI0
-rw-r--r--test/results/anyconnect-vpn.pcap.out8
-rw-r--r--test/results/fuzz-2006-06-26-2594.pcap.out24
-rw-r--r--test/results/genshin-impact.pcap.out56
-rw-r--r--test/results/skype.pcap.out4
-rw-r--r--test/results/ssl-cert-name-mismatch.pcap.out22
-rw-r--r--test/results/telegram.pcap.out10
-rw-r--r--test/results/tls_invalid_reads.pcap.out10
-rw-r--r--test/results/wa_voice.pcap.out4
-rwxr-xr-xtest/run_tests.sh29
13 files changed, 169 insertions, 49 deletions
diff --git a/.gitmodules b/.gitmodules
index e679b02b1..42fe0f92f 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,5 @@
[submodule "libnDPI"]
path = libnDPI
url = https://github.com/ntop/nDPI
+ branch = dev
+ update = rebase
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 93ec301e6..c4fff16df 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -3,6 +3,21 @@ project(nDPId C)
set(CMAKE_MODULE_PATH ${CMAKE_SOURCE_DIR}/cmake)
find_package(PkgConfig REQUIRED)
+function(initialize_submodule DIRECTORY)
+ if(NOT EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/${DIRECTORY}/.git)
+ find_package(Git QUIET REQUIRED)
+ message(STATUS "${CMAKE_CURRENT_SOURCE_DIR}/${DIRECTORY}/.git does not exist. "
+ "Initializing ${DIRECTORY} submodule ...")
+ execute_process(COMMAND ${GIT_EXECUTABLE} submodule update --init ${DIRECTORY}
+ WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+ RESULT_VARIABLE GIT_EXIT_CODE)
+ if(NOT GIT_EXIT_CODE EQUAL "0")
+ message(FATAL_ERROR "${GIT_EXECUTABLE} submodule update --init dependencies/${DIRECTORY} "
+ "failed with exit code ${GIT_EXIT_CODE}, please checkout submodules")
+ endif()
+ endif()
+endfunction(initialize_submodule)
+
option(ENABLE_SANITIZER "Enable ASAN/LSAN/UBSAN." OFF)
option(ENABLE_SANITIZER_THREAD "Enable TSAN (does not work together with ASAN)." OFF)
option(ENABLE_MEMORY_PROFILING "Enable dynamic memory tracking." OFF)
@@ -16,6 +31,14 @@ add_executable(nDPId nDPId.c utils.c)
add_executable(nDPIsrvd nDPIsrvd.c utils.c)
add_executable(nDPId-test nDPId-test.c utils.c)
+if(BUILD_NDPI)
+ enable_testing()
+ add_test(NAME run_tests
+ COMMAND "${CMAKE_SOURCE_DIR}/test/run_tests.sh"
+ "${CMAKE_SOURCE_DIR}/libnDPI"
+ "$<TARGET_FILE:nDPId-test>")
+endif()
+
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -DJSMN_STATIC=1 -DJSMN_STRICT=1")
set(BUILD_NDPI_CONFIGURE_OPTS "")
@@ -45,12 +68,12 @@ if(ENABLE_SANITIZER_THREAD)
endif()
if(STATIC_LIBNDPI_INSTALLDIR STREQUAL "" AND BUILD_NDPI)
+ initialize_submodule(libnDPI)
include(ExternalProject)
ExternalProject_Add(
libnDPI
SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR}/libnDPI
- CONFIGURE_COMMAND git submodule update --init &&
- ${CMAKE_CURRENT_SOURCE_DIR}/libnDPI/autogen.sh
+ CONFIGURE_COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/libnDPI/autogen.sh
--prefix=${CMAKE_CURRENT_BINARY_DIR}/libnDPI
${BUILD_NDPI_CONFIGURE_OPTS}
BUILD_COMMAND make
diff --git a/README.md b/README.md
index 2b2e034d8..d12675f72 100644
--- a/README.md
+++ b/README.md
@@ -129,7 +129,16 @@ or anything below `./examples`.
# test
-You may want to run some integration tests using pcap files from nDPI:
+The recommended way to run integration / diff tests:
+
+```shell
+mkdir build
+cd build
+cmake .. -DBUILD_NDPI=ON
+make nDPId-test test
+```
+
+Alternatively you can run some integration tests manually:
`./test/run_tests.sh /path/to/libnDPI/root/directory`
@@ -137,11 +146,6 @@ e.g.:
`./test/run_tests.sh ${HOME}/git/nDPI`
-
-For out-of-source builds, you'll need to specify a path to nDPId-test as well with:
-
-`/test/run_tests.sh /path/to/libnDPI/root/directory /path/to/nDPId-test-executable`
-
-For in-source builds and if CMake was configured with BUILD_NDPI=ON you can just type:
-
-`/test/run_tests.sh`
+Remember that all test results are tied to a specific libnDPI commit hash
+as part of the `git submodule`. Using `test/run_tests.s` for other commit hashes
+will most likely result in PCAP diff's.
diff --git a/libnDPI b/libnDPI
-Subproject 9377991263b651be2f7b9a1320d24bcf63f17a1
+Subproject 87076dcd5bcadbe9dbd24284429db59368af04a
diff --git a/test/results/anyconnect-vpn.pcap.out b/test/results/anyconnect-vpn.pcap.out
index 196afa3f5..72433414b 100644
--- a/test/results/anyconnect-vpn.pcap.out
+++ b/test/results/anyconnect-vpn.pcap.out
@@ -102,10 +102,10 @@
00478{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":95,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1569687246924,"flow_last_seen":0,"flow_tot_l4_data_len":36,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.76.76","l4_proto":"icmp","ndpi": {"proto":"ICMP","breed":"Acceptable","category":"Network"}}
00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":96,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1569687246981,"flow_last_seen":0,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":120,"flow_max_l4_data_len":120,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.213","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00554{"flow_id":18,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":96,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569687246,"pkt_ts_usec":981850,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"AQBeAAD7GIEORo7ICABFAACMDQUAAP8RwosKAADV4AAA+xTpFOkAeGDHAAAAAAADAAAAAAABD19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMgAEIX2hvbWVraXTAHAAMgAEMX3NsZWVwLXByb3h5BF91ZHDAIQAMgAEAACkFoAAAEZQAEgAEAA4AmjqBDkaOyBiBDkaOyA=="}
-00600{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":96,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1569687246981,"flow_last_seen":0,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":120,"flow_max_l4_data_len":120,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.213","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_companion-link._tcp.local"}}
+00561{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":96,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1569687246981,"flow_last_seen":0,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":120,"flow_max_l4_data_len":120,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.213","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_companion-link._tcp.local"}}
00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":97,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1569687246982,"flow_last_seen":0,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":120,"flow_max_l4_data_len":120,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::408:3e45:3abc:1552","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00582{"flow_id":19,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":97,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569687246,"pkt_ts_usec":982027,"pkt_caplen":174,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":174,"pkt_l4_len":120,"pkt":"MzMAAAD7GIEORo7Iht1gBoi5AHgR\/\/6AAAAAAAAABAg+RTq8FVL\/AgAAAAAAAAAAAAAAAAD7FOkU6QB4u70AAAAAAAMAAAAAAAEPX2NvbXBhbmlvbi1saW5rBF90Y3AFbG9jYWwAAAyAAQhfaG9tZWtpdMAcAAyAAQxfc2xlZXAtcHJveHkEX3VkcMAhAAyAAQAAKQWgAAARlAASAAQADgCaOoEORo7IGIEORo7I"}
-00611{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":97,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1569687246982,"flow_last_seen":0,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":120,"flow_max_l4_data_len":120,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::408:3e45:3abc:1552","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_companion-link._tcp.local"}}
+00572{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":97,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1569687246982,"flow_last_seen":0,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":120,"flow_max_l4_data_len":120,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::408:3e45:3abc:1552","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_companion-link._tcp.local"}}
00435{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":98,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1569687246982,"flow_last_seen":0,"flow_tot_l4_data_len":8,"flow_min_l4_data_len":8,"flow_max_l4_data_len":8,"flow_avg_l4_data_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.213","dst_ip":"224.0.0.2","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00406{"flow_id":20,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":98,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569687246,"pkt_ts_usec":982031,"pkt_caplen":46,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":46,"pkt_l4_len":8,"pkt":"AQBeAAACGIEORo7ICABGAAAgLwcAAAECCvoKAADV4AAAApQEAAAXAAgE4AAA+w=="}
00467{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":98,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1569687246982,"flow_last_seen":0,"flow_tot_l4_data_len":8,"flow_min_l4_data_len":8,"flow_max_l4_data_len":8,"flow_avg_l4_data_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.213","dst_ip":"224.0.0.2","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}}
@@ -252,9 +252,9 @@
00437{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":208,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1569687260293,"flow_last_seen":0,"flow_tot_l4_data_len":8,"flow_min_l4_data_len":8,"flow_max_l4_data_len":8,"flow_avg_l4_data_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.213","dst_ip":"224.0.0.2","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00482{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":208,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1569687259297,"flow_last_seen":0,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":240,"flow_max_l4_data_len":240,"flow_avg_l4_data_len":240,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"10.0.0.213","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00522{"flow_id":18,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":208,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569687261,"pkt_ts_usec":317606,"pkt_caplen":132,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":132,"pkt_l4_len":98,"pkt":"AQBeAAD7GIEORo7ICABFAAB23NkAAP8R8swKAADV4AAA+xTpFOkAYmA6AAAAAAAEAAAAAAABBV9yYW9wBF90Y3AFbG9jYWwAAAyAAcAMAAyAAQhfYWlycGxhecASAAyAAcAoAAyAAQAAKQWgAAARlAASAAQADgCbOoEORo7IGIEORo7I"}
-00610{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":208,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":5,"flow_first_seen":1569687246981,"flow_last_seen":1569687261317,"flow_tot_l4_data_len":642,"flow_min_l4_data_len":98,"flow_max_l4_data_len":152,"flow_avg_l4_data_len":128,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.213","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_raop._tcp.local"}}
+00571{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":208,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":5,"flow_first_seen":1569687246981,"flow_last_seen":1569687261317,"flow_tot_l4_data_len":642,"flow_min_l4_data_len":98,"flow_max_l4_data_len":152,"flow_avg_l4_data_len":128,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.213","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_raop._tcp.local"}}
00554{"flow_id":19,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":209,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569687261,"pkt_ts_usec":318027,"pkt_caplen":152,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":152,"pkt_l4_len":98,"pkt":"MzMAAAD7GIEORo7Iht1gBoi5AGIR\/\/6AAAAAAAAABAg+RTq8FVL\/AgAAAAAAAAAAAAAAAAD7FOkU6QBiuzAAAAAAAAQAAAAAAAEFX3Jhb3AEX3RjcAVsb2NhbAAADIABwAwADIABCF9haXJwbGF5wBIADIABwCgADIABAAApBaAAABGUABIABAAOAJs6gQ5GjsgYgQ5Gjsg="}
-00621{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":209,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":5,"flow_first_seen":1569687246982,"flow_last_seen":1569687261318,"flow_tot_l4_data_len":642,"flow_min_l4_data_len":98,"flow_max_l4_data_len":152,"flow_avg_l4_data_len":128,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::408:3e45:3abc:1552","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_raop._tcp.local"}}
+00582{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":209,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":5,"flow_first_seen":1569687246982,"flow_last_seen":1569687261318,"flow_tot_l4_data_len":642,"flow_min_l4_data_len":98,"flow_max_l4_data_len":152,"flow_avg_l4_data_len":128,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::408:3e45:3abc:1552","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_raop._tcp.local"}}
00585{"flow_id":3,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":217,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569687261,"pkt_ts_usec":436307,"pkt_caplen":176,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":176,"pkt_l4_len":142,"pkt":"pHczjPFANDY7z3UoCABFAgCiAABAAEAGJN0KAADjCgAAldwAH0m4VKX0auVrcYAYEABPswAAAQEIChwNuMkAIdsnFwMDAGkquNBHUc+ChscXrUtRgCMYZjRJVOaQbTlODQaeY5amqm\/GjUiqzcV41wRmui04E3RqPf8DL0M0lIjsIbM19o\/m74SCL79srfXk80arhJGRlFMGMhcIdyIAYFhKQmR+T8ve+Kap9JlvJLM="}
00585{"flow_id":3,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":218,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569687261,"pkt_ts_usec":438389,"pkt_caplen":176,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":176,"pkt_l4_len":142,"pkt":"NDY7z3UopHczjPFACABFAgCiFAVAAEAGENgKAACVCgAA4x9J3ABq5WtxuFSmYoAYARVPTQAAAQEICgAh3RwcDbjJFwMDAGk+N0ALJRzLafZuvouf5uUs5D\/U0tzAEaeM6atOPCHqQy7mpl9mt8bavf1mAJLusCbLzj5NJ+78e5L239EIVOnh5iS5h\/9VQOkeND9rF9xLGZBWJl3sT7DKnf23IQJYNAQU58BplPorNjw="}
00433{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":219,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569687261,"pkt_ts_usec":438465,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"pHczjPFANDY7z3UoCABFAAA0AABAAEAGJU0KAADjCgAAldwAH0m4VKZiauVr34AQD\/xubQAAAQEIChwNuMsAId0c"}
diff --git a/test/results/fuzz-2006-06-26-2594.pcap.out b/test/results/fuzz-2006-06-26-2594.pcap.out
index 38b1ec16b..fa10cda74 100644
--- a/test/results/fuzz-2006-06-26-2594.pcap.out
+++ b/test/results/fuzz-2006-06-26-2594.pcap.out
@@ -102,6 +102,7 @@
00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":41,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1120469620579,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.71","dst_ip":"147.137.21.122","src_port":2718,"dst_port":139,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":41,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1120469632829,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.114.1.2","dst_ip":"192.168.1.1","src_port":2719,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00449{"flow_id":23,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":41,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120469632,"pkt_ts_usec":829277,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"ADBUADRWAODtAW69CABFAAA9aaoAAIARTbLAcgECwKgBAQqfADUAKUpe7dQBAAABgAAAUgAAA2Z0cAdlY2l0ZexlA2NvbQAAAQAB"}
+00644{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":41,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1120469632829,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.114.1.2","dst_ip":"192.168.1.1","src_port":2719,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"ftp.ecite_e.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":42,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1120469633828,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2719,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00449{"flow_id":24,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":42,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120469633,"pkt_ts_usec":828778,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"ADBUADRWEODtAW69CABFAAA9aasAAIARTbHAqAECwKgBAQqfADUAKUpe7dQBAAABAAAAAAAAA2Z0cAdlY2l0ZWxlA2NvbQAAAQAB"}
00644{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":42,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1120469633828,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2719,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"ftp.ecitele.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
@@ -209,7 +210,6 @@
00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":100,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1120469635043,"flow_last_seen":0,"flow_tot_l4_data_len":47,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":1,"l3_proto":"ip4","src_ip":"147.234.1.253","dst_ip":"192.168.1.66","src_port":21,"dst_port":2720,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00594{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":100,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1120469635048,"flow_last_seen":0,"flow_tot_l4_data_len":79,"flow_min_l4_data_len":79,"flow_max_l4_data_len":79,"flow_avg_l4_data_len":79,"midstream":1,"l3_proto":"ip4","src_ip":"147.234.1.253","dst_ip":"192.168.1.2","src_port":21,"dst_port":2732,"l4_proto":"tcp","ndpi": {"proto":"FTP_CONTROL","breed":"Unsafe","category":"Download-FileTransfer-FileSharing"},"ftp": {"user":"","password":"","auth_failed":0}}
00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":100,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1120469635048,"flow_last_seen":0,"flow_tot_l4_data_len":79,"flow_min_l4_data_len":79,"flow_max_l4_data_len":79,"flow_avg_l4_data_len":79,"midstream":1,"l3_proto":"ip4","src_ip":"147.234.1.253","dst_ip":"192.168.1.2","src_port":21,"dst_port":2732,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00657{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":100,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1120469632829,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.114.1.2","dst_ip":"192.168.1.1","src_port":2719,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":0,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":100,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1120469632829,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.114.1.2","dst_ip":"192.168.1.1","src_port":2719,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00594{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":100,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1120469635010,"flow_last_seen":0,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":96,"flow_max_l4_data_len":96,"flow_avg_l4_data_len":96,"midstream":1,"l3_proto":"ip4","src_ip":"147.234.1.253","dst_ip":"192.169.1.2","src_port":21,"dst_port":2720,"l4_proto":"tcp","ndpi": {"proto":"FTP_CONTROL","breed":"Unsafe","category":"Download-FileTransfer-FileSharing"},"ftp": {"user":"","password":"","auth_failed":0}}
00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":100,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1120469635010,"flow_last_seen":0,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":96,"flow_max_l4_data_len":96,"flow_avg_l4_data_len":96,"midstream":1,"l3_proto":"ip4","src_ip":"147.234.1.253","dst_ip":"192.169.1.2","src_port":21,"dst_port":2720,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
@@ -237,7 +237,9 @@
00466{"flow_id":46,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":109,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120469680,"pkt_ts_usec":447016,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIRc8AAIARTYLAqAECwKgBAQqkJXMANFNK1tYBAAABAAAAAAAABF9zaXAEX3VkcANzaXAJY3liZXJjaXR5AmRrAAAhAAE="}
00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":110,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_first_seen":1120469681446,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2724,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00466{"flow_id":47,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":110,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120469681,"pkt_ts_usec":446824,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIadAAAIARTYHAqAECwKgBAQqkADUANFNK1tYBAAABAAB2AAAABF9zaXAEX3VkcAMlcwAJY3liZXJjaXR5AmRrAAAhAAE="}
+00659{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":110,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_first_seen":1120469681446,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2724,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp._s_.cybercity.dk","num_queries":0,"num_answers":0,"reply_code":0,"query_type":2403,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00466{"flow_id":47,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":111,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120469683,"pkt_ts_usec":449627,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIYdEAAIARTYDAqAECwKgBAQqkADUANFNK1tYBAAABAAAAAAAABF9zaXAGX3VkcANzaXAJY3liZXJjaXR5AmRrAAAhAQE="}
+00680{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":111,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":2,"flow_first_seen":1120469681446,"flow_last_seen":1120469683449,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2724,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00482{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":112,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120469684,"pkt_ts_usec":382515,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/AODtAW69CABFAABOadIAAIERTHvAqAECwKgB\/wCJAIkAOlunhPQBEAABAAAAAAAAIEVGRURFSkZQRUVFUEVORUJFSkVPQ0FDQUNBQ0FDQUJNAAAgADg="}
00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":113,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1120469685131,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.255","src_port":137,"dst_port":25481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00483{"flow_id":48,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":113,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120469685,"pkt_ts_usec":131995,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/AOB2AW69CABFAABOadMAAIARTHrAqAECwKgB\/wCJY4kAOls4hPQBEAABAAAAAAAAIEVGRURFSkZQRUVFUEVORUJFSkVPQ0FDQUN1NEFDQUJNAHEgAAE="}
@@ -302,9 +304,9 @@
00657{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":145,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":1,"flow_first_seen":1120469847979,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2734,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp.sip.cybercity.dk","num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":146,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_first_seen":1120469848977,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"172.168.1.2","dst_ip":"192.168.1.1","src_port":2734,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00466{"flow_id":58,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":146,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120469848,"pkt_ts_usec":977728,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIaigAAIARTSmsqAECwKgBAQquADUANKw8fdoBAAABAAAA4wAABF9zaXAEX3VkcANzaXAJY3liZXJjaXR5AmRrAAAhAAE="}
+00657{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":146,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_first_seen":1120469848977,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"172.168.1.2","dst_ip":"192.168.1.1","src_port":2734,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp.sip.cybercity.dk","num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00506{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":147,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1120469839664,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.170.170.170","src_port":43690,"dst_port":43690,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":147,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1120469839664,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.170.170.170","src_port":43690,"dst_port":43690,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00657{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":147,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_first_seen":1120469848977,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"172.168.1.2","dst_ip":"192.168.1.1","src_port":2734,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":0,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":147,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_first_seen":1120469848977,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"172.168.1.2","dst_ip":"192.168.1.1","src_port":2734,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":147,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":1,"flow_first_seen":1120469847667,"flow_last_seen":0,"flow_tot_l4_data_len":71,"flow_min_l4_data_len":71,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.2","src_port":53,"dst_port":2733,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":147,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":1,"flow_first_seen":1120469847666,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.115.1","src_port":2733,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
@@ -444,6 +446,7 @@
00466{"flow_id":84,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":217,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470033,"pkt_ts_usec":172606,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAXO9CABFAABIamkAAIDwTOjAqAECwKgBAQq6ADUANMsPhMQBAAABAAAAAAAABF9zaXAEX3VkcAR2b2lwB2JydWp18mEDbmV0AAAhAAE="}
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":218,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1120470035175,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":2746,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00466{"flow_id":85,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":218,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470035,"pkt_ts_usec":175480,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIamoAAIARTOfAqAEiwKgBAQq6ADUANMsPhMQBAAABAAAAiwAABF9zaXAEX3VkcAQlcwBwB2JyVmp1bGEDbmV0AAAhAAE="}
+00661{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":218,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1120470035175,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":2746,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp._s_p.brvjula.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28679,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00466{"flow_id":83,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":219,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470037,"pkt_ts_usec":178362,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIamsAAIARTObAqAECwKgBAQq6ADUANMsPhMQBAAABAAAAAAAABF9zaXAEX3VkcAR2b2lwB2JydWp1bGEDbmV0AAAhAAE="}
00466{"flow_id":83,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":220,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470041,"pkt_ts_usec":184152,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAKDtAW69CABFAABIamwAAIARTOXAqAECwKgBAQq6ADUANMsPhMQBAAABAAAAAAAABF9zaXAEX3VkcAR2b2lwB2JydWp1bGEDbmV0AAAhAAE="}
00508{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":221,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":1,"flow_first_seen":1120470032081,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.170","dst_ip":"170.170.170.170","src_port":43690,"dst_port":43690,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -451,7 +454,6 @@
00466{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":221,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":1,"flow_first_seen":1120470033172,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","l4_proto":240,"ndpi": {"proto":"Unknown","breed":"Unrated"}}
00452{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":221,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":1,"flow_first_seen":1120470033172,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","l4_proto":240,"flow_datalink":1,"flow_max_packets":15}
00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":221,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":1,"flow_first_seen":1120470032083,"flow_last_seen":0,"flow_tot_l4_data_len":71,"flow_min_l4_data_len":71,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.2","src_port":53,"dst_port":2745,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00658{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":221,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1120470035175,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":2746,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":0,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":221,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1120470035175,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":2746,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":221,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":1,"flow_first_seen":1120470049185,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"67.168.1.1","src_port":2747,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00462{"flow_id":86,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":221,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470049,"pkt_ts_usec":185972,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"ADBUAEFWAODtAW69CABFAABEam0AAIARTOjAqAECQ6gBAQq7ADUAMDM+8cUAAAABAAAAAAAAATEBMAEwAzEyNwdpbi1hZGRyBGFycGEAAAwAAQ=="}
@@ -523,6 +525,7 @@
00520{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":253,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":1,"flow_first_seen":1120470085969,"flow_last_seen":0,"flow_tot_l4_data_len":273,"flow_min_l4_data_len":273,"flow_max_l4_data_len":273,"flow_avg_l4_data_len":273,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"200.68.120.81","src_port":4901,"dst_port":29440,"l4_proto":"udp","ndpi": {"proto":"SIP","breed":"Acceptable","category":"VoIP"}}
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":254,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":1,"flow_first_seen":1120470086308,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"102.168.1.1","src_port":2752,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00467{"flow_id":100,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":254,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470086,"pkt_ts_usec":308978,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRmAODtAW69CABFAABIaocAAIARTMrAqAECZqgBAQrAADUANLk4cMwBAAABAACqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqo="}
+00659{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":254,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":1,"flow_first_seen":1120470086308,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"102.168.1.1","src_port":2752,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":0,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00909{"flow_id":90,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":255,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470086,"pkt_ts_usec":840071,"pkt_caplen":417,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":417,"pkt_l4_len":383,"pkt":"ADBUADRWAODtAW69CABFAAGTaogAAIARzJHAqAECyER4URPEE8QBf5mcQ0FOQ0VMIHNpqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq"}
00466{"flow_id":97,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":256,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470088,"pkt_ts_usec":311840,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIaokAAIARTMjAqAECwKgBAQrAADUANLk4cMwhAAABAAAAAAAABF9zaXAEX3VkcANzaXAJY3liZXJjaXR5AmRrAAAhAAE="}
00910{"flow_id":90,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":257,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470090,"pkt_ts_usec":856381,"pkt_caplen":417,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":417,"pkt_l4_len":383,"pkt":"ADBUADRWAODtAW69CABFAAGTaooAAIARzI\/AqAECyER4URPEE8QBf5mcQ0FOQ0VMIHNpcDoxNzIzOTI4NzA0NEB2b2lwLmJydWp1bGEubmV0IFNJUC8yLjANClZpYTogU0lQLzIuMC9VRFAgMTkyLjE2OC4xLjI7YnJhbmNoPXo5aEc0YktucDEwNDk4NDA1My00NGNlNGE0MTE5Mi4xNjguMS4yO3Jwb3J0DQpGcm9tOiAiYXJpayIgPHNpcDo4MTY2NjZAdm9pRC5icnVyanVsYS5uZXQ+O3RhZz02NDMzZWY5DQpUb4AgPHP2cDo5NzIzOTI4NzA0NEB2b2lwLmJydWp1bGEubmV0Pg0KQ2FsbC1JRDogMTA1MDkwMjU5LbQ0NmZhZjdhQDE5Mi4xNjguMS4yDQpDU2VxOiAxIENBTkNFTA0KQ29udDRudC1MZW5ndGg6IDANCk1heC1Gb3J3YXJkczogNzANClVzZ3ItQWdlbnQ6IE5lcm8gU0lQUFMgSVAgUGhvbmUgVmVyc2lvbiAyLjAuNTEuMTYNCg0K"}
@@ -531,7 +534,6 @@
00656{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":258,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":1,"flow_first_seen":1120470092317,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.98.1.2","dst_ip":"25.168.1.1","src_port":2752,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp.sip.cybercity.dk","num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":259,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":1,"flow_first_seen":1120470084827,"flow_last_seen":0,"flow_tot_l4_data_len":383,"flow_min_l4_data_len":383,"flow_max_l4_data_len":383,"flow_avg_l4_data_len":383,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"200.68.37.115","src_port":4292,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":259,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":1,"flow_first_seen":1120470085969,"flow_last_seen":0,"flow_tot_l4_data_len":273,"flow_min_l4_data_len":273,"flow_max_l4_data_len":273,"flow_avg_l4_data_len":273,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"200.68.120.81","src_port":4901,"dst_port":29440,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00658{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":259,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":1,"flow_first_seen":1120470086308,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"102.168.1.1","src_port":2752,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":0,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":259,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":1,"flow_first_seen":1120470086308,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"102.168.1.1","src_port":2752,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":259,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":1,"flow_first_seen":1120470083306,"flow_last_seen":0,"flow_tot_l4_data_len":71,"flow_min_l4_data_len":71,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.2","src_port":53,"dst_port":2751,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":259,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":1,"flow_first_seen":1120470083305,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.18","dst_ip":"192.168.1.1","src_port":2751,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
@@ -682,6 +684,7 @@
00660{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":336,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":1,"flow_first_seen":1120470250906,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.172","dst_ip":"192.168.1.1","src_port":2766,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp.sip.cybercity.dk","num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":337,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":1,"flow_first_seen":1120470251907,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2766,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00468{"flow_id":127,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":337,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470251,"pkt_ts_usec":907970,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIassAAIARTILAqAECwKgBAQrOADUANK35e\/0BAAABAAAAJXMABF9zaXAEX3VkcANzaXAJY3liZXJjaXR5AmRrAAAhAAE="}
+00658{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":337,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":1,"flow_first_seen":1120470251907,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2766,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp.sip.cybercity.dk","num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00468{"flow_id":127,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":338,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470253,"pkt_ts_usec":909994,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIatAAAIARTIHAqAECwKgBAQrOADUANK35e\/0BAAABAAAAAAAABF9zaXAEX3VkcANzaXAJY3liZTBjaXR5AmRrAAAhAAE="}
00428{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":339,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470255,"pkt_ts_usec":912874,"pkt_caplen":86,"pkt_type":43690,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":86,"pkt_l4_len":0,"pkt":"ADBUAKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqo="}
00172{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":339,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","type":43690}
@@ -704,6 +707,7 @@
00186{"basic_event_id":8,"basic_event_name":"nDPI IPv4\/L4 payload detection failed","thread_id":0,"packet_id":350,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","l4_data_len":52}
00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":351,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_first_seen":1120470270925,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":35536,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00467{"flow_id":131,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":351,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470270,"pkt_ts_usec":925077,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIat8AAIARTHLAqAECwKgBAYrQADUANDb28v4BAAABwwAAAAAABF9zaXAEX3VkcANzaXAJY3liZXJjaXR5AmRrAAAhAAE="}
+00659{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":351,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_first_seen":1120470270925,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":35536,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp.sip.cybercity.dk","num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":352,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":1,"flow_first_seen":1120470272927,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"94.168.1.2","dst_ip":"192.168.1.1","src_port":2768,"dst_port":4,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00467{"flow_id":132,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":352,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470272,"pkt_ts_usec":927556,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIauAAAIARTHFeqAECwKgBAQrQAAQANDb28v4BAAABAAAAAAAABF9zaXAEX3VkcANzaXAJY3liZXJjaXR5AmRrAAAhAAE="}
00467{"flow_id":130,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":353,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470276,"pkt_ts_usec":933108,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIauEAAIARTHDAqAECwKgBAQrQADUANDb28v4BALIBAAAAAAAABF9zaXAEX3VkcANzaXAJY3liZXJjaXR5AmRrAAAhAAE="}
@@ -711,7 +715,6 @@
00497{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":354,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":1,"flow_first_seen":1120470272927,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"94.168.1.2","dst_ip":"192.168.1.1","src_port":2768,"dst_port":4,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":354,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":1,"flow_first_seen":1120470272927,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"94.168.1.2","dst_ip":"192.168.1.1","src_port":2768,"dst_port":4,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":354,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":4,"flow_first_seen":1120469664171,"flow_last_seen":1120469680185,"flow_tot_l4_data_len":204,"flow_min_l4_data_len":48,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2722,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
-00659{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":354,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_first_seen":1120470270925,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":35536,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":0,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":354,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_first_seen":1120470270925,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":35536,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":354,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":1,"flow_first_seen":1120470284935,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2769,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00463{"flow_id":133,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":354,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470284,"pkt_ts_usec":935173,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"ADBUADRWAODtAW69CABFAABEauIAAIARTHPAqAECwKgBAQrRADUAMPnuKv8AAAABAAAAAAAAATEBMAEwAzEyNwdpbi1hZGRyBGFycGEAAAwAAQ=="}
@@ -720,7 +723,6 @@
00493{"flow_id":134,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":355,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470284,"pkt_ts_usec":936670,"pkt_caplen":105,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":105,"pkt_l4_len":71,"pkt":"AODtAW4FADBUADRWCABFAABbAABAAEARtz7AqAEBwKgBAgB1CtEARyVzAP+AAAABAAEAAAAAATEBMAEwAzEyNwdpbi1hZGRyBGFycGEAAAwAAcAMAAwAAQAAJxAACwlsb2NhbGhvc3QA"}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":356,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470284,"pkt_ts_usec":937812,"pkt_caplen":47,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":47,"pkt_l4_len":0,"pkt":"ADBUADRWAODtAW69CABFAAAhauMAqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqo="}
00186{"basic_event_id":8,"basic_event_name":"nDPI IPv4\/L4 payload detection failed","thread_id":0,"packet_id":356,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","l4_data_len":13}
-00670{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":357,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":3,"flow_first_seen":1120469681446,"flow_last_seen":1120469689458,"flow_tot_l4_data_len":156,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2724,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":0,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":357,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":3,"flow_first_seen":1120469681446,"flow_last_seen":1120469689458,"flow_tot_l4_data_len":156,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2724,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":357,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":2,"flow_first_seen":1120469697460,"flow_last_seen":1120469697462,"flow_tot_l4_data_len":119,"flow_min_l4_data_len":48,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2725,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":357,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":1,"flow_first_seen":1120470284935,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2769,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
@@ -748,7 +750,7 @@
00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":365,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":137,"flow_packet_id":1,"flow_first_seen":1120470304312,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"120.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":365,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":1,"flow_first_seen":1120470315338,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.57","dst_ip":"192.168.1.1","src_port":2771,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00464{"flow_id":138,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":365,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470315,"pkt_ts_usec":338689,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"ADBUADRWAODtAW69CABFAABEauwAAIARTGnAqAE5wKgBAQrTADUAMCcL\/eAAAAABAAAAAAAAATEBMAEw3TEyNwdpbi1hZGRyBGFycHcAAAwAAQ=="}
-00661{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":365,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":1,"flow_first_seen":1120470315338,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.57","dst_ip":"192.168.1.1","src_port":2771,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":12,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
+00622{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":365,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":1,"flow_first_seen":1120470315338,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.57","dst_ip":"192.168.1.1","src_port":2771,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":12,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":366,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":139,"flow_packet_id":1,"flow_first_seen":1120470315340,"flow_last_seen":0,"flow_tot_l4_data_len":71,"flow_min_l4_data_len":71,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.2","src_port":53,"dst_port":2771,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00494{"flow_id":139,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":366,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470315,"pkt_ts_usec":340201,"pkt_caplen":105,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":105,"pkt_l4_len":71,"pkt":"AODtAW68ADBUADRWCABFAABbAABAAEARtz7AqAEBwKgBAgA1CtMARwmH\/eCAAAABAAEAAAAAATEBMAEwAzEyNwdpbi1hZGRyBGFycGEAAAwAAcAMAAwAAQBhJxAACwlsb2NhbGhvc3QA"}
00654{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":366,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":139,"flow_packet_id":1,"flow_first_seen":1120470315340,"flow_last_seen":0,"flow_tot_l4_data_len":71,"flow_min_l4_data_len":71,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.2","src_port":53,"dst_port":2771,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"1.0.0.127.in-addr.arpa","num_queries":1,"num_answers":1,"reply_code":0,"query_type":0,"rsp_type":12,"rsp_addr":"0.0.0.0"}}
@@ -1057,10 +1059,11 @@
00467{"flow_id":191,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":505,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470779,"pkt_ts_usec":487018,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIa5kAAIARS7jAqAECwKgBAQrsADUANNbHUxEBAAABAAAAAAAABF9zaXAEX3VkcANzaXAJY3liZXJjaXR5AkFrAAAhAAE="}
00658{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":505,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":191,"flow_packet_id":1,"flow_first_seen":1120470779487,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2796,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp.sip.cybercity.ak","num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00467{"flow_id":191,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":506,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470780,"pkt_ts_usec":685398,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIa5oAAIARS7fAqAECwKgBAQrsADUANNbHUxEBAAABrQAAAAAABDtzaXAEX3VkcANzaXAJqqqqqqqqqqqqqqqqqqqqqqo="}
-00718{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":506,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":191,"flow_packet_id":2,"flow_first_seen":1120470779487,"flow_last_seen":1120470780685,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2796,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp.sip.cybercity.ak","num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
+00681{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":506,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":191,"flow_packet_id":2,"flow_first_seen":1120470779487,"flow_last_seen":1120470780685,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2796,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":508,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":192,"flow_packet_id":1,"flow_first_seen":1120470781608,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.170.170","dst_ip":"170.170.170.170","src_port":43690,"dst_port":43690,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00483{"flow_id":192,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":508,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470781,"pkt_ts_usec":608802,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/AODtAW69CABFAABOa5wAAIARSrHAqKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqo="}
00467{"flow_id":191,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":510,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470782,"pkt_ts_usec":692043,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIa54AAIARS7PAqAECwKgBAQrsADUANNbHUxEBAAABAAAAAAAABF9zaXAEX3VkcANzaXAJY3liZXJjaXR5AmRrAAAhAAE="}
+00718{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":510,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":191,"flow_packet_id":3,"flow_first_seen":1120470779487,"flow_last_seen":1120470782692,"flow_tot_l4_data_len":156,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2796,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp.sip.cybercity.dk","num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00427{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":511,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470784,"pkt_ts_usec":796360,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":86,"pkt_l4_len":0,"pkt":"ADBUADRWAODtAW69CABFAAB6a58AAIARS7LAqAECwKgBAQrsADUANNbHUxEBAAABAAAAAAAAJF9zaXAEX3VkcANzaXAJeXliZXJjaXR5AmRrAAAhAAE="}
00186{"basic_event_id":8,"basic_event_name":"nDPI IPv4\/L4 payload detection failed","thread_id":0,"packet_id":511,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","l4_data_len":52}
00511{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":512,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":192,"flow_packet_id":1,"flow_first_seen":1120470781608,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.170.170","dst_ip":"170.170.170.170","src_port":43690,"dst_port":43690,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
@@ -1068,6 +1071,7 @@
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":512,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":2,"flow_first_seen":1120470175647,"flow_last_seen":1120470179653,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2758,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":512,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":193,"flow_packet_id":1,"flow_first_seen":1120470788806,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.129","src_port":2796,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00467{"flow_id":193,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":512,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470788,"pkt_ts_usec":806482,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIa6AAAIARS7HAqAECwKgBgQrsADUANNbHUxEBAAABAACqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqo="}
+00661{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":512,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":193,"flow_packet_id":1,"flow_first_seen":1120470788806,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.129","src_port":2796,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":0,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":513,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":194,"flow_packet_id":1,"flow_first_seen":1120470796801,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2797,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00464{"flow_id":194,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":513,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470796,"pkt_ts_usec":801135,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"ADBUADRWAODtAW69CABFAABEa6EAAIARS7TAqAECwKgBAQrtADUAMFm\/yxIAAAABAAAAQAAAATEBMAEwAzEyNwdpbi1hZGRyBGFycFwAAAwAAQ=="}
00654{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":513,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":194,"flow_packet_id":1,"flow_first_seen":1120470796801,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2797,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"1.0.0.127.in-addr.arp_","num_queries":0,"num_answers":0,"reply_code":0,"query_type":12,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
@@ -1080,7 +1084,6 @@
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":518,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":195,"flow_packet_id":1,"flow_first_seen":1120470798172,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2798,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00467{"flow_id":195,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":518,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470798,"pkt_ts_usec":172728,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUABRUAODtAW69CABFAABIa6QAAIARS63AqAECwKgBAQruADUANPLDNxMBAAABAAAAAAAABF9zaXAEX3VkcANzaXAJY3liZXJjaXR5AmRrAAAhAAE="}
00658{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":518,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":195,"flow_packet_id":1,"flow_first_seen":1120470798172,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2798,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp.sip.cybercity.dk","num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
-00660{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":519,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":193,"flow_packet_id":1,"flow_first_seen":1120470788806,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.129","src_port":2796,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":0,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":519,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":193,"flow_packet_id":1,"flow_first_seen":1120470788806,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.129","src_port":2796,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":519,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":195,"flow_packet_id":1,"flow_first_seen":1120470798172,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2798,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":519,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":196,"flow_packet_id":1,"flow_first_seen":1120470800175,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2798,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
@@ -1126,8 +1129,8 @@
00658{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":540,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":203,"flow_packet_id":1,"flow_first_seen":1120470832512,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2802,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp.sip.cybercity.dk","num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":541,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":204,"flow_packet_id":1,"flow_first_seen":1120470834515,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":18162,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00467{"flow_id":204,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":541,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470834,"pkt_ts_usec":515187,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIa7YAAIARS5vAqAECwKgBAUbyADUANBq8DxcBAAABRwAAAAAABF9zaXAEX3VkcANzaXAJY3loZXJjaXR5AmRrAAAhAAE="}
+00659{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":541,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":204,"flow_packet_id":1,"flow_first_seen":1120470834515,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":18162,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp.sip.cyhercity.dk","num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00467{"flow_id":203,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":544,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470836,"pkt_ts_usec":517879,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIa7cAAIARS5rAqAECwKgBAQryADUANBq8DxcBAAABAAAAAAAABF9zaXAEX3VkcANzaXAJY3liZXJjaXR5AmRrAAAhAAE="}
-00659{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":545,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":204,"flow_packet_id":1,"flow_first_seen":1120470834515,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":18162,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":0,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":545,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":204,"flow_packet_id":1,"flow_first_seen":1120470834515,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":18162,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":545,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":202,"flow_packet_id":1,"flow_first_seen":1120470831516,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2568,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00467{"flow_id":203,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":545,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470840,"pkt_ts_usec":523569,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIa7gAAIARS5nAqAECwKgBAQryADUANBq8DxcBAAABAAAAAAAABF9zaXAEX3VkcANzaXAJY3liZXJjaXR5AmRrAAAhAAE="}
@@ -1148,7 +1151,6 @@
00171{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":554,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","type":2136}
00427{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":555,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470857,"pkt_ts_usec":648279,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":86,"pkt_l4_len":0,"pkt":"ADBUADRWAODtAW69CABFAABJa8QAAIARS43AqAECwKgBAQr0ADUANOq3PxkBAAABAAAAAAAABF9zaXAEX3VkcANzaXAJY3liZXJjaXR5AmRrAAAhAAE="}
00186{"basic_event_id":8,"basic_event_name":"nDPI IPv4\/L4 payload detection failed","thread_id":0,"packet_id":555,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","l4_data_len":52}
-00671{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":556,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":2,"flow_first_seen":1120470251907,"flow_last_seen":1120470253909,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2766,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":0,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":556,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":2,"flow_first_seen":1120470251907,"flow_last_seen":1120470253909,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2766,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":556,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":207,"flow_packet_id":1,"flow_first_seen":1120470865650,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2805,"dst_port":51,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00463{"flow_id":207,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":556,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470865,"pkt_ts_usec":650089,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"ADBUADRWAODtAW69CABFAABEa8UAAIARS5DAqAECwKgBAQr1ADMAMFWvzyVzAAABAAAAAAAAATEBMAEwAzEyNwdpbj1hZGRyBGFmcGEAAAwAAQ=="}
diff --git a/test/results/genshin-impact.pcap.out b/test/results/genshin-impact.pcap.out
new file mode 100644
index 000000000..74e9dc4dc
--- /dev/null
+++ b/test/results/genshin-impact.pcap.out
@@ -0,0 +1,56 @@
+00391{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"genshin-impact.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
+00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"genshin-impact.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1615497372822,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"47.245.143.85","src_port":58766,"dst_port":22101,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00431{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497372,"pkt_ts_usec":822667,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"eJS0JASgYDjgxTWgCABFAAAwrR4AAD8RTEjAqAJkL\/WPVeWOVlUAHPQTAAAA\/wAAAAAAAAAASZYC0v\/\/\/\/8="}
+00513{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"genshin-impact.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1615497372822,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"47.245.143.85","src_port":58766,"dst_port":22101,"l4_proto":"udp","ndpi": {"proto":"GenshinImpact","breed":"Fun","category":"Game"}}
+00425{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497372,"pkt_ts_usec":843789,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"YDjgxTWgeJS0JASgCABFAAAwK09AADcRlhcv9Y9VwKgCZFZV5Y4AHKXfAAABRQADGDI6DaIVSZYC0hRRRUU="}
+00631{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497372,"pkt_ts_usec":883763,"pkt_caplen":211,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":211,"pkt_l4_len":177,"pkt":"eJS0JASgYDjgxTWgCABFAADFrx4AAD8RSbPAqAJkL\/WPVeWOVlUAsVF7MhgDABWiDTpRAAABg6QlIwAAAAAAAAAAUQAAAOjKqWZw7UqL9Yt3c0eSZwkZnnlWAs83g1p8EKxdCAGrvC1rqvpVXt+DS9GDIp59mUEo7M9A0R8PnQy3bk3e+QGIcWRmxHcBqUQOH+f\/uJk3ozIYAwAVog06UQAAAYOkJSMBAAAAAAAAACAAAADoyqkGcO9Ki\/W6d3BfbJ9hSIrPxLFWnBNUYf2O83uxMA=="}
+00537{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497372,"pkt_ts_usec":914092,"pkt_caplen":144,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":144,"pkt_l4_len":110,"pkt":"YDjgxTWgeJS0JASgCABFAACCK5BAADcRlYQv9Y9VwKgCZFZV5Y4Abu3mMhgDABWiDTpSAAABg6QlIwAAAAACAAAAAAAAADIYAwAVog06UgAAAYOkJSMBAAAAAgAAAAAAAAAyGAMAFaINOlEAAAHepCUjAAAAAAIAAAASAAAA6MqpBXDmSov1t3fu\/jnV8Vij"}
+00439{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497372,"pkt_ts_usec":922682,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"eJS0JASgYDjgxTWgCABFAAA4+mEAAD8R\/vzAqAJkL\/WPVeWOVlUAJJKtMhgDABWiDTpSAAAB3qQlIwAAAAABAAAAAAAAAA=="}
+00626{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497373,"pkt_ts_usec":564593,"pkt_caplen":208,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":208,"pkt_l4_len":174,"pkt":"YDjgxTWgeJS0JASgCABFAADCLedAADcRku0v9Y9VwKgCZFZV5Y4ArsPCMhgDABWiDTpRAAABaKclIwEAAAACAAAAigAAAOjKqWVw70qL9cR3c19tn2FIis\/Mx0q9Q1BmAKQLXln46wByq\/xSDNrUGtaPJc1+xxYov8kd100OzFzjbEfRqwvacWdn93Q5ohkIH+3H0Kn+CWItLbQ0mAL5R70tsOXQwaxzbnw0wdZ3YZXh+bjtbE02KB2GPp3dNtN8cktyR8r7AR94UXJEaktiKQ=="}
+00626{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497373,"pkt_ts_usec":653864,"pkt_caplen":208,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":208,"pkt_l4_len":174,"pkt":"YDjgxTWgeJS0JASgCABFAADCLhxAADcRkrgv9Y9VwKgCZFZV5Y4ArmnCMhgDABWiDTpRAAABwqclIwEAAAACAAAAigAAAOjKqWVw70qL9cR3c19tn2FIis\/Mx0q9Q1BmAKQLXln46wByq\/xSDNrUGtaPJc1+xxYov8kd100OzFzjbEfRqwvacWdn93Q5ohkIH+3H0Kn+CWItLbQ0mAL5R70tsOXQwaxzbnw0wdZ3YZXh+bjtbE02KB2GPp3dNtN8cktyR8r7AR94UXJEaktiKQ=="}
+00474{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497373,"pkt_ts_usec":740891,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"eJS0JASgYDjgxTWgCABFAABUbHoAAD8RjMjAqAJkL\/WPVeWOVlUAQHGyMhgDABWiDTpSAAABaKclIwEAAAACAAAAAAAAADIYAwAVog06UgAAAcKnJSMBAAAAAgAAAAAAAAA="}
+01223{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497374,"pkt_ts_usec":375802,"pkt_caplen":648,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":648,"pkt_l4_len":614,"pkt":"eJS0JASgYDjgxTWgCABFAAJ6AyUAAD8R8\/fAqAJkL\/WPVeWOVlUCZjzUMhgDABWiDTpRAAABVKolIwIAAAACAAAAQgIAABE4i0CS+LtY\/I2kj6GtmIMNxu8suuJrrcaTS8b6L1P\/iY\/3LtndOt8WGLjqFp+LFYbeQhzZqF3lJ2GOT3RjKyNrCaVVuLPKjftyfxwsqw+SZsMqeZ5BfWYAqd6iqboWPmEx4RBvgCv\/7wyekyHtpu6bq1xnSM6WHJMOH\/liQVyiIbxwzjyOtngajpzmlqvBqTqyxUMst7C5YYipZBv7HIBT6AVt\/4Uwf9v8kw2IBQr0npSvtPQ2wF1+ATFDu3Nay4l0Ta\/AofG1SiKBHCN9zlTHty6gT0DNwkau9g10enyjwC2IlvkSR1zkOOd0EnKs0tbnTQe\/KXjg4+evE9JcO7hj3oTpvYM6sBGEDwZcvnd2VQhRGE195DfHAN+4YWf3jiBbvQcLsfxMFU19Tg28\/mMiEM6K27OAnTlXppjzDHXGaELuz7fk78p6PIgnGAW2JufZDH+BGZY6QsyzRpZQjxDDdocGyPXCLlyK92pbyHrFxTqZgYULMLi5cU4qwcLfKoyFVjFclUvNCDb8Xcb1XRW7Cxz2aQ6qkwV4fu32rcne8QdKM3zacd8b1fN+eYiuz66fGB3V+FZNELvzlaVpkZTvXKIxGfbr62qDN9vQZjtmTyTis0AA4My0DUFyVYV\/jY3hStQqJCVea4C8MVHujynJXkD+MMdYgOOO1wPfhLO\/eDh69P1pnYGxwb3Jk6+OH\/PEkkUibMzF3ATNNTxgHRYn8PSIT\/TGLdgVFEmWF6srvFkPyE32j8+S9uR6uBrOPTcH"}
+00600{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497374,"pkt_ts_usec":404147,"pkt_caplen":187,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":187,"pkt_l4_len":153,"pkt":"YDjgxTWgeJS0JASgCABFAACtL4ZAADcRkWMv9Y9VwKgCZFZV5Y4AmUyKMhgDABWiDTpSAAABVKolIwIAAAADAAAAAAAAADIYAwAVog06UQAAAbCqJSMCAAAAAwAAACUAAAAROItXkvq7WP62pI+5YHzZQNJZpJvg59uw\/iIB0gjCx8tMxcFDMhgDABWiDTpRAAABsKolIwMAAAADAAAAGAAAABE4iaSS+rtY\/qWkj7lgfNlA0lmmNenKPg=="}
+00476{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497374,"pkt_ts_usec":410922,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"eJS0JASgYDjgxTWgCABFAABU5O0AAD8RFFXAqAJkL\/WPVeWOVlUAQDSsMhgDABWiDTpSAAABsKolIwIAAAAEAAAAAAAAADIYAwAVog06UgAAAbCqJSMDAAAABAAAAAAAAAA="}
+00788{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497374,"pkt_ts_usec":414374,"pkt_caplen":330,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":330,"pkt_l4_len":296,"pkt":"YDjgxTWgeJS0JASgCABFAAE8L4hAADcRkNIv9Y9VwKgCZFZV5Y4BKJIIMhgDABWiDTpRAAABuqolIwQAAAADAAAAHAAAABE4i7uS+rtY\/qGkj7lgfNlA0lmkkOD6YAn0ow4yGAMAFaINOlEAAAG6qiUjBQAAAAMAAAAeAAAAETiKhpL6u1j+r6SPuWB82UDSWaZoXvKWsPUqpBWzMhgDABWiDTpRAAABuqolIwYAAAADAAAAHgAAABE4ioaS+rtY\/q+kj7lgfNlA0lmmaF7ylrD1KqQVszIYAwAVog06UQAAAbqqJSMHAAAAAwAAAB4AAAAROIqGkvq7WP6vpI+5YHzZQNJZpmhe8paw9SqkFbMyGAMAFaINOlEAAAG6qiUjCAAAAAMAAAAeAAAAETiKhpL6u1j+r6SPuWB82UDSWaZoXvKWsPUqpBWz"}
+00591{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497374,"pkt_ts_usec":420722,"pkt_caplen":182,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":182,"pkt_l4_len":148,"pkt":"eJS0JASgYDjgxTWgCABFAACoRFwAAD8RtJLAqAJkL\/WPVeWOVlUAlES5MhgDABWiDTpSAAABuqolIwQAAAAJAAAAAAAAADIYAwAVog06UgAAAbqqJSMFAAAACQAAAAAAAAAyGAMAFaINOlIAAAG6qiUjBgAAAAkAAAAAAAAAMhgDABWiDTpSAAABuqolIwcAAAAJAAAAAAAAADIYAwAVog06UgAAAbqqJSMIAAAACQAAAAAAAAA="}
+01994{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497374,"pkt_ts_usec":454693,"pkt_caplen":1223,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1223,"pkt_l4_len":1189,"pkt":"YDjgxTWgeJS0JASgCABFAAS5L5FAADcRjUwv9Y9VwKgCZFZV5Y4EpQL+MhgDABWiDTpRAAAB4qolIwkAAAADAAAAFQAAABE4ioiS+rtY\/qakj7lgfNlA0lknPjIYAwAVog06UQAAAeKqJSMKAAAAAwAAAF0AAAAROIzwkvq7WP7upI+5YHzZQNJZpIPgsbuy9jJ0NvZg5hteI8juk\/wat6qO2GbxdwGu6TiMdSxu9KXlOP4Xfbaq+MTwDev3KeW4Qkm3pCpS4MQt5MGvUJrKkRnoEzoyGAMAFaINOlEAAAHiqiUjCwAAAAMAAAAnAAAAETiBe5L6u1j+tKSPuWB82UDSWaSF4NFkpucpvZg4Y+4wMxm37TKnMhgDABWiDTpRAAAB4qolIwwAAAADAAAARQAAABE4gXuS+rtY\/pakj7lgfNlA0lmkn+DJZKbnK72DOErM++RMueyrD\/JsCIL65B9q2LviMC1nb2jEFkChXAV94oXwuPOOVjIYAwAVog06UQAAAeKqJSMNAAAAAwAAAEkAAAAROIF7kvq7WP6SpI+5YHzZQNJZpITg\/mSm5ym9DhlC7sN5Dd8Xvgbme5d51mD49rS\/yIAk5I9kauRcrn8JxxgRE252oVkApksDMhgDABWiDTpRAAAB4qolIw4AAAADAAAAJwAAABE4gXuS+rtY\/rSkj7lgfNlA0lmkheDNZKbnKb2ROGPuckdrtu0ypzIYAwAVog06UQAAAeKqJSMPAAAAAwAAAD8AAAAROIF7kvq7WP6MpI+5YHzZQNJZpJ\/gyxSn5yu9mTh2zOHkTcntqw3ydgi62GDxaae7+CM9675t\/JDKQIEU3LIyGAMAFaINOlEAAAHiqiUjEAAAAAMAAABFAAAAETiBe5L6u1j+lqSPuWB82UDSWaSf4OlkpucrvZI4bcz75Gy57KsP8n0IjfrNaBTYu+IwLUdvaMQWQLBcG32bsKe5845WMhgDABWiDTpRAAAB4qolIxEAAAADAAAASgAAABE4gXuS+rtY\/pOkj7lgfNlA0lmkmeDkZKbnK70nGkJW6ObWQE5KCPpwMDPQUDHvDlsNotrrlH3csKm6bBJNojNjIt7hMmpdxyHoMhgDABWiDTpRAAAB4qolIxIAAAADAAAAJwAAABE4gXuS+rtY\/rSkj7lgfNlA0lmkheC\/FafnKb2eOGPuY18pt+0ypzIYAwAVog06UQAAAeKqJSMTAAAAAwAAACcAAAAROIF7kvq7WP60pI+5YHzZQNJZpIXguW2m5ym9ljho7k53CcjuMqcyGAMAFaINOlEAAAHiqiUjFAAAAAMAAABFAAAAETiBe5L6u1j+lqSPuWB82UDSWaSF4PZkpucpvYI4aO5JJCm27bEG4sTZjMJx4fAGluIwLVhvaMQWQKBcBX2pjp65845WMhgDABWiDTpRAAAB4qolIxUAAAADAAAAPwAAABE4gXuS+rtY\/oykj7lgfNlA0lmkheCxFafnKb2eOGPuAHoEtu2xBuKHqI3CceHsBrTiKi0dHmnEFEC8XBTcsjIYAwAVog06UQAAAeKqJSMWAAAAAwAAACcAAAAROIF7kvq7WP60pI+5YHzZQNJZpIXgzGSm5ym9mzhj7iBmc7ftMqc="}
+01967{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1615497374,"pkt_ts_usec":454886,"pkt_caplen":1206,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1206,"pkt_l4_len":1172,"pkt":"YDjgxTWgeJS0JASgCABFAASoL5JAADcRjVwv9Y9VwKgCZFZV5Y4ElIPFMhgDABWiDTpRAAAB4qolIxcAAAADAAAASwAAABE4gXuS+rtY\/pCkj7lgfNlA0lmkheD5ZKbnKb2BOGfuFR5Qt+2xHOLP2YzCc+HzBqrAu+dMYWneBVAFjRVFGileZvwvOGg0Pa3K+jIYAwAVog06UQAAAeKqJSMYAAAAAwAAACcAAAAROIF7kvq7WP60pI+5YHzZQNJZpIXg0mSm5ym9kThj7nNsRLftMqcyGAMAFaINOlEAAAHiqiUjGQAAAAMAAABLAAAAETiBe5L6u1j+kKSPuWB82UDSWaSH4PFkpucpvRIdQg7qxCLgI0UJ4H8gPCN06e8+MO0AheiUftymqbpsEk2XNGPW9S8GGgI9rcr6MhgDABWiDTpRAAAB4qolIxoAAAADAAAASwAAABE4gXuS+rtY\/pCkj7lgfNlA0lmkheDsZKbnKb3dOHbudVZ3tu2xHOLC2YzCc+GvBoLAw4FPH2reBVAOjRVFGikCZt4vcSh5PK3K+jIYAwAVog06UQAAAeKqJSMbAAAAAwAAAD8AAAAROIF7kvq7WP6MpI+5YHzZQNJZpIXgthWn5ym9njhj7kdcKbftsQbihKiNwnHh7Aa04iotGB5pxBRAvFwU3LIyGAMAFaINOlEAAAHiqiUjHAAAAAMAAAAzAAAAETiBe5L6u1j+uKSPuWB82UDSWaSd4NVkpucrhYwSas5\/HcBY6ZsI4HsgHSN06e8GtmGLMhgDABWiDTpRAAAB4qolIx0AAAADAAAARQAAABE4gXuS+rtY\/pakj7lgfNlA0lmkheCyCqfnKb2lOGfuGGQJyO6xBuKAt43CceHXBtriMC0cAWnEFkCHXAV9g\/CbxvCOVjIYAwAVog06UQAAAeKqJSMeAAAAAwAAAEsAAAAROIF7kvq7WP6QpI+5YHzZQNJZpIXgqhWn5ym9uDhj7hpFT7btsRzimKiNwnPhyga0wMPoFmFp3gVQVPwURRopZ2bzL38wND2tyvoyGAMAFaINOlEAAAHiqiUjHwAAAAMAAAA\/AAAAETiBe5L6u1j+jKSPuWB82UDSWaSF4MhkpucpvZA4aO4BYHC37bEG4v\/ZjMJx4eIGquIqLWNvaMQUQLJcOdyyMhgDABWiDTpRAAAB4qolIyAAAAADAAAAPwAAABE4gXuS+rtY\/oykj7lgfNlA0lmkheCsFafnKb2fOGPuZUFktu2xBuKCqI3CceHtBrTiKi0eHmnEFEC9XBTcsjIYAwAVog06UQAAAeKqJSMhAAAAAwAAACcAAAAROIF7kvq7WP60pI+5YHzZQNJZpIXgum2m5ym9ljhj7jtGRbbtMqcyGAMAFaINOlEAAAHiqiUjIgAAAAMAAAAnAAAAETiBe5L6u1j+tKSPuWB82UDSWaSF4INkpucpvZg4Y+5dbGO37TKnMhgDABWiDTpRAAAB4qolIyMAAAADAAAASgAAABE4gXuS+rtY\/pOkj7lgfNlA0lmkhuC6FafnKb08lGPmY8vsvRgt8+95JoAp8Pz+J6ZIrCTOTurXH1a2hpFQCTBb5noG3V8\/wyHo"}
+00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":16,"source":"genshin-impact.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":15,"flow_first_seen":1615497372822,"flow_last_seen":1615497374454,"flow_tot_l4_data_len":4427,"flow_min_l4_data_len":28,"flow_max_l4_data_len":1189,"flow_avg_l4_data_len":295,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"47.245.143.85","src_port":58766,"dst_port":22101,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":16,"source":"genshin-impact.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1617969465739,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"47.254.169.109","src_port":59145,"dst_port":22102,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00432{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969465,"pkt_ts_usec":739661,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"eJS0JASgYDjgxTWgCABFAAAwIDwAAD8RvwnAqAJkL\/6pbecJVlYAHFkOAAAA\/wAAAAC6msTNSZYC0v\/\/\/\/8="}
+00515{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":16,"source":"genshin-impact.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1617969465739,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"47.254.169.109","src_port":59145,"dst_port":22102,"l4_proto":"udp","ndpi": {"proto":"GenshinImpact","breed":"Fun","category":"Game"}}
+00427{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969465,"pkt_ts_usec":761279,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"YDjgxTWgeJS0JASgCABFAAAwmj1AADcRDQgv\/qltwKgCZFZW5wkAHNyDAAABRQACIqy6msTNSZYC0hRRRUU="}
+00552{"flow_id":2,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969465,"pkt_ts_usec":796897,"pkt_caplen":153,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":153,"pkt_l4_len":119,"pkt":"eJS0JASgYDjgxTWgCABFAACLETwAAD8Rza7AqAJkL\/6pbecJVlYAd4PurCICAM3EmrpRAAABbMl+tgAAAAAAAAAAUwAAAOjKqWZw60qL9Yt3tYWQf\/bh4A8CmEwZmVNWIKRXCgqptAdyiLYHXIWEStbbdMV+nhEs6cNA1hYEnQ\/rbBPfqVmPcWA0wHkHrhALTrzN2JnmCbMb"}
+00439{"flow_id":2,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969465,"pkt_ts_usec":822356,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"YDjgxTWgeJS0JASgCABFAAA4mnVAADcRDMgv\/qltwKgCZFZW5wkAJNCqrCICAM3EmrpSAAABbMl+tgAAAAABAAAAAAAAAA=="}
+00628{"flow_id":2,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969466,"pkt_ts_usec":442121,"pkt_caplen":209,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":209,"pkt_l4_len":175,"pkt":"YDjgxTWgeJS0JASgCABFAADDnBFAADcRCqEv\/qltwKgCZFZW5wkAr58vrCICAM3EmrpRAAABP8x+tgAAAAABAAAAiwAAAOjKqWVw7UqL9cV3tYWQZx8+3lVfAt\/cHNmWKr5HDFui7AF186oJD92EHtODJcp3zBYr48tD1h1Wy1znPkPfrQyOdDY0xX4woCkAFe\/M0qGOOXqx5KQ032vvPu3M8qe6WA1GLKlWVI5iU9E1q9MYvSH7QLzYypooMZ9tX0Ab4QCSgJ54yulHLEquC+U="}
+00439{"flow_id":2,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969466,"pkt_ts_usec":626288,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"eJS0JASgYDjgxTWgCABFAAA4914AAD8R597AqAJkL\/6pbecJVlYAJP2nrCICAM3EmrpSAAABP8x+tgAAAAABAAAAAAAAAA=="}
+00628{"flow_id":2,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969466,"pkt_ts_usec":641868,"pkt_caplen":209,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":209,"pkt_l4_len":175,"pkt":"YDjgxTWgeJS0JASgCABFAADDnFhAADcRClov\/qltwKgCZFZW5wkAr9curCICAM3EmrpRAAABB81+tgAAAAABAAAAiwAAAOjKqWVw7UqL9cV3tYWQZx8+3lVfAt\/cHNmWKr5HDFui7AF186oJD92EHtODJcp3zBYr48tD1h1Wy1znPkPfrQyOdDY0xX4woCkAFe\/M0qGOOXqx5KQ032vvPu3M8qe6WA1GLKlWVI5iU9E1q9MYvSH7QLzYypooMZ9tX0Ab4QCSgJ54yulHLEquC+U="}
+00439{"flow_id":2,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969466,"pkt_ts_usec":646953,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"eJS0JASgYDjgxTWgCABFAAA4b2AAAD8Rb93AqAJkL\/6pbecJVlYAJDWnrCICAM3EmrpSAAABB81+tgAAAAABAAAAAAAAAA=="}
+01225{"flow_id":2,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969467,"pkt_ts_usec":412615,"pkt_caplen":650,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":650,"pkt_l4_len":616,"pkt":"eJS0JASgYDjgxTWgCABFAAJ8Md4AAD8RqxvAqAJkL\/6pbecJVlYCaA75rCICAM3EmrpRAAABts9+tgEAAAABAAAARAIAAJ34UwPI1EVMG1LIRvcrUGNSi\/VdepEoTdOKRUrWfpwO9nbsnsJll316gZCOiK+mqhTSdMkcygh0O6p1aKZ++EPmaheYVhNJXCi74EMdsMS+VJQqqiIfxJyNn9x+AgX3nLBwvFle8Gsgosfr9hJpAOwnokPZwpX+MDF8\/BN6ScKsQxvm+YEVlFcrNuza5lG\/S3PBnN9AaLTYmWvJwb7YMxYV2ErN7EjgmkwkuzvyG7EuhF2MeICbc7Ki1gN2XXD\/O2gPatOeRN6I5BKIzbGNniUefHqog16QXvpluvfHasB228DKvtbbABcS5htTZvbefii\/z\/siLnD2lMKfkhTX51JCtx91f5WeOj+8k4kvT+a0ZBZKcS2TVvYbgsD4+yvKLGTiK0zX1FwSpM4n1rYQMfpReQRLAri0Oh2DVnLq1bZt\/MPo28vIetyFhnfc\/Qig0siAp6BhTcuWfHY8UGixQrTq38nYzvdi2\/9JVZlo3o3nT13qC9t3XBRW7gx4BkjWHUA2X7xQ8hig6+kv7KdTmLFesVGD88s38H5cD8\/+zY274is9glBfMYbguqD8uMIjrTfpX0oo1rpPjwimPoLmavwkG6dbGpcziFh+50a1hDwtREOK7yXvSuH1M3TKetweS+1dSwFBYQx39zoybPhKRvlCHHBLvUQku6E58Qbqzj6wVS\/EGEFpG++u9vuW8mZxxtbSx2hYgOk1rprzeGjsMeNjGI9rWl4tZwUqdOziPbdtToh6IarGBxSYHWNlcsl3gV1+QIc="}
+00604{"flow_id":2,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":25,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969467,"pkt_ts_usec":442149,"pkt_caplen":191,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":191,"pkt_l4_len":157,"pkt":"YDjgxTWgeJS0JASgCABFAACxnlRAADcRCHAv\/qltwKgCZFZW5wkAnVWorCICAM3EmrpSAAABts9+tgEAAAACAAAAAAAAAKwiAgDNxJq6UQAAASfQfrYBAAAAAgAAACcAAACd+FMUyNJFTBlpyEb3K0jJnva8AOAQCU9f8jR6v+zkf2JP\/F+ijg+sIgIAzcSaulEAAAEn0H62AgAAAAIAAAAaAAAAnfhR58jSRUwZeshG9ytIyZ72vADgEqdGchc="}
+00476{"flow_id":2,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":26,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969467,"pkt_ts_usec":446159,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"eJS0JASgYDjgxTWgCABFAABUdC0AAD8RavTAqAJkL\/6pbecJVlYAQP5BrCICAM3EmrpSAAABJ9B+tgEAAAADAAAAAAAAAKwiAgDNxJq6UgAAASfQfrYCAAAAAwAAAAAAAAA="}
+00804{"flow_id":2,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":27,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969467,"pkt_ts_usec":452392,"pkt_caplen":340,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":340,"pkt_l4_len":306,"pkt":"YDjgxTWgeJS0JASgCABFAAFGnl1AADcRB9Iv\/qltwKgCZFZW5wkBMrkRrCICAM3EmrpRAAABMdB+tgMAAAACAAAAHgAAAJ34U\/jI0kVMGX7IRvcrSMme9rwA4BACT0JJjXA+46wiAgDNxJq6UQAAATHQfrYEAAAAAgAAACAAAACd+FLFyNJFTBlwyEb3K0jJnva8AOAS+vFKvzRxt0kjxKwiAgDNxJq6UQAAATHQfrYFAAAAAgAAACAAAACd+FLFyNJFTBlwyEb3K0jJnva8AOAS+vFKvzRxt0kjxKwiAgDNxJq6UQAAATHQfrYGAAAAAgAAACAAAACd+FLFyNJFTBlwyEb3K0jJnva8AOAS+vFKvzRxt0kjxKwiAgDNxJq6UQAAATHQfrYHAAAAAgAAACAAAACd+FLFyNJFTBlwyEb3K0jJnva8AOAS+vFKvzRxt0kjxA=="}
+00591{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":28,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969467,"pkt_ts_usec":457136,"pkt_caplen":182,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":182,"pkt_l4_len":148,"pkt":"eJS0JASgYDjgxTWgCABFAACoEAEAAD8RzszAqAJkL\/6pbecJVlYAlGYbrCICAM3EmrpSAAABMdB+tgMAAAAIAAAAAAAAAKwiAgDNxJq6UgAAATHQfrYEAAAACAAAAAAAAACsIgIAzcSaulIAAAEx0H62BQAAAAgAAAAAAAAArCICAM3EmrpSAAABMdB+tgYAAAAIAAAAAAAAAKwiAgDNxJq6UgAAATHQfrYHAAAACAAAAAAAAAA="}
+00557{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":29,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969467,"pkt_ts_usec":482889,"pkt_caplen":156,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":156,"pkt_l4_len":122,"pkt":"YDjgxTWgeJS0JASgCABFAACOnmtAADcRCHwv\/qltwKgCZFZW5wkAekgerCICAM3EmrpRAAABT9B+tggAAAACAAAAHQAAAJ34WIfI0kVMGX\/IRvcrSMme9rwA4BADg3cAGfocrCICAM3EmrpRAAABT9B+tgkAAAACAAAAHQAAAJ34WIfI0kVMGX\/IRvcrSMme9rwA4BAD4AAHGfoc"}
+00477{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":30,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1617969467,"pkt_ts_usec":485845,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"eJS0JASgYDjgxTWgCABFAABU7MsAAD8R8lXAqAJkL\/6pbecJVlYAQJJBrCICAM3EmrpSAAABT9B+tggAAAAKAAAAAAAAAKwiAgDNxJq6UgAAAU\/QfrYJAAAACgAAAAAAAAA="}
+00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":31,"source":"genshin-impact.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":15,"flow_first_seen":1617969465739,"flow_last_seen":1617969467485,"flow_tot_l4_data_len":2110,"flow_min_l4_data_len":28,"flow_max_l4_data_len":616,"flow_avg_l4_data_len":140,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"47.254.169.109","src_port":59145,"dst_port":22102,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":31,"source":"genshin-impact.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1618759616491,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"8.209.69.191","src_port":52575,"dst_port":22101,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00431{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":31,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759616,"pkt_ts_usec":491441,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"eJS0JASgYDjgxTWgCABFAAAwGRQAAD8RUQ3AqAJkCNFFv81fVlUAHHz9AAAA\/wAAAAAAAAAASZYC0v\/\/\/\/8="}
+00513{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":31,"source":"genshin-impact.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1618759616491,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"8.209.69.191","src_port":52575,"dst_port":22101,"l4_proto":"udp","ndpi": {"proto":"GenshinImpact","breed":"Fun","category":"Game"}}
+00428{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":32,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759616,"pkt_ts_usec":511233,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"YDjgxTWgeJS0JASgCABFAAAwBJVAADYRLowI0UW\/wKgCZFZVzV8AHCclAAABRQAC8VwSg\/gZSZYC0hRRRUU="}
+00632{"flow_id":3,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":33,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759616,"pkt_ts_usec":572945,"pkt_caplen":211,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":211,"pkt_l4_len":177,"pkt":"eJS0JASgYDjgxTWgCABFAADFKAcAAD8RQYXAqAJkCNFFv81fVlUAsRpMXPECABn4gxJRAAAB+IeX5QAAAAAAAAAAUQAAAOjKqWZw7UqL9Yt3c0eSZxk9sU5aAs83g1pzHa9XCgisvC1r9\/0GCIzdTdWOJM16x0h+u8IR0UsPmVrqPkXeqgnccmMxz3oCrkMOS+f\/uJk3o1zxAgAZ+IMSUQAAAfiHl+UBAAAAAAAAACAAAADoyqkGcO9Ki\/W6d3BffbtOf4bPxP18xxJUYUezQnixMA=="}
+00538{"flow_id":3,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759616,"pkt_ts_usec":601044,"pkt_caplen":144,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":144,"pkt_l4_len":110,"pkt":"YDjgxTWgeJS0JASgCABFAACCBNZAADYRLfkI0UW\/wKgCZFZVzV8AbgXrXPECABn4gxJSAAAB+IeX5QAAAAACAAAAAAAAAFzxAgAZ+IMSUgAAAfiHl+UBAAAAAgAAAAAAAABc8QIAGfiDElEAAAFMiJflAAAAAAIAAAASAAAA6MqpBXDmSov1t3ei1GLU8Vij"}
+00439{"flow_id":3,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":35,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759616,"pkt_ts_usec":612938,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"eJS0JASgYDjgxTWgCABFAAA4\/jQAAD8Ra+TAqAJkCNFFv81fVlUAJJbpXPECABn4gxJSAAABTIiX5QAAAAABAAAAAAAAAA=="}
+00628{"flow_id":3,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":36,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759617,"pkt_ts_usec":311589,"pkt_caplen":207,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":207,"pkt_l4_len":173,"pkt":"YDjgxTWgeJS0JASgCABFAADBBu1AADYRK6MI0UW\/wKgCZFZVzV8ArVHEXPECABn4gxJRAAABEouX5QEAAAACAAAAiQAAAOjKqWVw70qL9cV3c199u05\/hs\/MrkzZQVBmAPkMDQ+rtQZ2pvoBC4TdTIGCdM0qxxJ+4pkV1x4GmF\/kO0zcqAzdcTNn93Q5rRQLFe\/O16n+CWJxI+816DrJR3lO8p5qCNkCh4qniqRZL16WQ4G\/5308s+QBbMxPWEM9AV8Zn6N6gB\/jynECa4dA"}
+00628{"flow_id":3,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":37,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759617,"pkt_ts_usec":401574,"pkt_caplen":207,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":207,"pkt_l4_len":173,"pkt":"YDjgxTWgeJS0JASgCABFAADBBxJAADYRK34I0UW\/wKgCZFZVzV8ArffDXPECABn4gxJRAAABbIuX5QEAAAACAAAAiQAAAOjKqWVw70qL9cV3c199u05\/hs\/MrkzZQVBmAPkMDQ+rtQZ2pvoBC4TdTIGCdM0qxxJ+4pkV1x4GmF\/kO0zcqAzdcTNn93Q5rRQLFe\/O16n+CWJxI+816DrJR3lO8p5qCNkCh4qniqRZL16WQ4G\/5308s+QBbMxPWEM9AV8Zn6N6gB\/jynECa4dA"}
+00474{"flow_id":3,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":38,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759617,"pkt_ts_usec":493042,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"eJS0JASgYDjgxTWgCABFAABUZx0AAD8RAuDAqAJkCNFFv81fVlUAQHlAXPECABn4gxJSAAABEouX5QEAAAACAAAAAAAAAFzxAgAZ+IMSUgAAAWyLl+UBAAAAAgAAAAAAAAA="}
+01228{"flow_id":3,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":39,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759618,"pkt_ts_usec":537753,"pkt_caplen":648,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":648,"pkt_l4_len":614,"pkt":"eJS0JASgYDjgxTWgCABFAAJ6\/CUAAD8Ra7HAqAJkCNFFv81fVlUCZqlKXPECABn4gxJRAAABT4+X5QIAAAACAAAAQgIAAJqL1Iipuy+c4B1OjKQoWMU4kXfwbRo\/xsqjr1D7MMRT\/kQo1sJvgrMeD2wTGwPg9Rn3ouVKeRReAX124YswuOjTzwCqi0bbVKv61NyWzE8tby4DKH4S\/WPOmwSf08UPBJUUSTfIsZQhNMPkRdo4+i5or05rigGkcNmhEXu+6WgMqR1SiQxHnjhMKsAPBNUejcKO5hmVDhdMCNH0US\/iyHNNsGZ5UoGQgNE1nZ9uAVdVwZEkxG1r0unxCYiUqoQpLhpIAhArbkmD\/+6PHoNLogDTlYzyfeLrdBhnDQpjjJwPg1pOA01j0jNlYeebFGIWa9T9Cu4Fai5TGyjJq9U9oUyeAQZ4AsG1\/KTEhrRjvNzM3VIkxBVQhoFe9Gee2L\/MPlsO+LixMKVSC+DwW9H8U5hD1Lw2nWrFBY2NQG\/kVP9pGWSXNivXGr6567\/NqyJhFx60Bx5HFyuEpO2pbOUr4YN7WT\/L4d2tB0nihH92X8svrswxH8fyMvHOdJ1IzEPcvUPdteckwRncSss8zcj4jcEAKi++QrXPC\/W5VHrN23uN5ndMQ2k03fwakb3ZbK8SjZOxmHELI0ZFrcAdz8fdiWeQJvabaNGcFxsDd69lomidN3qcPBPg7S\/NMKkJkRbYHz5iPS2nptbN7ZJzdUAP\/OEqnV0wvlQJhpQEB4Nk\/blZiFriyXqzcLUSI+gPf8HyFhgg6W2V\/05sN973t6oYc\/\/rF7X\/Fs+Kl5iTFaSw6gkuaf9YiKMAhEDTa6HGzh1kqAaR"}
+01228{"flow_id":3,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":40,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759618,"pkt_ts_usec":538298,"pkt_caplen":648,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":648,"pkt_l4_len":614,"pkt":"eJS0JASgYDjgxTWgCABFAAJ6vqsAAD8RqSvAqAJkCNFFv81fVlUCZmNKXPECABn4gxJRAAABlY+X5QIAAAACAAAAQgIAAJqL1Iipuy+c4B1OjKQoWMU4kXfwbRo\/xsqjr1D7MMRT\/kQo1sJvgrMeD2wTGwPg9Rn3ouVKeRReAX124YswuOjTzwCqi0bbVKv61NyWzE8tby4DKH4S\/WPOmwSf08UPBJUUSTfIsZQhNMPkRdo4+i5or05rigGkcNmhEXu+6WgMqR1SiQxHnjhMKsAPBNUejcKO5hmVDhdMCNH0US\/iyHNNsGZ5UoGQgNE1nZ9uAVdVwZEkxG1r0unxCYiUqoQpLhpIAhArbkmD\/+6PHoNLogDTlYzyfeLrdBhnDQpjjJwPg1pOA01j0jNlYeebFGIWa9T9Cu4Fai5TGyjJq9U9oUyeAQZ4AsG1\/KTEhrRjvNzM3VIkxBVQhoFe9Gee2L\/MPlsO+LixMKVSC+DwW9H8U5hD1Lw2nWrFBY2NQG\/kVP9pGWSXNivXGr6567\/NqyJhFx60Bx5HFyuEpO2pbOUr4YN7WT\/L4d2tB0nihH92X8svrswxH8fyMvHOdJ1IzEPcvUPdteckwRncSss8zcj4jcEAKi++QrXPC\/W5VHrN23uN5ndMQ2k03fwakb3ZbK8SjZOxmHELI0ZFrcAdz8fdiWeQJvabaNGcFxsDd69lomidN3qcPBPg7S\/NMKkJkRbYHz5iPS2nptbN7ZJzdUAP\/OEqnV0wvlQJhpQEB4Nk\/blZiFriyXqzcLUSI+gPf8HyFhgg6W2V\/05sN973t6oYc\/\/rF7X\/Fs+Kl5iTFaSw6gkuaf9YiKMAhEDTa6HGzh1kqAaR"}
+00476{"flow_id":3,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":41,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759618,"pkt_ts_usec":561350,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"YDjgxTWgeJS0JASgCABFAABUCGJAADYRKpsI0UW\/wKgCZFZVzV8AQA84XPECABn4gxJSAAABT4+X5QIAAAADAAAAAAAAAFzxAgAZ+IMSUgAAAZWPl+UCAAAAAwAAAAAAAAA="}
+00468{"flow_id":3,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":42,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759618,"pkt_ts_usec":691595,"pkt_caplen":91,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":91,"pkt_l4_len":57,"pkt":"YDjgxTWgeJS0JASgCABFAABNCHBAADYRKpQI0UW\/wKgCZFZVzV8AOTyIXPECABn4gxJRAAABdpCX5QIAAAADAAAAFQAAAJqL1UCpuS+c4jZOjLzuk7ttpvb36Q=="}
+00875{"flow_id":3,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":43,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759618,"pkt_ts_usec":701851,"pkt_caplen":396,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":396,"pkt_l4_len":362,"pkt":"YDjgxTWgeJS0JASgCABFAAF+CHZAADYRKV0I0UW\/wKgCZFZVzV8BagUrXPECABn4gxJRAAABgJCX5QMAAAADAAAAJQAAAJqL1J+puS+c4iZOjLzuk7ttpvZ0TBiz7budkMSNEVFmutQdZ1Fc8QIAGfiDElEAAAGAkJflBAAAAAMAAAAYAAAAmovWbKm5L5ziNU6MvO6Tu22m9nbiEZ4IXPECABn4gxJRAAABgJCX5QUAAAADAAAAHgAAAJqL1rKpuS+c4j9OjLzuk7ttpvZ0Rhh9s920CGhKqlzxAgAZ+IMSUQAAAYCQl+UGAAAAAwAAACUAAACai9SfqbkvnOImToy87pO7bab2dEwYs+27nZDEjRFRZrrUHWdRXPECABn4gxJRAAABgJCX5QcAAAADAAAAGAAAAJqL1mypuS+c4jVOjLzuk7ttpvZ24hGeCFzxAgAZ+IMSUQAAAYCQl+UIAAAAAwAAACIAAACai9VOqbkvnOI7Toy87pO7bab2dqydu6C7lphg2QPxZhPf"}
+00666{"flow_id":3,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":44,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759618,"pkt_ts_usec":715293,"pkt_caplen":238,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":238,"pkt_l4_len":204,"pkt":"eJS0JASgYDjgxTWgCABFAADgBboAAD8RY7fAqAJkCNFFv81fVlUAzKPcXPECABn4gxJSAAABdpCX5QIAAAAJAAAAAAAAAFzxAgAZ+IMSUgAAAYCQl+UDAAAACQAAAAAAAABc8QIAGfiDElIAAAGAkJflBAAAAAkAAAAAAAAAXPECABn4gxJSAAABgJCX5QUAAAAJAAAAAAAAAFzxAgAZ+IMSUgAAAYCQl+UGAAAACQAAAAAAAABc8QIAGfiDElIAAAGAkJflBwAAAAkAAAAAAAAAXPECABn4gxJSAAABgJCX5QgAAAAJAAAAAAAAAA=="}
+00472{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":45,"source":"genshin-impact.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1618759618,"pkt_ts_usec":761347,"pkt_caplen":95,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":95,"pkt_l4_len":61,"pkt":"YDjgxTWgeJS0JASgCABFAABRCH1AADYRKoMI0UW\/wKgCZFZVzV8APR45XPECABn4gxJRAAABvJCX5QkAAAADAAAAGQAAAJqL1VapuS+c4jJOjLzuk7ttpvZ2nowWKgI="}
+00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":45,"source":"genshin-impact.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":15,"flow_first_seen":1618759616491,"flow_last_seen":1618759618761,"flow_tot_l4_data_len":2765,"flow_min_l4_data_len":28,"flow_max_l4_data_len":614,"flow_avg_l4_data_len":184,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"8.209.69.191","src_port":52575,"dst_port":22101,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
+00134{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":45,"source":"genshin-impact.pcap","alias":"nDPId-test"}
diff --git a/test/results/skype.pcap.out b/test/results/skype.pcap.out
index d08b49ea4..ed6486b57 100644
--- a/test/results/skype.pcap.out
+++ b/test/results/skype.pcap.out
@@ -1732,10 +1732,10 @@
00514{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1672,"source":"skype.pcap","alias":"nDPId-test","flow_id":242,"flow_packet_id":1,"flow_first_seen":1431969713813,"flow_last_seen":0,"flow_tot_l4_data_len":26,"flow_min_l4_data_len":26,"flow_max_l4_data_len":26,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"71.62.0.85","src_port":13021,"dst_port":33647,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1673,"source":"skype.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":1,"flow_first_seen":1431969713814,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.92","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00617{"flow_id":243,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1673,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969713,"pkt_ts_usec":814754,"pkt_caplen":207,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":207,"pkt_l4_len":173,"pkt":"PBXCt3IOxCwDBkn+CABFAADBLbUAAP8R6nbAqAFc4AAA+xTpFOkArSlHAAAAAAAEAAMAAAAAC19hZnBvdmVydGNwBF90Y3AFbG9jYWwAAAyAAQRfc21iwBgADIABBF9yZmLAGAAMgAEGX2FkaXNrwBgADIABwAwADAABAAAPvAAWE0x1Y2HigJlzIE1hY0Jvb2tQcm\/ADMAMAAwAAQAADA4AEA1MdWNh4oCZcyBpTWFjwAzAKAAMAAEAAAwOABANTHVjYeKAmXMgaU1hY8Ao"}
-00592{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1673,"source":"skype.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":1,"flow_first_seen":1431969713814,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.92","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_afpovertcp._tcp.local"}}
+00553{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1673,"source":"skype.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":1,"flow_first_seen":1431969713814,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.92","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_afpovertcp._tcp.local"}}
00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1674,"source":"skype.pcap","alias":"nDPId-test","flow_id":244,"flow_packet_id":1,"flow_first_seen":1431969713815,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::c62c:3ff:fe06:49fe","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00650{"flow_id":244,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1674,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969713,"pkt_ts_usec":815539,"pkt_caplen":227,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":227,"pkt_l4_len":173,"pkt":"MzMAAAD7xCwDBkn+ht1gAU9NAK0R\/\/6AAAAAAAAAxiwD\/\/4GSf7\/AgAAAAAAAAAAAAAAAAD7FOkU6QCtu5cAAAAAAAQAAwAAAAALX2FmcG92ZXJ0Y3AEX3RjcAVsb2NhbAAADIABBF9zbWLAGAAMgAEEX3JmYsAYAAyAAQZfYWRpc2vAGAAMgAHADAAMAAEAAA+8ABYTTHVjYeKAmXMgTWFjQm9va1Byb8AMwAwADAABAAAMDgAQDUx1Y2HigJlzIGlNYWPADMAoAAwAAQAADA4AEA1MdWNh4oCZcyBpTWFjwCg="}
-00601{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1674,"source":"skype.pcap","alias":"nDPId-test","flow_id":244,"flow_packet_id":1,"flow_first_seen":1431969713815,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::c62c:3ff:fe06:49fe","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_afpovertcp._tcp.local"}}
+00562{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1674,"source":"skype.pcap","alias":"nDPId-test","flow_id":244,"flow_packet_id":1,"flow_first_seen":1431969713815,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::c62c:3ff:fe06:49fe","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_afpovertcp._tcp.local"}}
00417{"flow_id":238,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1675,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969713,"pkt_ts_usec":822833,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"PBXCt3IO0NQSxnP1CABFCAAot7tAADYGlwZbvth9wKgBIjA+w7686z9DA+vffFAQA6DimgAAAAAAAAAA"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1681,"source":"skype.pcap","alias":"nDPId-test","flow_id":245,"flow_packet_id":1,"flow_first_seen":1431969713965,"flow_last_seen":0,"flow_tot_l4_data_len":26,"flow_min_l4_data_len":26,"flow_max_l4_data_len":26,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.145","src_port":13021,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00418{"flow_id":245,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1681,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969713,"pkt_ts_usec":965184,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAuO\/8AAEARXS3AqAEinTeCkTLdAbsAGqTTnQwCwP4SRbwMfSMDCWlEQOP1"}
diff --git a/test/results/ssl-cert-name-mismatch.pcap.out b/test/results/ssl-cert-name-mismatch.pcap.out
new file mode 100644
index 000000000..c3fca242a
--- /dev/null
+++ b/test/results/ssl-cert-name-mismatch.pcap.out
@@ -0,0 +1,22 @@
+00399{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
+00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1620643422034,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.222","dst_ip":"104.154.89.105","src_port":54772,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00449{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":34834,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"BBjWBrNaACWQ1Mz5CABFAAA8gCNAAEAGNQ\/AqALeaJpZadX0AbtP8LY3AAAAAKACchCFuAAAAgQFtAQCCAoBlw8kAAAAAAEDAwc="}
+00450{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":162607,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ACWQ1Mz5BBjWBrNaCABFAAA8AABAADAGxTJomllpwKgC3gG71fRoLFRgT\/C2OKASbgBjmAAAAgQFjAQCCAqtfZhXAZcPJAEDAwc="}
+00437{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":162625,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"BBjWBrNaACWQ1Mz5CABFAAA0gCRAAEAGNRbAqALeaJpZadX0AbtP8LY4aCxUYYAQAOWFsAAAAQEICgGXD0StfZhX"}
+00771{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":196037,"pkt_caplen":311,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":311,"pkt_l4_len":277,"pkt":"BBjWBrNaACWQ1Mz5CABFAAEpgCVAAEAGNCDAqALeaJpZadX0AbtP8LY4aCxUYYAYAOWGpQAAAQEICgGXD02tfZhXFgMBAPABAADsAwNgmQ7zHV6F023ZZMjzy2PnOAFhzodV\/0kvIs9S5KNjJQAATMArwCzAhsCHwAnACsCswK3ACMAvwDDAisCLwBPAFMASAJwAncB6wHsALwA1AEEAhMCcwJ0ACgCeAJ\/AfMB9ADMAOQBFAIjAnsCfABYBAAB3ABcAAAAWAAAABQAFAQAAAAAAAAAaABgAABV3cm9uZy5ob3N0LmJhZHNzbC5jb23\/AQABAAAjAAAACgAMAAoAFwAYABkAFQATAAsAAgEAAA0AFgAUBAEEAwUBBQMGAQYDAwEDAwIBAgMAEAALAAkIaHR0cC8xLjE="}
+00746{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1620643422034,"flow_last_seen":1620643422196,"flow_tot_l4_data_len":389,"flow_min_l4_data_len":32,"flow_max_l4_data_len":277,"flow_avg_l4_data_len":97,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.222","dst_ip":"104.154.89.105","src_port":54772,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"wrong.host.badssl.com","ja3":"4e69e4e5627c5e4c2846ba3e64d23fb9","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"http\/1.1"}}
+00438{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":323351,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ACWQ1Mz5BBjWBrNaCABFAAA0X1pAADAGZeBomllpwKgC3gG71fRoLFRhT\/C3LYAQAOX9lwAAAQEICq19mPkBlw9N"}
+02334{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":325332,"pkt_caplen":1474,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1474,"pkt_l4_len":1440,"pkt":"ACWQ1Mz5BBjWBrNaCABFAAW0X1tAADAGYF9omllpwKgC3gG71fRoLFRhT\/C3LYAQAOVgYQAAAQEICq19mPoBlw9NFgMDAFACAABMAwOyFB1JAwr2Ek6Q1qUskLvoCKxZqXUDKBtO2f4bevmgIgDALwAAJAAAAAD\/AQABAAALAAQDAAECACMAAAAQAAsACQhodHRwLzEuMRYDAwtRCwALTQALSgAGrDCCBqgwggWQoAMCAQICEArwbNo3pgtkE0LwoesdWf0wDQYJKoZIhvcNAQELBQAwTTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEnMCUGA1UEAxMeRGlnaUNlcnQgU0hBMiBTZWN1cmUgU2VydmVyIENBMB4XDTIwMDMyMzAwMDAwMFoXDTIyMDUxNzEyMDAwMFowbjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFTATBgNVBAcTDFdhbG51dCBDcmVlazEcMBoGA1UEChMTTHVjYXMgR2Fycm9uIFRvcnJlczEVMBMGA1UEAwwMKi5iYWRzc2wuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwgTs+IzuBMKz2FDVcFjMkxjrXKhoSbAitfmVnrErLHY+bMBLYExM6rK0wA+AtrD5csmGAvlcQV0TK39xxEu86ZQuUDemZxxhjPZBQsVG0xaHJ5906wqdEVImIXNshEx5VeTRa+gGPUgVUq2zKNuq\/27\/YJVKd2s58STRMbbdTcDE\/FO5bUKttXz+rvUV0jNI5yJxx8IUemwo6jdK3+pstXK0flqiFtxpsVdE2woSq97DD0d0XEEi4Zr5G5PmrSIGKS6xukkcDCeeo\/uL90ByAKySCNmMV4RTgQXL5v5rVJhAJ4XHELtzcO9pGEEHRVV8+WQ\/PSzDqXzrkxpMhtHKhQIDAQABo4IDYTCCA10wHwYDVR0jBBgwFoAUD4BhHIIxYdUvKOeNRji0LOHG2eIwHQYDVR0OBBYEFJ3uwXuBCzpHaXEYfRE3k7ylGz\/7MCMGA1UdEQQcMBqCDCouYmFkc3NsLmNvbYIKYmFkc3NsLmNvbTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGsGA1UdHwRkMGIwL6AtoCuGKWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9zc2NhLXNoYTItZzYuY3JsMC+gLaArhilodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vc3NjYS1zaGEyLWc2LmNybDBMBgNVHSAERTBDMDcGCWCGSAGG\/WwBATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMAgGBmeBDAECAzB8BggrBgEFBQcBAQRwMG4wJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBGBggrBgEFBQcwAoY6aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMlNlY3VyZVNlcnZlckNBLmNydDAMBgNVHRMBAf8EAjAAMIIBfgYKKwYBBAHWeQIEAgSCAW4EggFqAWgAdgC72d+8H4pxtZOUI5eqkntHOFeVCqtS6BqQlmQ2jh7RhQAAAXEIRl4qAAAEAwBHMEUCIA31lQVxLlGQtmD+EotwEA4nRwuFPXuV0xshu0hTQ5UZAiEAs4pKwNZ3+26AHYb2hrtlZHLd1WiPtMvKd4JqJ1OXfQ8AdgAiRUUHWVUkVpY\/oS\/x922G4CMmY63AS39dxoNcbuIPAgAAAXEIRl5bAAAEAwBHMEUCIQDFolbItr2HcUQkbLvwzJgsoWNIiTyhxNnOnoz8nCG4KgIgLN5EkktDYlBYhwcO0GkP7Bjvv5TWL4xMZc1VFg=="}
+00803{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":6,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":1620643422034,"flow_last_seen":1620643422325,"flow_tot_l4_data_len":1861,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1440,"flow_avg_l4_data_len":310,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.222","dst_ip":"104.154.89.105","src_port":54772,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"wrong.host.badssl.com","ja3":"4e69e4e5627c5e4c2846ba3e64d23fb9","ja3s":"b898351eb5e266aefd3723d466935494","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"http\/1.1"}}
+00437{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":325346,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"BBjWBrNaACWQ1Mz5CABFAAA0gCZAAEAGNRTAqALeaJpZadX0AbtP8LctaCxZ4YAQAPuFsAAAAQEICgGXD22tfZj6"}
+02338{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":325350,"pkt_caplen":1474,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1474,"pkt_l4_len":1440,"pkt":"ACWQ1Mz5BBjWBrNaCABFAAW0X1xAADAGYF5omllpwKgC3gG71fRoLFnhT\/C3LYAQAOVbxAAAAQEICq19mPoBlw9NJbgNLwB2AFGjsPX9AXmcVm24N3iPDKR6zBsny\/eeiEKaDf7UiwXlAAABcQhGXnoAAAQDAEcwRQIgKsntiBqt8Au8DAABFkxISELhP3U\/wb5lb76pvfenWL0CIQDr2kLhCWP\/QUNxXqGmvr1GaG9EuokTOLEnGPhGv1cMkDANBgkqhkiG9w0BAQsFAAOCAQEA0RGxlwy3Tl0lhrUAn2mIi8LcZ9nBUyfAcCXCtYyCdEbjIP64xgX6pzTt0WJoxzlT+MiK6fc0hECZXqpkTNVTARYtGkJoljlTK2vAdHZ0SOpm9OT4RLfjGnImY0hiFbZ\/LtsvS2Zg7cVJecqnrZe\/za\/nbDdljnnrll7C8O5naQuKr4teuice3e8a4TtviFwS\/wdDnJ3RrE83b1IljILbU5SV0X1NajyYkUWS7AnOmrFUUByzMwdGrM6kt0lfJy\/gvGVsgIKZocHdedPeECqAtq7FAJYanOsjNN9RbBOGhbwq0\/FPCC01zojqS10nGowxzOiqyB4m6wytmzf0QwjpMwAEmDCCBJQwggN8oAMCAQICEAH9o+tuynXIiEOLckvPvJEwDQYJKoZIhvcNAQELBQAwYTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEgMB4GA1UEAxMXRGlnaUNlcnQgR2xvYmFsIFJvb3QgQ0EwHhcNMTMwMzA4MTIwMDAwWhcNMjMwMzA4MTIwMDAwWjBNMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5EaWdpQ2VydCBTSEEyIFNlY3VyZSBTZXJ2ZXIgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDcrliQTcHEMBWQNVtuPIIV9SxcvePb\/3FD+mQlgNTuGKJN8GbQCnNuEZg2F2SvN539+kGEr8evjP4ac03PM5eQopaHU4MruaZ1SC0dVjd72jEyGtesqwb0ql1Lt0dG3SqTw5AueYCA7xMEahQ7tZuSvsIHZU782vz\/eq7cXH5VMQzoOQek174v0wtq0rHfX\/5XdFM7NYDdro5EmLOfDtPa4Nf0aymrRKdLWIRtkkuBw9pzixKXSJAERXUa3Tcxl5LozVQNO+TBPzleLrjzXH4QjoZBAI1FZkewoWXOoKopCU7zl+voLqsPcqcwDvrH9P0Ud8OkWyhXwrP5gv23RVibAgMBAAGjggFaMIIBVjASBgNVHRMBAf8ECDAGAQH\/AgEAMA4GA1UdDwEB\/wQEAwIBhjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTB7BgNVHR8EdDByMDegNaAzhjFodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRHbG9iYWxSb290Q0EuY3JsMDegNaAzhjFodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRHbG9iYWxSb290Q0EuY3JsMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMB0GA1UdDgQWBBQPgGEcgjFh1S8o541GOLQs4cbZ4jAfBgNVHSMEGDAWgBQD3lA1VtFMu2bwo+IbG8OXsj3RVTANBgkqhkiG9w0BAQsFAAOCAQEAIz7fS9IxQqW2fkJcGkTMadFotF1L4AQhbEvibcyx4JePplMJzaoqZeU5Tx6DpW5cmKIkJub7oe2Txy4Cxk1Kv7BC33jas6j5bf8hhVM2YEx2zuw43A=="}
+00437{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":325356,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"BBjWBrNaACWQ1Mz5CABFAAA0gCdAAEAGNRPAqALeaJpZadX0AbtP8LctaCxfYYAQARKFsAAAAQEICgGXD22tfZj6"}
+01144{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":325538,"pkt_caplen":584,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":584,"pkt_l4_len":550,"pkt":"ACWQ1Mz5BBjWBrNaCABFAAI6X11AADAGY9domllpwKgC3gG71fRoLF9hT\/C3LYAYAOWeJwAAAQEICq19mPoBlw9N1lGA8MXW5dRNJ2Srm8c+cftIl7gzbckTB+6WohsYFfZcTEDts8Ls\/3HB40f\/1LkAtDdC2iDJ6m6K7hQGrn2iWZiIqBtvLfTyyRRfJs8sjX7tN8Cp1Tm5gr8ZDOo0rwAhaPitc+LJMto4JQtV05od8GiG7S5BNO98pVAdvzr508EIDObtHopYJeS4d60tbvVS3bR0j6tJLp07kzQoH3jOlOrHvdPJbRzeXDLzFgMDAU0MAAFJAwAXQQSfPD0+2hyzpX6XvHE87OMIo+mQMyEjJaKvRk6jzXbV7TJpQEYIvZLrAHFO+I0uH4KwZID6Vn4PD7d+\/e6PTvLpBgEBAIZuhJdnxAuMxxpuaYxZTCxybq\/SRhTfq91ygxjEhiZaoLeCiknryeR1XBTum26kIo1q2yNuvQk8CKd6hOc5f6oKERIacwAkubGLIArYaXHm\/ZxaG0I9LxOxHcK\/dYXwTP013HOSbXtfzzsXgLTKOTcqrRMiFijJkt4hp3CJh9UUMhEevNbRpuK82kXly3lQzK\/wwUQe4n1Ky2kVJ7f+Gu5\/kXa8HEhkdanGf2jf8faNYjAJe6mcd8KPfQgfyh6qH+LsaLIrat96jRia8wi+9BxPUVaAKI2dtdktuorf5RZwi\/cfY+t5ldoduI3QUJvEv7M9gtUtdo42GFJl9c9KysQWAwMABA4AAAA="}
+01127{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":10,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":10,"flow_first_seen":1620643422034,"flow_last_seen":1620643422325,"flow_tot_l4_data_len":3915,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1440,"flow_avg_l4_data_len":391,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.222","dst_ip":"104.154.89.105","src_port":54772,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"10":"TLS Certificate Mismatch"},"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"wrong.host.badssl.com","server_names":"*.badssl.com,badssl.com","ja3":"4e69e4e5627c5e4c2846ba3e64d23fb9","ja3s":"b898351eb5e266aefd3723d466935494","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA","issuerDN":"C=US, ST=California, L=Walnut Creek, O=Lucas Garron Torres, CN=*.badssl.com","alpn":"http\/1.1","fingerprint":"18:45:B2:16:EF:D0:83:9A:18:51:A9:57:32:5D:A3:36:21:70:49:CB"}}
+00439{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":325550,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"BBjWBrNaACWQ1Mz5CABFAAA0gChAAEAGNRLAqALeaJpZadX0AbtP8LctaCxhZ4AQASiFsAAAAQEICgGXD22tfZj6"}
+00544{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":326406,"pkt_caplen":141,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":141,"pkt_l4_len":107,"pkt":"BBjWBrNaACWQ1Mz5CABFAAB\/gClAAEAGNMbAqALeaJpZadX0AbtP8LctaCxhZ4AYASiF+wAAAQEICgGXD22tfZj6FgMDAEYQAABCQQR3kdBEzsAbckXxhxZPB7YNFIGgegw6wbTOhZCV559EoLoXsK\/DABGNdFUNvhJlgjoi6pF7kn5BtR715jNzOuWN"}
+00440{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":493716,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ACWQ1Mz5BBjWBrNaCABFAAA0X15AADAGZdxomllpwKgC3gG71fRoLGFnT\/C3eIAQAOXvfAAAAQEICq19maMBlw9t"}
+00510{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":493729,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"BBjWBrNaACWQ1Mz5CABFAABngCpAAEAGNN3AqALeaJpZadX0AbtP8Ld4aCxhZ4AYASiF4wAAAQEICgGXD5etfZmjFAMDAAEBFgMDACgAAAAAAAAAAFby\/uAJZTNFwwUqUoCgOytrFRiVxd7BGhLKzCfnFnrv"}
+00440{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1620643422,"pkt_ts_usec":620446,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ACWQ1Mz5BBjWBrNaCABFAAA0X19AADAGZdtomllpwKgC3gG71fRoLGFnT\/C3q4AQAOXuoAAAAQEICq19miIBlw+X"}
+00508{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":21,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":21,"flow_first_seen":1620643422034,"flow_last_seen":1620643422754,"flow_tot_l4_data_len":4698,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1440,"flow_avg_l4_data_len":223,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.222","dst_ip":"104.154.89.105","src_port":54772,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00142{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":21,"source":"ssl-cert-name-mismatch.pcap","alias":"nDPId-test"}
diff --git a/test/results/telegram.pcap.out b/test/results/telegram.pcap.out
index 0c8b4be67..134243261 100644
--- a/test/results/telegram.pcap.out
+++ b/test/results/telegram.pcap.out
@@ -63,10 +63,10 @@
00514{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":45,"source":"telegram.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1588779601223,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}}
00781{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":50,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779601,"pkt_ts_usec":447909,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJZAAEARYHvAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGAM98X0EAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
00583{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":67,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779603,"pkt_ts_usec":292776,"pkt_caplen":181,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":181,"pkt_l4_len":147,"pkt":"AQBeAAD7wJrQLWJ0CABFAACnQj4AAP8R1i7AqAE14AAA+xTpFOkAk34YAAAAAAAFAAAAAAABCF9ob21la2l0BF90Y3AFbG9jYWwAAAyAAQ9fY29tcGFuaW9uLWxpbmvAFQAMgAEFX3Jhb3DAFQAMgAEIX2FpcnBsYXnAFQAMgAEMX3NsZWVwLXByb3h5BF91ZHDAGgAMgAEAACkFoAAAEZQAEgAEAA4AMeKa0C1idMCa0C1idA=="}
-00607{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":67,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1588779596464,"flow_last_seen":1588779603292,"flow_tot_l4_data_len":200,"flow_min_l4_data_len":53,"flow_max_l4_data_len":147,"flow_avg_l4_data_len":100,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_homekit._tcp.local"}}
+00568{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":67,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1588779596464,"flow_last_seen":1588779603292,"flow_tot_l4_data_len":200,"flow_min_l4_data_len":53,"flow_max_l4_data_len":147,"flow_avg_l4_data_len":100,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_homekit._tcp.local"}}
00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":68,"source":"telegram.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1588779603292,"flow_last_seen":0,"flow_tot_l4_data_len":147,"flow_min_l4_data_len":147,"flow_max_l4_data_len":147,"flow_avg_l4_data_len":147,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::18a0:a412:8935:c01b","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00612{"flow_id":11,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":68,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779603,"pkt_ts_usec":292829,"pkt_caplen":201,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":201,"pkt_l4_len":147,"pkt":"MzMAAAD7wJrQLWJ0ht1gBqDxAJMR\/\/6AAAAAAAAAGKCkEok1wBv\/AgAAAAAAAAAAAAAAAAD7FOkU6QCTHG8AAAAAAAUAAAAAAAEIX2hvbWVraXQEX3RjcAVsb2NhbAAADIABD19jb21wYW5pb24tbGlua8AVAAyAAQVfcmFvcMAVAAyAAQhfYWlycGxhecAVAAyAAQxfc2xlZXAtcHJveHkEX3VkcMAaAAyAAQAAKQWgAAARlAASAAQADgAx4prQLWJ0wJrQLWJ0"}
-00599{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":68,"source":"telegram.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1588779603292,"flow_last_seen":0,"flow_tot_l4_data_len":147,"flow_min_l4_data_len":147,"flow_max_l4_data_len":147,"flow_avg_l4_data_len":147,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::18a0:a412:8935:c01b","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_homekit._tcp.local"}}
+00560{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":68,"source":"telegram.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1588779603292,"flow_last_seen":0,"flow_tot_l4_data_len":147,"flow_min_l4_data_len":147,"flow_max_l4_data_len":147,"flow_avg_l4_data_len":147,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::18a0:a412:8935:c01b","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_homekit._tcp.local"}}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":69,"source":"telegram.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1588779603320,"flow_last_seen":0,"flow_tot_l4_data_len":286,"flow_min_l4_data_len":286,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":286,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.53","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00769{"flow_id":12,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":69,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779603,"pkt_ts_usec":320702,"pkt_caplen":320,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":320,"pkt_l4_len":286,"pkt":"wJrQLWJ0KDc3AG3ICABFAAEyUGUAAP8R5oLAqAFNwKgBNRTpFOkBHhkkAACEAAAAAAEAAAAED19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMAAEAABGUABANTHVjYeKAmXMgaU1hY8AMwDIAIYABAAAAeAATAAAAAMAFCkx1Y2FzLWlNYWPAIcAyABCAAQAAEZQAWBZycEJBPTM5OjJBOjg4OkFDOjQxOkFCCnJwVnI9MTUyLjERcnBIST1mOWM0NmM2ZGQwN2QRcnBITj0zYzVkYzVjZTk1NzgRcnBIQT04Y2E4Y2I3MzFjMWMNTHVjYeKAmXMgaU1hYwxfZGV2aWNlLWluZm\/AHAAQAAEAABGUABoObW9kZWw9aU1hYzExLDMKb3N4dmVycz0xN8BUAAGAAQAAAHgABMCoAU0="}
00558{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":69,"source":"telegram.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1588779603320,"flow_last_seen":0,"flow_tot_l4_data_len":286,"flow_min_l4_data_len":286,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":286,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.53","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_companion-link._tcp.local"}}
@@ -79,9 +79,9 @@
00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":99,"source":"telegram.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1588779596465,"flow_last_seen":0,"flow_tot_l4_data_len":319,"flow_min_l4_data_len":319,"flow_max_l4_data_len":319,"flow_avg_l4_data_len":319,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00781{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":99,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779606,"pkt_ts_usec":465822,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJdAAEARYHrAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGABAmSTUAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
00533{"flow_id":3,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":102,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779607,"pkt_ts_usec":307651,"pkt_caplen":142,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":142,"pkt_l4_len":108,"pkt":"AQBeAAD7wJrQLWJ0CABFAACAeJ4AAP8Rn\/XAqAE14AAA+xTpFOkAbGrlAAAAAAABAAEAAAABDF9zbGVlcC1wcm94eQRfdWRwBWxvY2FsAAAMAAHADAAMAAEAABGRABIPNTAtMzUtMTAtNzAuMSAxwAwAACkFoAAAEZQAEgAEAA4AMeKa0C1idMCa0C1idA=="}
-00612{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":102,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_first_seen":1588779596464,"flow_last_seen":1588779607307,"flow_tot_l4_data_len":512,"flow_min_l4_data_len":53,"flow_max_l4_data_len":204,"flow_avg_l4_data_len":128,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_sleep-proxy._udp.local"}}
+00573{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":102,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_first_seen":1588779596464,"flow_last_seen":1588779607307,"flow_tot_l4_data_len":512,"flow_min_l4_data_len":53,"flow_max_l4_data_len":204,"flow_avg_l4_data_len":128,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_sleep-proxy._udp.local"}}
00561{"flow_id":11,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":103,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779607,"pkt_ts_usec":308336,"pkt_caplen":162,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":162,"pkt_l4_len":108,"pkt":"MzMAAAD7wJrQLWJ0ht1gBqDxAGwR\/\/6AAAAAAAAAGKCkEok1wBv\/AgAAAAAAAAAAAAAAAAD7FOkU6QBsCTwAAAAAAAEAAQAAAAEMX3NsZWVwLXByb3h5BF91ZHAFbG9jYWwAAAwAAcAMAAwAAQAAEZEAEg81MC0zNS0xMC03MC4xIDHADAAAKQWgAAARlAASAAQADgAx4prQLWJ0wJrQLWJ0"}
-00624{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":103,"source":"telegram.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":3,"flow_first_seen":1588779603292,"flow_last_seen":1588779607308,"flow_tot_l4_data_len":459,"flow_min_l4_data_len":108,"flow_max_l4_data_len":204,"flow_avg_l4_data_len":153,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::18a0:a412:8935:c01b","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_sleep-proxy._udp.local"}}
+00585{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":103,"source":"telegram.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":3,"flow_first_seen":1588779603292,"flow_last_seen":1588779607308,"flow_tot_l4_data_len":459,"flow_min_l4_data_len":108,"flow_max_l4_data_len":204,"flow_avg_l4_data_len":153,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::18a0:a412:8935:c01b","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_sleep-proxy._udp.local"}}
00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":104,"source":"telegram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1588779607374,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":52118,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00438{"flow_id":13,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":104,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779607,"pkt_ts_usec":374355,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA9u6QAAP8RfGzAqAFNwKgBAcuWADUAKd8a0oUBAAABAAAAAAAAAmluCWFwcGNlbnRlcgJtcwAAAQAB"}
00637{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":104,"source":"telegram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1588779607374,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":52118,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Microsoft","breed":"Safe","category":"Cloud"},"dns": {"query":"in.appcenter.ms","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
@@ -273,7 +273,7 @@
00643{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":710,"source":"telegram.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1588779629079,"flow_last_seen":0,"flow_tot_l4_data_len":49,"flow_min_l4_data_len":49,"flow_max_l4_data_len":49,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.ntop","breed":"Safe","category":"Network"},"dns": {"query":"b._dns-sd._udp.ntop.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":12,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00782{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":719,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779631,"pkt_ts_usec":447782,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJxAAEARYHXAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGALnIwr0AAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
00479{"flow_id":3,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":720,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779631,"pkt_ts_usec":710543,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"AQBeAAD7wJrQLWJ0CABFAABZzLkAAAIRSQLAqAE14AAA+xTpFOkARfrBAAoAAAACAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQlfQ0MzMkU3NTMEX3N1YsAMAAwAAQ=="}
-00611{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":720,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":6,"flow_first_seen":1588779596464,"flow_last_seen":1588779631710,"flow_tot_l4_data_len":689,"flow_min_l4_data_len":53,"flow_max_l4_data_len":204,"flow_avg_l4_data_len":114,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_googlecast._tcp.local"}}
+00572{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":720,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":6,"flow_first_seen":1588779596464,"flow_last_seen":1588779631710,"flow_tot_l4_data_len":689,"flow_min_l4_data_len":53,"flow_max_l4_data_len":204,"flow_avg_l4_data_len":114,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_googlecast._tcp.local"}}
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":721,"source":"telegram.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1588779632305,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
01030{"flow_id":34,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":721,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779632,"pkt_ts_usec":305252,"pkt_caplen":506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":506,"pkt_l4_len":472,"pkt":"\/\/\/\/\/\/\/\/KDc3AG3ICABFAAHsdQUAAEARQgfAqAFN\/\/\/\/\/0RcRFwB2FvpeyJ2ZXJzaW9uIjogWzIsIDBdLCAicG9ydCI6IDE3NTAwLCAiaG9zdF9pbnQiOiA0MDk1NjMzNTA1MDQ3NDIyMDI0ODQ4MjA1NjAzMDgyNTQwNDYyOSwgImRpc3BsYXluYW1lIjogIiIsICJuYW1lc3BhY2VzIjogWzUzMDMzMDEyNDgsIDc4NTI2NjE3NywgMTUyNjI2MzA0NSwgMjg1MjE2MDcsIDE0ODE5MzM3LCA0NTE0NzI2NTgsIDczNjM0MTUyOCwgOTM4ODEzODQ5LCAyNzUwMzcwNTYwLCAxMjY3Njk1MTA5LCA1NDQwNDA3MDcyLCA1ODM0NDk5NiwgNDA1NjQ2MjU5MiwgNzA1MzYyNzE4NCwgMTUyMjE3NzU4NywgMTQyMTExNDM5OSwgMTI1MjExNjQyOSwgNzA3OTYzNjY4OCwgMTc2OTY0MzA3LCAxMjU1NDA1NjYsIDEwNDc0MjgxODksIDQ3MTYxOTAwNDgsIDU0NjcxNjMwODgsIDExOTUwNDQwNzEsIDk2ODUzMjI0LCAxNzYwOTk2MywgNjQ3ODMwMzQ0MCwgNTExNzA2NjQyLCA2Mjk3OTU1MTg0LCAxNDE1NjIwMzUwXX0="}
00517{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":721,"source":"telegram.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1588779632305,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}}
diff --git a/test/results/tls_invalid_reads.pcap.out b/test/results/tls_invalid_reads.pcap.out
index b1a7bdd9d..1f93cadcc 100644
--- a/test/results/tls_invalid_reads.pcap.out
+++ b/test/results/tls_invalid_reads.pcap.out
@@ -15,5 +15,11 @@
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":9,"source":"tls_invalid_reads.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1421985541772,"flow_last_seen":0,"flow_tot_l4_data_len":30,"flow_min_l4_data_len":30,"flow_max_l4_data_len":30,"flow_avg_l4_data_len":30,"midstream":1,"l3_proto":"ip4","src_ip":"74.80.160.99","dst_ip":"67.217.77.28","src_port":3258,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00433{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"tls_invalid_reads.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1421985541,"pkt_ts_usec":772794,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"AAOf2SAhEFbKCIWJCABFAAAyM2VAAH8GFrhKUKBjQ9lNHAy6AbvQcb+g7Sa+J1AY\/QKZOwAlAAMBAAUBAAABAQ=="}
00501{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":9,"source":"tls_invalid_reads.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1421985541772,"flow_last_seen":0,"flow_tot_l4_data_len":30,"flow_min_l4_data_len":30,"flow_max_l4_data_len":30,"flow_avg_l4_data_len":30,"midstream":1,"l3_proto":"ip4","src_ip":"74.80.160.99","dst_ip":"67.217.77.28","src_port":3258,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
-00481{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9,"source":"tls_invalid_reads.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1421985541772,"flow_last_seen":0,"flow_tot_l4_data_len":30,"flow_min_l4_data_len":30,"flow_max_l4_data_len":30,"flow_avg_l4_data_len":30,"midstream":1,"l3_proto":"ip4","src_ip":"74.80.160.99","dst_ip":"67.217.77.28","src_port":3258,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
-00136{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":9,"source":"tls_invalid_reads.pcap","alias":"nDPId-test"}
+00482{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":10,"source":"tls_invalid_reads.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1421985541772,"flow_last_seen":0,"flow_tot_l4_data_len":30,"flow_min_l4_data_len":30,"flow_max_l4_data_len":30,"flow_avg_l4_data_len":30,"midstream":1,"l3_proto":"ip4","src_ip":"74.80.160.99","dst_ip":"67.217.77.28","src_port":3258,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
+00477{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":10,"source":"tls_invalid_reads.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1544035479,"pkt_ts_usec":538596,"pkt_caplen":118,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":118,"pkt_l4_len":0,"pkt":"AAAAAAAFYAgQGhx\/gQBsn4EAYAIIAEVoAGDVegAA\/xG3XAruJEAK7vQxCGgIaABMAAAw\/wA8B+zklkUAADyx3UAAQAbcAwq\/ixE23eAt5LgBu\/kVfJ4AAAAAoAL\/\/3GmAAACBAW0BAIICgAUzUMAAAAAAQMDBg=="}
+00168{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":10,"source":"tls_invalid_reads.pcap","alias":"nDPId-test","type":33024}
+00472{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":11,"source":"tls_invalid_reads.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1544035479,"pkt_ts_usec":721867,"pkt_caplen":118,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":118,"pkt_l4_len":0,"pkt":"AAAAAAAFYAgQGhx\/gQAMn4EAAAIIAEVoAGBxLwAAOxHfqAru9DEK7iRACGgIaABMAAAw\/wA8AABhskUAADwAAEAA5Abp4Dbd4C0Kv4sRAbvkuBpaSBv5FXyfoBJxILDEAAACBAV4BAIICh1e0BYAFM1DAQMDCA=="}
+00168{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":11,"source":"tls_invalid_reads.pcap","alias":"nDPId-test","type":33024}
+00751{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":12,"source":"tls_invalid_reads.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1544035479,"pkt_ts_usec":768404,"pkt_caplen":324,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":324,"pkt_l4_len":0,"pkt":"AAAAAAAFYAgQGhx\/gQBsn4EAYAIIAEVoAS7V9AAA\/xG2FAruJEAK7vQxCGgIaAEaAAAw\/wEKB+zklkUAAOux30AAQAbbUgq\/ixE23eAt5LgBu\/kVfJ8aWkgcgBgFWRb9AAABAQgKABTNax1e0BYWAwEAsgEAAK4DA+Jfj3VZ7Se+llOF2hoK\/0SOWa4JB8kGoFPipHXr6zI3AAAowCvALMAvwDAAngCfwAnACsATwBQAMwA5wAfAEQCcAJ0ALwA1AAUA\/wEAAF0AAAAWABQAABFlLmNyYXNobHl0aWNzLmNvbQAXAAAAIwAAAA0AFgAUBgEGAwUBBQMEAQQDAwEDAwIBAgMAEAALuImlL1Y1GeVflD5H40\/GlDV3w0Q4eHATzs15UMvq3bDFbT9WBxf4WY7WsXHZhuEm\/fgNJZccyFnwUKMb"}
+00168{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":12,"source":"tls_invalid_reads.pcap","alias":"nDPId-test","type":33024}
+00137{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":12,"source":"tls_invalid_reads.pcap","alias":"nDPId-test"}
diff --git a/test/results/wa_voice.pcap.out b/test/results/wa_voice.pcap.out
index fc18c4612..98002e2bb 100644
--- a/test/results/wa_voice.pcap.out
+++ b/test/results/wa_voice.pcap.out
@@ -229,9 +229,9 @@
00428{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":612,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455737,"pkt_ts_usec":155479,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkkLkxKPrKCABFAAA0AABAAEAGKcrAqAIMEfI8VMDKFGdIDzsY7pIez4AQB\/\/KXAAAAQEICjTOr488tAya"}
00457{"flow_id":26,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":618,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455737,"pkt_ts_usec":290531,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"xiwDYGpkkLkxKPrKCABFAABIaUoAAEAR\/yrAqAIMATxOQNwI+xoANFOWAAEAGCESpEJEp04wqayhNgpwqhcACAAUjz2kl+dJJZ\/5pJmfYUQPx33hp98="}
00581{"flow_id":12,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":632,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455737,"pkt_ts_usec":893179,"pkt_caplen":180,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":180,"pkt_l4_len":146,"pkt":"AQBeAAD7kLkxKPrKCABFAACmf9YAAP8Rl8DAqAIM4AAA+xTpFOkAklETAAAAAAAFAAEAAAAACF9ob21la2l0BF90Y3AFbG9jYWwAAAwAAQ9fY29tcGFuaW9uLWxpbmvAFQAMAAEMX3NsZWVwLXByb3h5BF91ZHDAGgAMAAEFX3Jhb3DAFQAMAAEIX2FpcnBsYXnAFQAMAAHAJQAMAAEAAA2VABANTHVjYeKAmXMgaU1hY8Al"}
-00608{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":632,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":5,"flow_first_seen":1561455705874,"flow_last_seen":1561455737893,"flow_tot_l4_data_len":374,"flow_min_l4_data_len":57,"flow_max_l4_data_len":146,"flow_avg_l4_data_len":74,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_homekit._tcp.local"}}
+00569{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":632,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":5,"flow_first_seen":1561455705874,"flow_last_seen":1561455737893,"flow_tot_l4_data_len":374,"flow_min_l4_data_len":57,"flow_max_l4_data_len":146,"flow_avg_l4_data_len":74,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_homekit._tcp.local"}}
00613{"flow_id":13,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":633,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455737,"pkt_ts_usec":895397,"pkt_caplen":200,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":200,"pkt_l4_len":146,"pkt":"MzMAAAD7kLkxKPrKht1gDagnAJIR\/\/6AAAAAAAAABBRAnYr9nwX\/AgAAAAAAAAAAAAAAAAD7FOkU6QCSh5AAAAAAAAUAAQAAAAAIX2hvbWVraXQEX3RjcAVsb2NhbAAADAABD19jb21wYW5pb24tbGlua8AVAAwAAQxfc2xlZXAtcHJveHkEX3VkcMAaAAwAAQVfcmFvcMAVAAwAAQhfYWlycGxhecAVAAwAAcAlAAwAAQAADZUAEA1MdWNh4oCZcyBpTWFjwCU="}
-00617{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":633,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":5,"flow_first_seen":1561455705874,"flow_last_seen":1561455737895,"flow_tot_l4_data_len":374,"flow_min_l4_data_len":57,"flow_max_l4_data_len":146,"flow_avg_l4_data_len":74,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::414:409d:8afd:9f05","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_homekit._tcp.local"}}
+00578{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":633,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":5,"flow_first_seen":1561455705874,"flow_last_seen":1561455737895,"flow_tot_l4_data_len":374,"flow_min_l4_data_len":57,"flow_max_l4_data_len":146,"flow_avg_l4_data_len":74,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::414:409d:8afd:9f05","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_homekit._tcp.local"}}
00455{"flow_id":26,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":634,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455737,"pkt_ts_usec":912653,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"xiwDYGpkkLkxKPrKCABFAABI3cwAAEARiqjAqAIMATxOQNwI+xoANNKMAAEAGCESpELCmPpdxscpAaqNI2UACAAUdLiw0j82TxziQLO4s52BG1yXKEE="}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":640,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1561455738163,"flow_last_seen":0,"flow_tot_l4_data_len":20,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"169.254.162.244","src_port":49352,"dst_port":49159,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00410{"flow_id":27,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":640,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455738,"pkt_ts_usec":163757,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"2DBiVgAckLkxKPrKCABFAAAok2wAAP8GGLzAqAIMqf6i9MDIwAcC6LXACBPPY1AQCAWHOAAA"}
diff --git a/test/run_tests.sh b/test/run_tests.sh
index 4bebf7a3c..6268fc39d 100755
--- a/test/run_tests.sh
+++ b/test/run_tests.sh
@@ -9,18 +9,24 @@ NETCAT_EXEC="nc -q 0 -l 127.0.0.1 9000"
JSON_VALIDATOR="$(realpath "${3:-"${MYDIR}/../examples/py-schema-validation/py-schema-validation.py"}")"
SEMN_VALIDATOR="$(realpath "${4:-"${MYDIR}/../examples/py-semantic-validation/py-semantic-validation.py"}")"
-if [ $# -eq 0 -a -x "${MYDIR}/../libnDPI/tests/pcap" ]; then
- nDPI_SOURCE_ROOT="${MYDIR}/../libnDPI"
-elif [ $# -ne 1 -a $# -ne 2 -a $# -ne 3 -a $# -ne 4 ]; then
+function usage()
+{
cat <<EOF
usage: ${0} [path-to-nDPI-source-root] \\
- [path-to-nDPId-test-exec] [path-to-nDPId-JSON-validator] [path-to-nDPId-SEMANTIC-validator]
+ [path-to-nDPId-test-exec] [path-to-nDPId-JSON-validator] [path-to-nDPId-SEMANTIC-validator]
- path-to-nDPId-test-exec defaults to ${nDPId_test_EXEC}
- path-to-nDPId-JSON-validator defaults to ${JSON_VALIDATOR}
- path-to-nDPId-SEMANTIC-validator default to ${SEMN_VALIDATOR}
+ path-to-nDPId-test-exec defaults to ${nDPId_test_EXEC}
+ path-to-nDPId-JSON-validator defaults to ${JSON_VALIDATOR}
+ path-to-nDPId-SEMANTIC-validator default to ${SEMN_VALIDATOR}
EOF
-exit 2
+return 0
+}
+
+if [ $# -eq 0 -a -x "${MYDIR}/../libnDPI/tests/pcap" ]; then
+ nDPI_SOURCE_ROOT="${MYDIR}/../libnDPI"
+elif [ $# -ne 1 -a $# -ne 2 -a $# -ne 3 -a $# -ne 4 ]; then
+ usage
+ exit 2
else
nDPI_SOURCE_ROOT="$(realpath "${1}")"
fi
@@ -42,10 +48,9 @@ function sighandler()
trap sighandler SIGINT SIGTERM
if [ ! -x "${nDPId_test_EXEC}" ]; then
-cat >&2 <<EOF
-Required nDPId-test executable does not exist; ${nDPId_test_EXEC}
-EOF
-exit 5
+ usage
+ printf '\n%s\n' "Required nDPId-test executable does not exist; ${nDPId_test_EXEC}"
+ exit 5
fi
nc -h |& head -n1 | grep -qoE '^OpenBSD netcat' || {
Powered by cgit, Themed by Ted Yin.