diff options
322 files changed, 7039 insertions, 900 deletions
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 769d87fca..3b675391d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -31,7 +31,7 @@ jobs: sudo apt-get install autoconf automake cmake libtool pkg-config gettext libjson-c-dev flex bison libpcap-dev zlib1g-dev sudo apt-get install gcc-arm-linux-gnueabihf gcc-mingw-w64 libc6-dev lcov - name: Install Ubuntu Prerequisites (libgcrypt) - if: startsWith(matrix.os, 'ubuntu') && !startsWith(matrix.ndpid_gcrypt, '-DNDPI_WITH_GCRYPT=OFF') + if: startsWith(matrix.os, 'ubuntu') && startsWith(matrix.ndpid_gcrypt, '-DNDPI_WITH_GCRYPT=ON') run: | sudo apt-get install libgcrypt20-dev - name: Install Ubuntu Prerequisities (zlib) @@ -50,7 +50,7 @@ jobs: ./build/nDPId-test || test $? -eq 1 ./build/nDPId -h || test $? -eq 1 - name: Test DIFF - if: startsWith(matrix.os, 'ubuntu') && !startsWith(matrix.ndpid_gcrypt, '-DNDPI_WITH_GCRYPT=OFF') + if: startsWith(matrix.os, 'ubuntu') && startsWith(matrix.ndpid_gcrypt, '-DNDPI_WITH_GCRYPT=OFF') run: | ./test/run_tests.sh ./libnDPI ./build/nDPId-test - name: Daemon diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index f27896c8b..41ad3109d 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -11,7 +11,7 @@ before_script: coreutils sudo \ build-essential make cmake binutils gcc autoconf automake \ libtool pkg-config git \ - libpcap-dev libgcrypt-dev libgpg-error-dev libjson-c-dev zlib1g-dev \ + libpcap-dev libgpg-error-dev libjson-c-dev zlib1g-dev \ netcat-openbsd python3 python3-jsonschema tree lcov after_script: diff --git a/CMakeLists.txt b/CMakeLists.txt index 3c99fe254..5b82e25cc 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -134,8 +134,7 @@ if(ENABLE_ZLIB) endif() if(NDPI_WITH_GCRYPT) message(STATUS "Enable GCRYPT") -else() - set(NDPI_ADDITIONAL_ARGS "${NDPI_ADDITIONAL_ARGS} --disable-gcrypt") + set(NDPI_ADDITIONAL_ARGS "${NDPI_ADDITIONAL_ARGS} --with-local-libgcrypt") endif() if(NDPI_WITH_PCRE) message(STATUS "Enable PCRE") @@ -33,7 +33,7 @@ #define nDPId_TCP_POST_END_FLOW_TIME 120000u /* 120 sec */ #define nDPId_THREAD_DISTRIBUTION_SEED 0x03dd018b #define nDPId_PACKETS_PER_FLOW_TO_SEND 15u -#define nDPId_PACKETS_PER_FLOW_TO_PROCESS NDPI_MAX_NUM_PKTS_PER_FLOW_TO_DISSECT +#define nDPId_PACKETS_PER_FLOW_TO_PROCESS NDPI_DEFAULT_MAX_NUM_PKTS_PER_FLOW_TO_DISSECT #define nDPId_FLOW_STRUCT_SEED 0x5defc104 /* nDPIsrvd default config options */ diff --git a/libnDPI b/libnDPI -Subproject 8b062295cc76a60e3905c054ce37bd17669464d +Subproject bb12837ca75efc2691ecb18fd5f56e2d097ef26 @@ -47,8 +47,8 @@ #define DLT_DSA_TAG_EDSA 285 #endif -#if ((NDPI_MAJOR == 4 && NDPI_MINOR < 4) || NDPI_MAJOR < 4) && NDPI_API_VERSION < 5892 -#error "nDPI >= 4.4.0 or API version >= 5892 required" +#if ((NDPI_MAJOR == 4 && NDPI_MINOR < 3) || NDPI_MAJOR < 4) && NDPI_API_VERSION < 6043 +#error "nDPI >= 4.3.0 or API version >= 6043 required" #endif #if !defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_4) || !defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_8) diff --git a/schema/flow_event_schema.json b/schema/flow_event_schema.json index 385fcf192..6a7f54628 100644 --- a/schema/flow_event_schema.json +++ b/schema/flow_event_schema.json @@ -107,11 +107,11 @@ }, "flow_first_seen": { "type": "number", - "minimum": 24710 + "minimum": 0 }, "flow_last_seen": { "type": "number", - "minimum": 24710 + "minimum": 0 }, "flow_idle_time": { "type": "number", diff --git a/schema/packet_event_schema.json b/schema/packet_event_schema.json index 3ad88f79f..e0e549d71 100644 --- a/schema/packet_event_schema.json +++ b/schema/packet_event_schema.json @@ -66,7 +66,7 @@ }, "flow_last_seen": { "type": "number", - "minimum": 24710 + "minimum": 0 }, "flow_idle_time": { "type": "number", diff --git a/scripts/get-and-build-libndpi.sh b/scripts/get-and-build-libndpi.sh index f4bae262e..8b83ae988 100755 --- a/scripts/get-and-build-libndpi.sh +++ b/scripts/get-and-build-libndpi.sh @@ -36,7 +36,7 @@ if [ ! -z "${CROSS_COMPILE_TRIPLET}" ]; then else HOST_ARG="" fi -./autogen.sh --prefix="${DEST_INSTALL}" --with-only-libndpi ${HOST_ARG} ${ADDITIONAL_ARGS} +./autogen.sh --enable-option-checking=fatal --prefix="${DEST_INSTALL}" --with-only-libndpi ${HOST_ARG} ${ADDITIONAL_ARGS} ${MAKE_PROGRAM} install rm -f "${LOCKFILE}" diff --git a/test/results/1kxun.pcap.out b/test/results/1kxun.pcap.out index 0ceeff93a..96c648152 100644 --- a/test/results/1kxun.pcap.out +++ b/test/results/1kxun.pcap.out @@ -701,9 +701,9 @@ ~~ total active/idle flows...: 129/129 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4904682 bytes -~~ total memory freed........: 4904682 bytes -~~ total allocations/frees...: 103042/103042 +~~ total memory allocated....: 5403589 bytes +~~ total memory freed........: 5403589 bytes +~~ total allocations/frees...: 114924/114924 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 458 chars ~~ json string max len.......: 2444 chars diff --git a/test/results/443-chrome.pcap.out b/test/results/443-chrome.pcap.out index d87c213d9..46ebf031f 100644 --- a/test/results/443-chrome.pcap.out +++ b/test/results/443-chrome.pcap.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681587 bytes -~~ total memory freed........: 4681587 bytes -~~ total allocations/frees...: 101145/101145 +~~ total memory allocated....: 5180494 bytes +~~ total memory freed........: 5180494 bytes +~~ total allocations/frees...: 113027/113027 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 466 chars ~~ json string max len.......: 2429 chars diff --git a/test/results/443-curl.pcap.out b/test/results/443-curl.pcap.out index 1046c1645..f82d56091 100644 --- a/test/results/443-curl.pcap.out +++ b/test/results/443-curl.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4687587 bytes -~~ total memory freed........: 4687587 bytes -~~ total allocations/frees...: 101258/101258 +~~ total memory allocated....: 5186494 bytes +~~ total memory freed........: 5186494 bytes +~~ total allocations/frees...: 113140/113140 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 1104 chars diff --git a/test/results/443-firefox.pcap.out b/test/results/443-firefox.pcap.out index c329d8b2d..98f65d466 100644 --- a/test/results/443-firefox.pcap.out +++ b/test/results/443-firefox.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4703823 bytes -~~ total memory freed........: 4703823 bytes -~~ total allocations/frees...: 101817/101817 +~~ total memory allocated....: 5202730 bytes +~~ total memory freed........: 5202730 bytes +~~ total allocations/frees...: 113699/113699 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 467 chars ~~ json string max len.......: 1170 chars diff --git a/test/results/443-git.pcap.out b/test/results/443-git.pcap.out index de811a502..34268b0d6 100644 --- a/test/results/443-git.pcap.out +++ b/test/results/443-git.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4689966 bytes -~~ total memory freed........: 4689966 bytes -~~ total allocations/frees...: 101221/101221 +~~ total memory allocated....: 5188873 bytes +~~ total memory freed........: 5188873 bytes +~~ total allocations/frees...: 113103/113103 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 1212 chars diff --git a/test/results/443-opvn.pcap.out b/test/results/443-opvn.pcap.out index 75931dce8..9b362deed 100644 --- a/test/results/443-opvn.pcap.out +++ b/test/results/443-opvn.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682892 bytes -~~ total memory freed........: 4682892 bytes -~~ total allocations/frees...: 101190/101190 +~~ total memory allocated....: 5181799 bytes +~~ total memory freed........: 5181799 bytes +~~ total allocations/frees...: 113072/113072 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 689 chars diff --git a/test/results/443-safari.pcap.out b/test/results/443-safari.pcap.out index f21bc9f45..015fbe91e 100644 --- a/test/results/443-safari.pcap.out +++ b/test/results/443-safari.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685645 bytes -~~ total memory freed........: 4685645 bytes -~~ total allocations/frees...: 101190/101190 +~~ total memory allocated....: 5184552 bytes +~~ total memory freed........: 5184552 bytes +~~ total allocations/frees...: 113072/113072 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 466 chars ~~ json string max len.......: 1148 chars diff --git a/test/results/4in4tunnel.pcap.out b/test/results/4in4tunnel.pcap.out index a3ffc414f..8e6da69d4 100644 --- a/test/results/4in4tunnel.pcap.out +++ b/test/results/4in4tunnel.pcap.out @@ -23,9 +23,9 @@ ~~ total active/idle flows...: 0/0 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4678638 bytes -~~ total memory freed........: 4678638 bytes -~~ total allocations/frees...: 101140/101140 +~~ total memory allocated....: 5177545 bytes +~~ total memory freed........: 5177545 bytes +~~ total allocations/frees...: 113022/113022 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 192 chars ~~ json string max len.......: 555 chars diff --git a/test/results/4in6tunnel.pcap.out b/test/results/4in6tunnel.pcap.out index 79c341f54..4a75724fb 100644 --- a/test/results/4in6tunnel.pcap.out +++ b/test/results/4in6tunnel.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679626 bytes -~~ total memory freed........: 4679626 bytes -~~ total allocations/frees...: 101147/101147 +~~ total memory allocated....: 5178533 bytes +~~ total memory freed........: 5178533 bytes +~~ total allocations/frees...: 113029/113029 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 466 chars ~~ json string max len.......: 879 chars diff --git a/test/results/6in4tunnel.pcap.out b/test/results/6in4tunnel.pcap.out index 8b72182d4..b1ef08348 100644 --- a/test/results/6in4tunnel.pcap.out +++ b/test/results/6in4tunnel.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4683193 bytes -~~ total memory freed........: 4683193 bytes -~~ total allocations/frees...: 101270/101270 +~~ total memory allocated....: 5182100 bytes +~~ total memory freed........: 5182100 bytes +~~ total allocations/frees...: 113152/113152 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 466 chars ~~ json string max len.......: 657 chars diff --git a/test/results/6in6tunnel.pcap.out b/test/results/6in6tunnel.pcap.out index 7d57b295a..085f2950f 100644 --- a/test/results/6in6tunnel.pcap.out +++ b/test/results/6in6tunnel.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680440 bytes -~~ total memory freed........: 4680440 bytes -~~ total allocations/frees...: 101148/101148 +~~ total memory allocated....: 5179347 bytes +~~ total memory freed........: 5179347 bytes +~~ total allocations/frees...: 113030/113030 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 466 chars ~~ json string max len.......: 604 chars diff --git a/test/results/BGP_Cisco_hdlc_slarp.pcap.out b/test/results/BGP_Cisco_hdlc_slarp.pcap.out index b6bdc41bd..66d9caf8d 100644 --- a/test/results/BGP_Cisco_hdlc_slarp.pcap.out +++ b/test/results/BGP_Cisco_hdlc_slarp.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679916 bytes -~~ total memory freed........: 4679916 bytes -~~ total allocations/frees...: 101157/101157 +~~ total memory allocated....: 5178823 bytes +~~ total memory freed........: 5178823 bytes +~~ total allocations/frees...: 113039/113039 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 453 chars ~~ json string max len.......: 692 chars diff --git a/test/results/BGP_redist.pcap.out b/test/results/BGP_redist.pcap.out index a894fb452..36162197e 100644 --- a/test/results/BGP_redist.pcap.out +++ b/test/results/BGP_redist.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679539 bytes -~~ total memory freed........: 4679539 bytes -~~ total allocations/frees...: 101144/101144 +~~ total memory allocated....: 5178446 bytes +~~ total memory freed........: 5178446 bytes +~~ total allocations/frees...: 113026/113026 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 192 chars ~~ json string max len.......: 679 chars diff --git a/test/results/EAQ.pcap.out b/test/results/EAQ.pcap.out index 261f8af10..dc104c130 100644 --- a/test/results/EAQ.pcap.out +++ b/test/results/EAQ.pcap.out @@ -195,9 +195,9 @@ ~~ total active/idle flows...: 31/31 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4711484 bytes -~~ total memory freed........: 4711484 bytes -~~ total allocations/frees...: 101436/101436 +~~ total memory allocated....: 5210391 bytes +~~ total memory freed........: 5210391 bytes +~~ total allocations/frees...: 113318/113318 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 449 chars ~~ json string max len.......: 922 chars diff --git a/test/results/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out b/test/results/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out new file mode 100644 index 000000000..37fc0e1c9 --- /dev/null +++ b/test/results/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out @@ -0,0 +1,48 @@ +00479{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00565{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1228468937630} +00595{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1228468937630,"flow_last_seen":1228468937630,"flow_idle_time":180000,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":45,"flow_avg_l4_payload_len":45,"midstream":0,"thread_ts_msec":1228468937630,"l3_proto":"ip4","src_ip":"10.35.40.22","dst_ip":"10.23.1.42","src_port":2944,"dst_port":2944,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00513{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1228468937630,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":1228468937630,"pkt":"ABgYesP\/AAFbAAaHCABFAABJQq5AAEARunwKIygWChcBKguAC4AANST+IS8xIDxpTVNTPgpUPTU1NTI4MjcxM3tDPS17QVY9RFMvMS81e0FUe019fX19"} +00653{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1228468937630,"flow_last_seen":1228468937630,"flow_idle_time":180000,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":45,"flow_avg_l4_payload_len":45,"midstream":0,"thread_ts_msec":1228468937630,"l3_proto":"ip4","src_ip":"10.35.40.22","dst_ip":"10.23.1.42","src_port":2944,"dst_port":2944,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"Megaco","breed":"Acceptable","category":"VoIP"}} +00513{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1228468937631,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":1228468937631,"pkt":"ABgYesP\/AAFbAAaHCABFAABJQq9AAEARunsKIygWChcBKguAC4AANSUAIS8xIDxpTVNTPgpUPTU1NTI4MjcxNHtDPSp7QVY9RFMvMS81e0FUe019fX19"} +00792{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1228468937633,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":292,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":292,"pkt_l4_len":258,"thread_ts_msec":1228468937633,"pkt":"AAFbAAaHABgYesP\/CABFaAEWVmoAAD4R54sKFwEqCiMoFguAC4ABAnAeIS8xIFsxMC4yMy4xLjQyXToyOTQ0IFAgPSA1NTUyODI3MTN7IEMgPSAtIHthdj1kcy8xLzUgIHsgbSB7IHRzIHsgc2k9aXYsYmYgPSAgT0ZGICxFUklfVEVSTUlORk8vbGF3X2NvbnY9b2ZmICwgRVJJX1RFUk1JTkZPL2Rldl9zdGF0ZT1Ob3JtICwgRVJJX1RFUk1JTkZPL2Rldl90eXBlPUNFRTEgfSAsc3QgPSAwIHsgbyB7IG1vPWluLFRETUMvRUM9T04gLCBURE1DL0dBSU49MCxyZyA9ICBPRkYgLHJ2ID0gIE9GRiAgfSAgfSAgfSAgfSB9fQ=="} +00602{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":23,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1228468958651,"flow_last_seen":1228468958651,"flow_idle_time":180000,"flow_min_l4_payload_len":877,"flow_max_l4_payload_len":877,"flow_tot_l4_payload_len":877,"flow_avg_l4_payload_len":877,"midstream":0,"thread_ts_msec":1228468958651,"l3_proto":"ip4","src_ip":"10.35.60.72","dst_ip":"10.35.60.100","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +01628{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1228468958651,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":919,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":919,"pkt_l4_len":885,"thread_ts_msec":1228468958651,"pkt":"AAglAXLqABEKVkXQCABFAAOJs6ZAAEAR9ssKIzxICiM8ZBPEE8QDdRkjSU5WSVRFIHNpcDowNjE5NjMxNzctaWtodXVlcDViaTEyM0AxMC4zNS42MC4xMDA6NTA2MDt0cmFuc3BvcnQ9dWRwIFNJUC8yLjANClZpYTogU0lQLzIuMC9VRFAgMTAuMzUuNjAuNzI6NTA2MDticmFuY2g9ejloRzRiSy5pSWlJaUkuMGEyMzI4MTkuZTlkNGJkDQpUbzogIDxzaXA6MDYxOTYzMTc3QGl0YWx0ZWwuaXQ7dXNlcj1waG9uZT4NCkZyb206IDxzaXA6dW5hdmFpbGFibGVAaG9zdHBvcnRpb24+O3RhZz0wMGU5ZDQ3OA0KQ2FsbC1JRDogMDBlOWQ0YTUwMGU5ZDQ4LTAwMTUtMDAwMS0wMDAwLTAwMDBAMTAuMzUuNDAuMjUNCkNTZXE6ICAxIElOVklURQ0KTWF4LUZvcndhcmRzOiA3MA0KQ29udGFjdDogPHNpcDphbm9ueW1vdXMuaUlpSWlJLjBhMjMyODE5LkAxMC4zNS42MC43Mj4NCkFsbG93OiBJTlZJVEUsIEFDSywgUFJBQ0ssIENBTkNFTCwgQllFLCBPUFRJT05TLCBNRVNTQUdFLCBOT1RJRlksIFVQREFURSwgUkVHSVNURVIsIElORk8sIFJFRkVSLCBTVUJTQ1JJQkUNCkFjY2VwdDogYXBwbGljYXRpb24vc2RwLCBhcHBsaWNhdGlvbi9pc3VwLCBhcHBsaWNhdGlvbi94bWwsIGFwcGxpY2F0aW9uL2R0bWYtcmVsYXkNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vc2RwDQpDb250ZW50LUxlbmd0aDogMjQwDQoNCnY9MA0Kbz0tIDE5MSAxMjI4NTAwNzM2IElOIElQNCAxMC4yMy4xLjUyDQpzPUlNU1MNCmM9SU4gSVA0IDEwLjIzLjEuNTINCnQ9MCAwDQptPWF1ZGlvIDE2NzU2IFJUUC9BVlAgOCAxMDMgMTAyDQphPXJ0cG1hcDoxMDMgRzcyNi0zMi84MDAwDQphPXB0aW1lOjMwDQphPXJ0cG1hcDoxMDIgdGVsZXBob25lLWV2ZW50LzgwMDAvMQ0KYT1mbXRwOjEwMiAwLTE1DQphPXNxbjowDQphPWNkc2M6MSBpbWFnZSB1ZHB0bCB0MzgNCg=="} +00657{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":23,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1228468958651,"flow_last_seen":1228468958651,"flow_idle_time":180000,"flow_min_l4_payload_len":877,"flow_max_l4_payload_len":877,"flow_tot_l4_payload_len":877,"flow_avg_l4_payload_len":877,"midstream":0,"thread_ts_msec":1228468958651,"l3_proto":"ip4","src_ip":"10.35.60.72","dst_ip":"10.35.60.100","src_port":5060,"dst_port":5060,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SIP","breed":"Acceptable","category":"VoIP"}} +00602{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":24,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1228468958651,"flow_last_seen":1228468958651,"flow_idle_time":180000,"flow_min_l4_payload_len":877,"flow_max_l4_payload_len":877,"flow_tot_l4_payload_len":877,"flow_avg_l4_payload_len":877,"midstream":0,"thread_ts_msec":1228468958651,"l3_proto":"ip4","src_ip":"10.35.40.25","dst_ip":"10.35.40.200","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +01628{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":1228468958651,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":919,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":919,"pkt_l4_len":885,"thread_ts_msec":1228468958651,"pkt":"ABEKVkXRAAFbASs3CABFAAOJP55AAEARkp8KIygZCiMoyBPEE8QDdUDuSU5WSVRFIHNpcDowNjE5NjMxNzctaWtodXVlcDViaTEyM0AxMC4zNS42MC4xMDA6NTA2MDt0cmFuc3BvcnQ9dWRwIFNJUC8yLjANClZpYTogU0lQLzIuMC9VRFAgMTAuMzUuNjAuNzI6NTA2MDticmFuY2g9ejloRzRiSy5pSWlJaUkuMGEyMzI4MTkuZTlkNGJkDQpUbzogIDxzaXA6MDYxOTYzMTc3QGl0YWx0ZWwuaXQ7dXNlcj1waG9uZT4NCkZyb206IDxzaXA6dW5hdmFpbGFibGVAaG9zdHBvcnRpb24+O3RhZz0wMGU5ZDQ3OA0KQ2FsbC1JRDogMDBlOWQ0YTUwMGU5ZDQ4LTAwMTUtMDAwMS0wMDAwLTAwMDBAMTAuMzUuNDAuMjUNCkNTZXE6ICAxIElOVklURQ0KTWF4LUZvcndhcmRzOiA3MA0KQ29udGFjdDogPHNpcDphbm9ueW1vdXMuaUlpSWlJLjBhMjMyODE5LkAxMC4zNS42MC43Mj4NCkFsbG93OiBJTlZJVEUsIEFDSywgUFJBQ0ssIENBTkNFTCwgQllFLCBPUFRJT05TLCBNRVNTQUdFLCBOT1RJRlksIFVQREFURSwgUkVHSVNURVIsIElORk8sIFJFRkVSLCBTVUJTQ1JJQkUNCkFjY2VwdDogYXBwbGljYXRpb24vc2RwLCBhcHBsaWNhdGlvbi9pc3VwLCBhcHBsaWNhdGlvbi94bWwsIGFwcGxpY2F0aW9uL2R0bWYtcmVsYXkNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vc2RwDQpDb250ZW50LUxlbmd0aDogMjQwDQoNCnY9MA0Kbz0tIDE5MSAxMjI4NTAwNzM2IElOIElQNCAxMC4yMy4xLjUyDQpzPUlNU1MNCmM9SU4gSVA0IDEwLjIzLjEuNTINCnQ9MCAwDQptPWF1ZGlvIDE2NzU2IFJUUC9BVlAgOCAxMDMgMTAyDQphPXJ0cG1hcDoxMDMgRzcyNi0zMi84MDAwDQphPXB0aW1lOjMwDQphPXJ0cG1hcDoxMDIgdGVsZXBob25lLWV2ZW50LzgwMDAvMQ0KYT1mbXRwOjEwMiAwLTE1DQphPXNxbjowDQphPWNkc2M6MSBpbWFnZSB1ZHB0bCB0MzgNCg=="} +00657{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":24,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1228468958651,"flow_last_seen":1228468958651,"flow_idle_time":180000,"flow_min_l4_payload_len":877,"flow_max_l4_payload_len":877,"flow_tot_l4_payload_len":877,"flow_avg_l4_payload_len":877,"midstream":0,"thread_ts_msec":1228468958651,"l3_proto":"ip4","src_ip":"10.35.40.25","dst_ip":"10.35.40.200","src_port":5060,"dst_port":5060,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SIP","breed":"Acceptable","category":"VoIP"}} +00808{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":25,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1228468958652,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"thread_ts_msec":1228468958652,"pkt":"ABEKVkXQAAglAXLqCABFAAEiAABAAIARbNkKIzxkCiM8SBPEE8QBDiJNU0lQLzIuMCAxMDAgVHJ5aW5nDQpWaWE6IFNJUC8yLjAvVURQIDEwLjM1LjYwLjcyOjUwNjA7YnJhbmNoPXo5aEc0YksuaUlpSWlJLjBhMjMyODE5LmU5ZDRiZA0KVG86IDxzaXA6MDYxOTYzMTc3QGl0YWx0ZWwuaXQ7dXNlcj1waG9uZT4NCkZyb206IDxzaXA6dW5hdmFpbGFibGVAaG9zdHBvcnRpb24+O3RhZz0wMGU5ZDQ3OA0KQ2FsbC1JRDogMDBlOWQ0YTUwMGU5ZDQ4LTAwMTUtMDAwMS0wMDAwLTAwMDBAMTAuMzUuNDAuMjUNCkNTZXE6IDEgSU5WSVRFDQoNCg=="} +01628{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":26,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":1228468958653,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":919,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":919,"pkt_l4_len":885,"thread_ts_msec":1228468958653,"pkt":"ABEKVkXRAAFbASs3CABFAAOJP55AAEARkp8KIygZCiMoyBPEE8QDdUDuSU5WSVRFIHNpcDowNjE5NjMxNzctaWtodXVlcDViaTEyM0AxMC4zNS42MC4xMDA6NTA2MDt0cmFuc3BvcnQ9dWRwIFNJUC8yLjANClZpYTogU0lQLzIuMC9VRFAgMTAuMzUuNjAuNzI6NTA2MDticmFuY2g9ejloRzRiSy5pSWlJaUkuMGEyMzI4MTkuZTlkNGJkDQpUbzogIDxzaXA6MDYxOTYzMTc3QGl0YWx0ZWwuaXQ7dXNlcj1waG9uZT4NCkZyb206IDxzaXA6dW5hdmFpbGFibGVAaG9zdHBvcnRpb24+O3RhZz0wMGU5ZDQ3OA0KQ2FsbC1JRDogMDBlOWQ0YTUwMGU5ZDQ4LTAwMTUtMDAwMS0wMDAwLTAwMDBAMTAuMzUuNDAuMjUNCkNTZXE6ICAxIElOVklURQ0KTWF4LUZvcndhcmRzOiA3MA0KQ29udGFjdDogPHNpcDphbm9ueW1vdXMuaUlpSWlJLjBhMjMyODE5LkAxMC4zNS42MC43Mj4NCkFsbG93OiBJTlZJVEUsIEFDSywgUFJBQ0ssIENBTkNFTCwgQllFLCBPUFRJT05TLCBNRVNTQUdFLCBOT1RJRlksIFVQREFURSwgUkVHSVNURVIsIElORk8sIFJFRkVSLCBTVUJTQ1JJQkUNCkFjY2VwdDogYXBwbGljYXRpb24vc2RwLCBhcHBsaWNhdGlvbi9pc3VwLCBhcHBsaWNhdGlvbi94bWwsIGFwcGxpY2F0aW9uL2R0bWYtcmVsYXkNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vc2RwDQpDb250ZW50LUxlbmd0aDogMjQwDQoNCnY9MA0Kbz0tIDE5MSAxMjI4NTAwNzM2IElOIElQNCAxMC4yMy4xLjUyDQpzPUlNU1MNCmM9SU4gSVA0IDEwLjIzLjEuNTINCnQ9MCAwDQptPWF1ZGlvIDE2NzU2IFJUUC9BVlAgOCAxMDMgMTAyDQphPXJ0cG1hcDoxMDMgRzcyNi0zMi84MDAwDQphPXB0aW1lOjMwDQphPXJ0cG1hcDoxMDIgdGVsZXBob25lLWV2ZW50LzgwMDAvMQ0KYT1mbXRwOjEwMiAwLTE1DQphPXNxbjowDQphPWNkc2M6MSBpbWFnZSB1ZHB0bCB0MzgNCg=="} +00609{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":27,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1228468958657,"flow_last_seen":1228468958657,"flow_idle_time":180000,"flow_min_l4_payload_len":884,"flow_max_l4_payload_len":884,"flow_tot_l4_payload_len":884,"flow_avg_l4_payload_len":884,"midstream":0,"thread_ts_msec":1228468958657,"l3_proto":"ip4","src_ip":"138.132.169.101","dst_ip":"192.168.100.219","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +01636{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":27,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_last_seen":1228468958657,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":926,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":926,"pkt_l4_len":892,"thread_ts_msec":1228468958657,"pkt":"AAAMB6ypAAglAXLkCABFAAOQAABAAIARne+KhKllwKhk2xPEE8QDfOJtSU5WSVRFIHNpcDowNjE5NjMxNzdAMTkyLjE2OC4xMDAuMjE5OjUwNjAgU0lQLzIuMA0KVmlhOiBTSVAvMi4wL1VEUCAxMzguMTMyLjE2OS4xMDE6NTA2MDticmFuY2g9ejloRzRiS2Z2MmY0MDEwNzg3aDNhOHExMjgwLjENClRvOiA8c2lwOjA2MTk2MzE3N0BpdGFsdGVsLml0O3VzZXI9cGhvbmU+DQpGcm9tOiA8c2lwOnVuYXZhaWxhYmxlQGhvc3Rwb3J0aW9uPjt0YWc9U0Q0OTA5NzAxLTAwZTlkNDc4DQpDYWxsLUlEOiBTRDQ5MDk3MDEtOWZmMTFiZjcyZWI0YTM0N2M5Mjk3NGQ4ZmJiYzI2NjgtYW84bzNpMQ0KQ1NlcTogMSBJTlZJVEUNCk1heC1Gb3J3YXJkczogNjkNCkNvbnRhY3Q6IDxzaXA6dW5hdmFpbGFibGVAMTM4LjEzMi4xNjkuMTAxOjUwNjA7dHJhbnNwb3J0PXVkcD4NCkFsbG93OiBJTlZJVEUsIEFDSywgUFJBQ0ssIENBTkNFTCwgQllFLCBPUFRJT05TLCBNRVNTQUdFLCBOT1RJRlksIFVQREFURSwgUkVHSVNURVIsIElORk8sIFJFRkVSLCBTVUJTQ1JJQkUNCkFjY2VwdDogYXBwbGljYXRpb24vc2RwLCBhcHBsaWNhdGlvbi9pc3VwLCBhcHBsaWNhdGlvbi94bWwsIGFwcGxpY2F0aW9uL2R0bWYtcmVsYXkNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vc2RwDQpDb250ZW50LUxlbmd0aDogMjUwDQoNCnY9MA0Kbz0tIDE5MSAxMjI4NTAwNzM2IElOIElQNCAxMzguMTMyLjE2OS4xMDENCnM9SU1TUw0KYz1JTiBJUDQgMTM4LjEzMi4xNjkuMTAxDQp0PTAgMA0KbT1hdWRpbyAxNTU4MCBSVFAvQVZQIDggMTAzIDEwMg0KYT1ydHBtYXA6MTAzIEc3MjYtMzIvODAwMA0KYT1wdGltZTozMA0KYT1ydHBtYXA6MTAyIHRlbGVwaG9uZS1ldmVudC84MDAwLzENCmE9Zm10cDoxMDIgMC0xNQ0KYT1zcW46MA0KYT1jZHNjOjEgaW1hZ2UgdWRwdGwgdDM4DQo="} +00664{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":27,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1228468958657,"flow_last_seen":1228468958657,"flow_idle_time":180000,"flow_min_l4_payload_len":884,"flow_max_l4_payload_len":884,"flow_tot_l4_payload_len":884,"flow_avg_l4_payload_len":884,"midstream":0,"thread_ts_msec":1228468958657,"l3_proto":"ip4","src_ip":"138.132.169.101","dst_ip":"192.168.100.219","src_port":5060,"dst_port":5060,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SIP","breed":"Acceptable","category":"VoIP"}} +00808{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":28,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_last_seen":1228468958657,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"thread_ts_msec":1228468958657,"pkt":"AAFbASs3ABEKVkXRCABFAAEild5AAEARPsYKIyjICiMoGRPEE8QBDkoYU0lQLzIuMCAxMDAgVHJ5aW5nDQpWaWE6IFNJUC8yLjAvVURQIDEwLjM1LjYwLjcyOjUwNjA7YnJhbmNoPXo5aEc0YksuaUlpSWlJLjBhMjMyODE5LmU5ZDRiZA0KVG86IDxzaXA6MDYxOTYzMTc3QGl0YWx0ZWwuaXQ7dXNlcj1waG9uZT4NCkZyb206IDxzaXA6dW5hdmFpbGFibGVAaG9zdHBvcnRpb24+O3RhZz0wMGU5ZDQ3OA0KQ2FsbC1JRDogMDBlOWQ0YTUwMGU5ZDQ4LTAwMTUtMDAwMS0wMDAwLTAwMDBAMTAuMzUuNDAuMjUNCkNTZXE6IDEgSU5WSVRFDQoNCg=="} +00853{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":30,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_last_seen":1228468958718,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":339,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":339,"pkt_l4_len":305,"thread_ts_msec":1228468958718,"pkt":"AAglAXLkABZGR+C\/CABFuAFFHeUAAD0RBJ7AqGTbioSpZRPEE8QBMRfZU0lQLzIuMCAxMDAgVHJ5aW5nDQpDYWxsLUlEOiBTRDQ5MDk3MDEtOWZmMTFiZjcyZWI0YTM0N2M5Mjk3NGQ4ZmJiYzI2NjgtYW84bzNpMQ0KQ29udGVudC1MZW5ndGg6IDANCkNTZXE6IDEgSU5WSVRFDQpGcm9tOiA8c2lwOnVuYXZhaWxhYmxlQGhvc3Rwb3J0aW9uPjt0YWc9U0Q0OTA5NzAxLTAwZTlkNDc4DQpUbzogPHNpcDowNjE5NjMxNzdAaXRhbHRlbC5pdDt1c2VyPXBob25lPg0KVmlhOiBTSVAvMi4wL1VEUCAxMzguMTMyLjE2OS4xMDE6NTA2MDticmFuY2g9ejloRzRiS2Z2MmY0MDEwNzg3aDNhOHExMjgwLjENCg0K"} +01029{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":31,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":3,"flow_last_seen":1228468958819,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":469,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":469,"pkt_l4_len":435,"thread_ts_msec":1228468958819,"pkt":"AAglAXLkABZGR+C\/CABFuAHHHeYAAD0RBBvAqGTbioSpZRPEE8QBs3VMU0lQLzIuMCAxODAgUmluZ2luZw0KQ2FsbC1JRDogU0Q0OTA5NzAxLTlmZjExYmY3MmViNGEzNDdjOTI5NzRkOGZiYmMyNjY4LWFvOG8zaTENCkNvbnRhY3Q6IDxzaXA6MDYxOTYzMTc3QDE5Mi4xNjguMTAwLjIxOTo1MDYwPg0KQ29udGVudC1MZW5ndGg6IDANCkNTZXE6IDEgSU5WSVRFDQpGcm9tOiA8c2lwOnVuYXZhaWxhYmxlQGhvc3Rwb3J0aW9uPjt0YWc9U0Q0OTA5NzAxLTAwZTlkNDc4DQpTZXJ2ZXI6IEFyY29yL0FyY29yLTEuMDIuMDA1dDINClRvOiA8c2lwOjA2MTk2MzE3N0BpdGFsdGVsLml0O3VzZXI9cGhvbmU+O3RhZz02MTcyNjM2MTY0Nzk2MTZFLTMzMTcxNTUyMC01MzM2Zjc4NS0xODc0MTAyMDUNClZpYTogU0lQLzIuMC9VRFAgMTM4LjEzMi4xNjkuMTAxOjUwNjA7YnJhbmNoPXo5aEc0YktmdjJmNDAxMDc4N2gzYThxMTI4MC4xDQoNCg=="} +01052{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":32,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1228468958820,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":488,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":488,"pkt_l4_len":454,"thread_ts_msec":1228468958820,"pkt":"ABEKVkXQAAglAXLqCABFAAHaAABAAIARbCEKIzxkCiM8SBPEE8QBxvK8U0lQLzIuMCAxODAgUmluZ2luZw0KVmlhOiBTSVAvMi4wL1VEUCAxMC4zNS42MC43Mjo1MDYwO2JyYW5jaD16OWhHNGJLLmlJaUlpSS4wYTIzMjgxOS5lOWQ0YmQNClRvOiA8c2lwOjA2MTk2MzE3N0BpdGFsdGVsLml0O3VzZXI9cGhvbmU+O3RhZz1TRDQ5MDk3OTktNjE3MjYzNjE2NDc5NjE2RS0zMzE3MTU1MjAtNTMzNmY3ODUtMTg3NDEwMjA1DQpGcm9tOiA8c2lwOnVuYXZhaWxhYmxlQGhvc3Rwb3J0aW9uPjt0YWc9MDBlOWQ0NzgNCkNhbGwtSUQ6IDAwZTlkNGE1MDBlOWQ0OC0wMDE1LTAwMDEtMDAwMC0wMDAwQDEwLjM1LjQwLjI1DQpDU2VxOiAxIElOVklURQ0KQ29udGFjdDogPHNpcDowNjE5NjMxNzctaWtodXVlcDViaTEyM0AxMC4zNS42MC4xMDA6NTA2MDt0cmFuc3BvcnQ9dWRwPg0KQ29udGVudC1MZW5ndGg6IDANClNlcnZlcjogQXJjb3IvQXJjb3ItMS4wMi4wMDV0Mg0KDQo="} +00603{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":45,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1228468965434,"flow_last_seen":1228468965434,"flow_idle_time":180000,"flow_min_l4_payload_len":172,"flow_max_l4_payload_len":172,"flow_tot_l4_payload_len":172,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1228468965434,"l3_proto":"ip4","src_ip":"10.35.60.100","dst_ip":"10.23.1.52","src_port":15580,"dst_port":16756,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00689{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":45,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_last_seen":1228468965434,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"thread_ts_msec":1228468965434,"pkt":"ABgYesP\/AAglAXLqCABFuADIHecAAD0RDLUKIzxkChcBNDzcQXQAtEC7gAgAAGfPFaAOrw6v1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1Q=="} +00659{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":45,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1228468965434,"flow_last_seen":1228468965434,"flow_idle_time":180000,"flow_min_l4_payload_len":172,"flow_max_l4_payload_len":172,"flow_tot_l4_payload_len":172,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1228468965434,"l3_proto":"ip4","src_ip":"10.35.60.100","dst_ip":"10.23.1.52","src_port":15580,"dst_port":16756,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"RTP","breed":"Acceptable","category":"Media"}} +00689{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":46,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_last_seen":1228468965455,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"thread_ts_msec":1228468965455,"pkt":"ABgYesP\/AAglAXLqCABFuADIHegAAD0RDLQKIzxkChcBNDzcQXQAtEAagAgAAWfPFkAOrw6v1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1Q=="} +00689{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":47,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_last_seen":1228468965474,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"thread_ts_msec":1228468965474,"pkt":"ABgYesP\/AAglAXLqCABFuADIHekAAD0RDLMKIzxkChcBNDzcQXQAtD95gAgAAmfPFuAOrw6v1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1Q=="} +00706{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7217,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"finished","flow_packets_processed":6995,"flow_first_seen":1228468965434,"flow_last_seen":1228469042419,"flow_idle_time":180000,"flow_min_l4_payload_len":13,"flow_max_l4_payload_len":172,"flow_tot_l4_payload_len":1100399,"flow_avg_l4_payload_len":157,"midstream":0,"thread_ts_msec":1228469046884,"l3_proto":"ip4","src_ip":"10.35.60.100","dst_ip":"10.23.1.52","src_port":15580,"dst_port":16756,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"RTP","breed":"Acceptable","category":"Media"}} +00702{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7217,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":130,"flow_first_seen":1228468937630,"flow_last_seen":1228469046884,"flow_idle_time":180000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":541,"flow_tot_l4_payload_len":18110,"flow_avg_l4_payload_len":139,"midstream":0,"thread_ts_msec":1228469046884,"l3_proto":"ip4","src_ip":"10.35.40.22","dst_ip":"10.23.1.42","src_port":2944,"dst_port":2944,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"Megaco","breed":"Acceptable","category":"VoIP"}} +00708{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7217,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":23,"flow_first_seen":1228468958657,"flow_last_seen":1228469042442,"flow_idle_time":180000,"flow_min_l4_payload_len":297,"flow_max_l4_payload_len":884,"flow_tot_l4_payload_len":12177,"flow_avg_l4_payload_len":529,"midstream":0,"thread_ts_msec":1228469046884,"l3_proto":"ip4","src_ip":"138.132.169.101","dst_ip":"192.168.100.219","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SIP","breed":"Acceptable","category":"VoIP"}} +00701{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7217,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":46,"flow_first_seen":1228468958651,"flow_last_seen":1228469042445,"flow_idle_time":180000,"flow_min_l4_payload_len":262,"flow_max_l4_payload_len":881,"flow_tot_l4_payload_len":24540,"flow_avg_l4_payload_len":533,"midstream":0,"thread_ts_msec":1228469046884,"l3_proto":"ip4","src_ip":"10.35.40.25","dst_ip":"10.35.40.200","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SIP","breed":"Acceptable","category":"VoIP"}} +00701{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7217,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":23,"flow_first_seen":1228468958651,"flow_last_seen":1228469042444,"flow_idle_time":180000,"flow_min_l4_payload_len":262,"flow_max_l4_payload_len":881,"flow_tot_l4_payload_len":12270,"flow_avg_l4_payload_len":533,"midstream":0,"thread_ts_msec":1228469046884,"l3_proto":"ip4","src_ip":"10.35.60.72","dst_ip":"10.35.60.100","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SIP","breed":"Acceptable","category":"VoIP"}} +00583{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":7217,"source":"FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","packets-captured":7217,"packets-processed":7217,"total-skipped-flows":0,"total-l4-data-len":1167496,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":5,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":5,"total-idle-flows":5,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":33,"global_ts_msec":1228469046884} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 7217/7217 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 1167496 bytes +~~ total detected protocols..: 5 +~~ total active/idle flows...: 5/5 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5391198 bytes +~~ total memory freed........: 5391198 bytes +~~ total allocations/frees...: 120254/120254 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 484 chars +~~ json string max len.......: 1641 chars +~~ json string avg len.......: 1061 chars diff --git a/test/results/IEC104.pcap.out b/test/results/IEC104.pcap.out index 8b0527d51..c52e452e7 100644 --- a/test/results/IEC104.pcap.out +++ b/test/results/IEC104.pcap.out @@ -21,9 +21,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680817 bytes -~~ total memory freed........: 4680817 bytes -~~ total allocations/frees...: 101161/101161 +~~ total memory allocated....: 5179724 bytes +~~ total memory freed........: 5179724 bytes +~~ total allocations/frees...: 113043/113043 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 453 chars ~~ json string max len.......: 691 chars diff --git a/test/results/KakaoTalk_chat.pcap.out b/test/results/KakaoTalk_chat.pcap.out index f87a6bf3a..4743b6a38 100644 --- a/test/results/KakaoTalk_chat.pcap.out +++ b/test/results/KakaoTalk_chat.pcap.out @@ -242,9 +242,9 @@ ~~ total active/idle flows...: 38/38 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4835660 bytes -~~ total memory freed........: 4835660 bytes -~~ total allocations/frees...: 101811/101811 +~~ total memory allocated....: 5334567 bytes +~~ total memory freed........: 5334567 bytes +~~ total allocations/frees...: 113693/113693 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 466 chars ~~ json string max len.......: 1834 chars diff --git a/test/results/KakaoTalk_talk.pcap.out b/test/results/KakaoTalk_talk.pcap.out index 989b6125b..37765b112 100644 --- a/test/results/KakaoTalk_talk.pcap.out +++ b/test/results/KakaoTalk_talk.pcap.out @@ -122,9 +122,9 @@ ~~ total active/idle flows...: 20/20 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4815917 bytes -~~ total memory freed........: 4815917 bytes -~~ total allocations/frees...: 104422/104422 +~~ total memory allocated....: 5314824 bytes +~~ total memory freed........: 5314824 bytes +~~ total allocations/frees...: 116304/116304 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 1524 chars diff --git a/test/results/NTPv2.pcap.out b/test/results/NTPv2.pcap.out index 0e029839b..6636c5e1f 100644 --- a/test/results/NTPv2.pcap.out +++ b/test/results/NTPv2.pcap.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679539 bytes -~~ total memory freed........: 4679539 bytes -~~ total allocations/frees...: 101144/101144 +~~ total memory allocated....: 5178446 bytes +~~ total memory freed........: 5178446 bytes +~~ total allocations/frees...: 113026/113026 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 929 chars diff --git a/test/results/NTPv3.pcap.out b/test/results/NTPv3.pcap.out index fdd4815b6..5a60c7935 100644 --- a/test/results/NTPv3.pcap.out +++ b/test/results/NTPv3.pcap.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679539 bytes -~~ total memory freed........: 4679539 bytes -~~ total allocations/frees...: 101144/101144 +~~ total memory allocated....: 5178446 bytes +~~ total memory freed........: 5178446 bytes +~~ total allocations/frees...: 113026/113026 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 673 chars diff --git a/test/results/NTPv4.pcap.out b/test/results/NTPv4.pcap.out index 5373cb927..59dd28ae7 100644 --- a/test/results/NTPv4.pcap.out +++ b/test/results/NTPv4.pcap.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679539 bytes -~~ total memory freed........: 4679539 bytes -~~ total allocations/frees...: 101144/101144 +~~ total memory allocated....: 5178446 bytes +~~ total memory freed........: 5178446 bytes +~~ total allocations/frees...: 113026/113026 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 673 chars diff --git a/test/results/Oscar.pcap.out b/test/results/Oscar.pcap.out index 356591407..afe9f3059 100644 --- a/test/results/Oscar.pcap.out +++ b/test/results/Oscar.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4714451 bytes -~~ total memory freed........: 4714451 bytes -~~ total allocations/frees...: 101225/101225 +~~ total memory allocated....: 5213358 bytes +~~ total memory freed........: 5213358 bytes +~~ total allocations/frees...: 113107/113107 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 456 chars ~~ json string max len.......: 683 chars diff --git a/test/results/WebattackRCE.pcap.out b/test/results/WebattackRCE.pcap.out index 0d1ddff3a..d74299712 100644 --- a/test/results/WebattackRCE.pcap.out +++ b/test/results/WebattackRCE.pcap.out @@ -3197,9 +3197,9 @@ ~~ total active/idle flows...: 797/797 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5486587 bytes -~~ total memory freed........: 5486587 bytes -~~ total allocations/frees...: 106628/106628 +~~ total memory allocated....: 5985494 bytes +~~ total memory freed........: 5985494 bytes +~~ total allocations/frees...: 118510/118510 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 468 chars ~~ json string max len.......: 1403 chars diff --git a/test/results/WebattackSQLinj.pcap.out b/test/results/WebattackSQLinj.pcap.out index 1de2c2844..1173c7f4f 100644 --- a/test/results/WebattackSQLinj.pcap.out +++ b/test/results/WebattackSQLinj.pcap.out @@ -63,9 +63,9 @@ ~~ total active/idle flows...: 9/9 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4690940 bytes -~~ total memory freed........: 4690940 bytes -~~ total allocations/frees...: 101297/101297 +~~ total memory allocated....: 5189847 bytes +~~ total memory freed........: 5189847 bytes +~~ total allocations/frees...: 113179/113179 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 471 chars ~~ json string max len.......: 1075 chars diff --git a/test/results/WebattackXSS.pcap.out b/test/results/WebattackXSS.pcap.out index b0503c90e..0ed728645 100644 --- a/test/results/WebattackXSS.pcap.out +++ b/test/results/WebattackXSS.pcap.out @@ -3976,9 +3976,9 @@ ~~ total active/idle flows...: 661/661 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5531112 bytes -~~ total memory freed........: 5531112 bytes -~~ total allocations/frees...: 112585/112585 +~~ total memory allocated....: 6030019 bytes +~~ total memory freed........: 6030019 bytes +~~ total allocations/frees...: 124467/124467 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 468 chars ~~ json string max len.......: 1123 chars diff --git a/test/results/afp.pcap.out b/test/results/afp.pcap.out new file mode 100644 index 000000000..298ac5731 --- /dev/null +++ b/test/results/afp.pcap.out @@ -0,0 +1,24 @@ +00454{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"afp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00540{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"afp.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1643275951277} +00577{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"afp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1643275951277,"flow_last_seen":1643275951277,"flow_idle_time":7440000,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":1,"thread_ts_msec":1643275951277,"l3_proto":"ip4","src_ip":"192.168.27.57","dst_ip":"192.168.27.139","src_port":64987,"dst_port":548,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00495{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"afp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1643275951277,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":1643275951277,"pkt":"ABxCVgfWYPgdrn1ECABFAABKAABAAEAGgpnAqBs5wKgbi\/3bAiR+nkVXU19RioAYCHEmJgAAAQEICtTtV\/gAQrf\/AAIixgAAAAAAAAAGAAAAABEAAAIOHA=="} +00640{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"afp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1643275951277,"flow_last_seen":1643275951277,"flow_idle_time":7440000,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":1,"thread_ts_msec":1643275951277,"l3_proto":"ip4","src_ip":"192.168.27.57","dst_ip":"192.168.27.139","src_port":64987,"dst_port":548,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"AFP","breed":"Acceptable","category":"DataTransfer"}} +00461{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"afp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1643275951277,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1643275951277,"pkt":"YPgdrn1EABxCVgfWCABFAAA038RAAEAGourAqBuLwKgbOQIk\/dtTX1GKfp5FbYAQVeK4OwAAAQEICgBCwzzU7Vf4"} +00531{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"afp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1643275951277,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_msec":1643275951277,"pkt":"YPgdrn1EABxCVgfWCABFAABm38VAAEAGorfAqBuLwKgbOQIk\/dtTX1GKfp5FbYAYVeK4bQAAAQEICgBCwzzU7Vf4AQIixgAAAAAAAAAiAAAAAA4cx5MnnCmFIy+AAAAAAAAACVyxcAAAAAALpMeAAAAAEAA="} +00681{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":16,"source":"afp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":16,"flow_first_seen":1643275951277,"flow_last_seen":1643275952364,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":50,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":10,"midstream":1,"thread_ts_msec":1643275952364,"l3_proto":"ip4","src_ip":"192.168.27.57","dst_ip":"192.168.27.139","src_port":64987,"dst_port":548,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"AFP","breed":"Acceptable","category":"DataTransfer"}} +00547{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":16,"source":"afp.pcap","alias":"nDPId-test","packets-captured":16,"packets-processed":16,"total-skipped-flows":0,"total-l4-data-len":162,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1643275952364} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 16/16 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 162 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5178881 bytes +~~ total memory freed........: 5178881 bytes +~~ total allocations/frees...: 113041/113041 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 459 chars +~~ json string max len.......: 686 chars +~~ json string avg len.......: 564 chars diff --git a/test/results/ah.pcapng.out b/test/results/ah.pcapng.out new file mode 100644 index 000000000..0d4dda364 --- /dev/null +++ b/test/results/ah.pcapng.out @@ -0,0 +1,29 @@ +00455{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ah.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00541{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"ah.pcapng","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1587338929051} +00568{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"ah.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1587338929051,"flow_last_seen":1587338929051,"flow_idle_time":180000,"flow_min_l4_payload_len":358,"flow_max_l4_payload_len":358,"flow_tot_l4_payload_len":358,"flow_avg_l4_payload_len":358,"midstream":0,"thread_ts_msec":1587338929051,"l3_proto":"ip4","src_ip":"10.2.3.2","dst_ip":"10.3.4.4","src_port":500,"dst_port":500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00912{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"ah.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1587338929051,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":400,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":400,"pkt_l4_len":366,"thread_ts_msec":1587338929051,"pkt":"qrvMAAMQqrvMAAIQCABFwAGCAJ4AAP8RngIKAgMCCgMEBAH0AfQBbieYHBhp9tKboMwAAAAAAAAAACEgIggAAAAAAAABZiIAADAAAAAsAQEABAMAAAwBAAAMgA4BAAMAAAgCAAAGAwAACAMAAA0AAAAIBAAAFCgAAGgAFAAAop90y3jHmNMWVGIbNRerOVFzMP5JoRLlIVT+uGcaHcUDAfZ9agub4v3ifShq9iAjKtd\/XZoIX76e0SSPXecxSXzgS1HJOpsJtzfXg96dFLBFkvBpXPHiUb1T29i2BXzdKwAAJGy943MOgVw+17TTE3RGnNSeH1Br3ZzttJxYzZbae2KMKwAAF0NJU0NPLURFTEVURS1SRUFTT04rAAATQ0lTQ09WUE4tUkVWLTAyKwAAF0NJU0NPLURZTkFNSUMtUk9VVEUpAAAVRkxFWFZQTi1TVVBQT1JURUQpAAAcAABABCNvuAsA4SMheroNDIs0se1c2REJAAAAHAAAQAUSA9ZB8IS5r14gXhydhU2hTnWD2w=="} +00912{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"ah.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1587338929058,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":400,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":400,"pkt_l4_len":366,"thread_ts_msec":1587338929058,"pkt":"qrvMAAIQqrvMAAMQCABFwAGCAJUAAP4RnwsKAwQECgIDAgH0AfQBbpMTHBhp9tKboMxXKornVXrZ7CEgIiAAAAAAAAABZiIAADAAAAAsAQEABAMAAAwBAAAMgA4BAAMAAAgCAAAGAwAACAMAAA0AAAAIBAAAFCgAAGgAFAAA3\/NdSHtjsuV9lwu7r3PG72M7PTs97w7W7XWrjiKy83GusQxHzpqo7SyUw6CdLyZlI6GlvRXFFZQ37DazOAEOXk0lG8t6jBRQFWWSD0tGhA1+E9jC73KPJu4MHQQrp0dlKwAAJMsSzp7FMBmLLwjNerQt3fDJwl4MLQ75rKamBuCoU9JFKwAAF0NJU0NPLURFTEVURS1SRUFTT04rAAATQ0lTQ09WUE4tUkVWLTAyKwAAF0NJU0NPLURZTkFNSUMtUk9VVEUpAAAVRkxFWFZQTi1TVVBQT1JURUQpAAAcAABABLSbKQHg76sTvA2s+iqtHO17zN+1AAAAHAAAQAXEF0AGtBGCSamsYpymSQTNLPEeng=="} +00876{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"ah.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1587338929067,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":370,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":370,"pkt_l4_len":336,"thread_ts_msec":1587338929067,"pkt":"qrvMAAMQqrvMAAIQCABFwAFkAJ8AAP8Rnh8KAgMCCgMEBAH0AfQBUGzjHBhp9tKboMxXKornVXrZ7C4gIwgAAAABAAABSCsAASyBDTrs2Pxvpq7JTnlskHs3y\/lcA4L2kN8fdzJ8fVpYrZTlpuZPtrueSIpYdb+qQTDV2NvMTrxEqmRiytNcmsMUgiqFEXykJmS3P10k8AYBydJ7jb5c3eyLXb1Xq+36+2tgOS1TpUTMh9FvAJkjDZuy9dxuXzbWMy9Bia4cikOr17km8gYu1TAmwh\/g9n514pWnNcM6640AaIdVe6A4QpHHMQEvu1nLtY9OQj13tjKJXcfVHJL\/tVSVAMUi+K5X3aJOMKyYeZBbVZrNRi8RFtvjXQRLRPFCTuUeShJfFRDznRua5syxQXi+6dd5t3q5F806SIRRAk975bBTw\/\/FxVkvix8dHReWdnoNuDuSDSHK8wVobcjOktkOzVZUVL8vxTTf4rHWn7VO+g=="} +00535{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5,"source":"ah.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1587338931051,"flow_last_seen":1587338931051,"flow_idle_time":600000,"flow_min_l4_payload_len":104,"flow_max_l4_payload_len":104,"flow_tot_l4_payload_len":104,"flow_avg_l4_payload_len":104,"midstream":0,"thread_ts_msec":1587338931051,"l3_proto":"ip4","src_ip":"10.2.3.2","dst_ip":"10.3.4.4","l4_proto":51,"flow_datalink":1,"flow_max_packets":3} +00559{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"ah.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1587338931051,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"thread_ts_msec":1587338931051,"pkt":"qrvMAAMQqrvMAAIQCABFAAB8ABMAAP8zoDEKAgMCCgMEBAEEAABgSBb2AAAAAecyq6zhxgBG7sZB7QgAZwQABQABAAAAAAAUFyyrzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavN"} +00585{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":5,"source":"ah.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1587338931051,"flow_last_seen":1587338931051,"flow_idle_time":600000,"flow_min_l4_payload_len":104,"flow_max_l4_payload_len":104,"flow_tot_l4_payload_len":104,"flow_avg_l4_payload_len":104,"midstream":0,"thread_ts_msec":1587338931051,"l3_proto":"ip4","src_ip":"10.2.3.2","dst_ip":"10.3.4.4","l4_proto":51,"ndpi": {"confidence": {"4":"DPI"},"proto":"IPsec","breed":"Safe","category":"VPN"}} +00559{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"ah.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1587338931051,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"thread_ts_msec":1587338931051,"pkt":"qrvMAAIQqrvMAAMQCABFAAB8ABMAAP4zoTEKAwQECgIDAgEEAACvhoPvAAAAAQLuLdf7aFTxy+gQnAAAbwQABQABAAAAAAAUFyyrzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavN"} +00628{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":6,"source":"ah.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1587338929051,"flow_last_seen":1587338929075,"flow_idle_time":180000,"flow_min_l4_payload_len":280,"flow_max_l4_payload_len":358,"flow_tot_l4_payload_len":1324,"flow_avg_l4_payload_len":331,"midstream":0,"thread_ts_msec":1587338931051,"l3_proto":"ip4","src_ip":"10.2.3.2","dst_ip":"10.3.4.4","src_port":500,"dst_port":500,"l4_proto":"udp","ndpi": {"confidence": {"1":"Match by port"},"proto":"IPsec","breed":"Safe","category":"VPN"}} +00570{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6,"source":"ah.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1587338929051,"flow_last_seen":1587338929075,"flow_idle_time":180000,"flow_min_l4_payload_len":280,"flow_max_l4_payload_len":358,"flow_tot_l4_payload_len":1324,"flow_avg_l4_payload_len":331,"midstream":0,"thread_ts_msec":1587338931051,"l3_proto":"ip4","src_ip":"10.2.3.2","dst_ip":"10.3.4.4","src_port":500,"dst_port":500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00624{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6,"source":"ah.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1587338931051,"flow_last_seen":1587338931051,"flow_idle_time":600000,"flow_min_l4_payload_len":104,"flow_max_l4_payload_len":104,"flow_tot_l4_payload_len":208,"flow_avg_l4_payload_len":104,"midstream":0,"thread_ts_msec":1587338931051,"l3_proto":"ip4","src_ip":"10.2.3.2","dst_ip":"10.3.4.4","l4_proto":51,"flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"IPsec","breed":"Safe","category":"VPN"}} +00547{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":6,"source":"ah.pcapng","alias":"nDPId-test","packets-captured":6,"packets-processed":6,"total-skipped-flows":0,"total-l4-data-len":1532,"total-not-detected-flows":0,"total-guessed-flows":1,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":14,"global_ts_msec":1587338931051} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 6/6 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 1532 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 2/2 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5179463 bytes +~~ total memory freed........: 5179463 bytes +~~ total allocations/frees...: 113034/113034 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 460 chars +~~ json string max len.......: 917 chars +~~ json string avg len.......: 687 chars diff --git a/test/results/aimini-http.pcap.out b/test/results/aimini-http.pcap.out index 32b35e563..21a149a09 100644 --- a/test/results/aimini-http.pcap.out +++ b/test/results/aimini-http.pcap.out @@ -9,21 +9,21 @@ 00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1614860229385,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614860229385,"pkt":"5kBKB+riApXG95NLCABFAAAwBP8AAIAGAAAKZQACCmYAAm9WAFCbu7tlAAAAAHACgAEU8QAAAgQFtAMDAQA="} 00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":38,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1614860229386,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614860229386,"pkt":"ApXG95WRWgXZu6TVCABFAAAwBP8AAH8GIfsKZQACCmYAAm9WAFCbu7tlAAAAAHACgAEoiAAAAgQFtAMDAQA="} 00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":39,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1614860229386,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614860229386,"pkt":"WgXZu6TVApXG95WRCABFAAAwBQ0AAIAGAAAKZgACCmUAAgBQb1abu8Cxm7u7ZnASgAEU8QAAAgQFtAMDAQA="} -00951{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":42,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1614860229385,"flow_last_seen":1614860229386,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":524,"flow_tot_l4_payload_len":524,"flow_avg_l4_payload_len":87,"midstream":0,"thread_ts_msec":1614860229386,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28502,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"www.aimini.com","url":"www.aimini.com\/webcounter\/w.php?___hm=.net_SignUp_&_lh_=http:\/\/www.aimini.net\/member\/signup\/&__Refer_=http:\/\/www.aimini.net\/","code":0,"content_type":"","user_agent":"Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko\/20110420 Firefox\/3.6.17"}} +00641{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":42,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1614860229385,"flow_last_seen":1614860229386,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":524,"flow_tot_l4_payload_len":524,"flow_avg_l4_payload_len":87,"midstream":0,"thread_ts_msec":1614860229386,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28502,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"Aimini.HTTP","breed":"Acceptable","category":"Web"}} 00574{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":95,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1614860229388,"flow_last_seen":1614860229388,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1614860229388,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28503,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":95,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":1614860229388,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614860229388,"pkt":"5kBKB+riApXG95NLCABFAAAwBREAAIAGAAAKZQACCmYAAm9XAFCbu+drAAAAAHACgAEU8QAAAgQFtAMDAQA="} 00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":98,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":1614860229389,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614860229389,"pkt":"ApXG95WRWgXZu6TVCABFAAAwBREAAH8GIekKZQACCmYAAm9XAFCbu+drAAAAAHACgAH8gAAAAgQFtAMDAQA="} 00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":99,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_last_seen":1614860229389,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614860229389,"pkt":"WgXZu6TVApXG95WRCABFAAAwBRkAAIAGAAAKZgACCmUAAgBQb1ebu+vKm7vnbHASgAEU8QAAAgQFtAMDAQA="} -00859{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":102,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1614860229388,"flow_last_seen":1614860229389,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":604,"flow_tot_l4_payload_len":604,"flow_avg_l4_payload_len":100,"midstream":0,"thread_ts_msec":1614860229389,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28503,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"www.aimini.net","url":"www.aimini.net\/search\/?q=pictures&sca=","code":0,"content_type":"","user_agent":"Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko\/20110420 Firefox\/3.6.17"}} +00643{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":102,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1614860229388,"flow_last_seen":1614860229389,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":604,"flow_tot_l4_payload_len":604,"flow_avg_l4_payload_len":100,"midstream":0,"thread_ts_msec":1614860229389,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28503,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"Aimini.HTTP","breed":"Acceptable","category":"Web"}} 00575{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":119,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1614860229389,"flow_last_seen":1614860229389,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1614860229389,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28504,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":119,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_last_seen":1614860229389,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614860229389,"pkt":"5kBKB+riApXG95NLCABFAAAwBRcAAIAGAAAKZQACCmYAAm9YAFCbu\/hqAAAAAHACgAEU8QAAAgQFtAMDAQA="} 00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":127,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_last_seen":1614860229390,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614860229390,"pkt":"ApXG95WRWgXZu6TVCABFAAAwBRcAAH8GIeMKZQACCmYAAm9YAFCbu\/hqAAAAAHACgAHrgAAAAgQFtAMDAQA="} 00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":128,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":3,"flow_last_seen":1614860229390,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614860229390,"pkt":"WgXZu6TVApXG95WRCABFAAAwBSIAAIAGAAAKZgACCmUAAgBQb1ibu\/tYm7v4a3ASgAEU8QAAAgQFtAMDAQA="} -00960{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":132,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1614860229389,"flow_last_seen":1614860229390,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":542,"flow_tot_l4_payload_len":542,"flow_avg_l4_payload_len":90,"midstream":0,"thread_ts_msec":1614860229390,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28504,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"www.aimini.com","url":"www.aimini.com\/webcounter\/w.php?___hm=.net_Search_&_lh_=http:\/\/www.aimini.net\/search\/?q=pictures&sca=&__Refer_=http:\/\/www.aimini.net\/","code":0,"content_type":"","user_agent":"Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko\/20110420 Firefox\/3.6.17"}} +00642{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":132,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1614860229389,"flow_last_seen":1614860229390,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":542,"flow_tot_l4_payload_len":542,"flow_avg_l4_payload_len":90,"midstream":0,"thread_ts_msec":1614860229390,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28504,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"Aimini.HTTP","breed":"Acceptable","category":"Web"}} 00685{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":139,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":72,"flow_first_seen":1614860229383,"flow_last_seen":1614860229388,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":60714,"flow_avg_l4_payload_len":843,"midstream":0,"thread_ts_msec":1614860229390,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28501,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"Aimini.HTTP","breed":"Acceptable","category":"Web"}} -00676{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":139,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":18,"flow_first_seen":1614860229385,"flow_last_seen":1614860229388,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":531,"flow_tot_l4_payload_len":3194,"flow_avg_l4_payload_len":177,"midstream":0,"thread_ts_msec":1614860229390,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28502,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} -00678{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":139,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":30,"flow_first_seen":1614860229388,"flow_last_seen":1614860229390,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":13568,"flow_avg_l4_payload_len":452,"midstream":0,"thread_ts_msec":1614860229390,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28503,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} -00676{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":139,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":13,"flow_first_seen":1614860229389,"flow_last_seen":1614860229390,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":542,"flow_tot_l4_payload_len":1654,"flow_avg_l4_payload_len":127,"midstream":0,"thread_ts_msec":1614860229390,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28504,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} +00683{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":139,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":18,"flow_first_seen":1614860229385,"flow_last_seen":1614860229388,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":531,"flow_tot_l4_payload_len":3194,"flow_avg_l4_payload_len":177,"midstream":0,"thread_ts_msec":1614860229390,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28502,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"Aimini.HTTP","breed":"Acceptable","category":"Web"}} +00685{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":139,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":30,"flow_first_seen":1614860229388,"flow_last_seen":1614860229390,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":13568,"flow_avg_l4_payload_len":452,"midstream":0,"thread_ts_msec":1614860229390,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28503,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"Aimini.HTTP","breed":"Acceptable","category":"Web"}} +00683{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":139,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":13,"flow_first_seen":1614860229389,"flow_last_seen":1614860229390,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":542,"flow_tot_l4_payload_len":1654,"flow_avg_l4_payload_len":127,"midstream":0,"thread_ts_msec":1614860229390,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28504,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"Aimini.HTTP","breed":"Acceptable","category":"Web"}} 00561{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":139,"source":"aimini-http.pcap","alias":"nDPId-test","packets-captured":139,"packets-processed":133,"total-skipped-flows":0,"total-l4-data-len":79130,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":4,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":4,"total-idle-flows":4,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":27,"global_ts_msec":1614860229390} ~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ ~~ packets captured/processed: 139/133 @@ -33,10 +33,10 @@ ~~ total active/idle flows...: 4/4 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4686707 bytes -~~ total memory freed........: 4686707 bytes -~~ total allocations/frees...: 101297/101297 +~~ total memory allocated....: 5185614 bytes +~~ total memory freed........: 5185614 bytes +~~ total allocations/frees...: 113179/113179 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 467 chars -~~ json string max len.......: 965 chars -~~ json string avg len.......: 715 chars +~~ json string max len.......: 690 chars +~~ json string avg len.......: 577 chars diff --git a/test/results/ajp.pcap.out b/test/results/ajp.pcap.out index 2b63187fe..2dc3830e9 100644 --- a/test/results/ajp.pcap.out +++ b/test/results/ajp.pcap.out @@ -45,9 +45,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681136 bytes -~~ total memory freed........: 4681136 bytes -~~ total allocations/frees...: 101172/101172 +~~ total memory allocated....: 5180043 bytes +~~ total memory freed........: 5180043 bytes +~~ total allocations/frees...: 113054/113054 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 202 chars ~~ json string max len.......: 1493 chars diff --git a/test/results/alexa-app.pcapng.out b/test/results/alexa-app.pcapng.out index c5823bfa0..ca2384599 100644 --- a/test/results/alexa-app.pcapng.out +++ b/test/results/alexa-app.pcapng.out @@ -1079,9 +1079,9 @@ ~~ total active/idle flows...: 160/160 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5367888 bytes -~~ total memory freed........: 5367888 bytes -~~ total allocations/frees...: 105691/105691 +~~ total memory allocated....: 5866795 bytes +~~ total memory freed........: 5866795 bytes +~~ total allocations/frees...: 117573/117573 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 189 chars ~~ json string max len.......: 2122 chars diff --git a/test/results/among_us.pcap.out b/test/results/among_us.pcap.out index aa7e5447a..ef25db122 100644 --- a/test/results/among_us.pcap.out +++ b/test/results/among_us.pcap.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679539 bytes -~~ total memory freed........: 4679539 bytes -~~ total allocations/frees...: 101144/101144 +~~ total memory allocated....: 5178446 bytes +~~ total memory freed........: 5178446 bytes +~~ total allocations/frees...: 113026/113026 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 455 chars ~~ json string max len.......: 672 chars diff --git a/test/results/amqp.pcap.out b/test/results/amqp.pcap.out index 9ade13c67..df1b7b152 100644 --- a/test/results/amqp.pcap.out +++ b/test/results/amqp.pcap.out @@ -27,9 +27,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4692038 bytes -~~ total memory freed........: 4692038 bytes -~~ total allocations/frees...: 101312/101312 +~~ total memory allocated....: 5190945 bytes +~~ total memory freed........: 5190945 bytes +~~ total allocations/frees...: 113194/113194 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 460 chars ~~ json string max len.......: 1071 chars diff --git a/test/results/android.pcap.out b/test/results/android.pcap.out index 70155183d..93a8c7cca 100644 --- a/test/results/android.pcap.out +++ b/test/results/android.pcap.out @@ -387,9 +387,9 @@ ~~ total active/idle flows...: 63/63 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4907683 bytes -~~ total memory freed........: 4907683 bytes -~~ total allocations/frees...: 102053/102053 +~~ total memory allocated....: 5406590 bytes +~~ total memory freed........: 5406590 bytes +~~ total allocations/frees...: 113935/113935 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 2361 chars diff --git a/test/results/anyconnect-vpn.pcap.out b/test/results/anyconnect-vpn.pcap.out index ad0fd51c5..627a1c681 100644 --- a/test/results/anyconnect-vpn.pcap.out +++ b/test/results/anyconnect-vpn.pcap.out @@ -404,9 +404,9 @@ ~~ total active/idle flows...: 69/69 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4890279 bytes -~~ total memory freed........: 4890279 bytes -~~ total allocations/frees...: 104395/104395 +~~ total memory allocated....: 5389186 bytes +~~ total memory freed........: 5389186 bytes +~~ total allocations/frees...: 116277/116277 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 451 chars ~~ json string max len.......: 1597 chars diff --git a/test/results/anydesk-2.pcap.out b/test/results/anydesk-2.pcap.out index b7c08aa6b..d80577e9f 100644 --- a/test/results/anydesk-2.pcap.out +++ b/test/results/anydesk-2.pcap.out @@ -911,9 +911,9 @@ ~~ total active/idle flows...: 4/4 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4754911 bytes -~~ total memory freed........: 4754911 bytes -~~ total allocations/frees...: 103241/103241 +~~ total memory allocated....: 5253818 bytes +~~ total memory freed........: 5253818 bytes +~~ total allocations/frees...: 115123/115123 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 211 chars ~~ json string max len.......: 7838 chars diff --git a/test/results/anydesk.pcap.out b/test/results/anydesk.pcap.out index 38333f03d..ba1839261 100644 --- a/test/results/anydesk.pcap.out +++ b/test/results/anydesk.pcap.out @@ -23,9 +23,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4889014 bytes -~~ total memory freed........: 4889014 bytes -~~ total allocations/frees...: 108114/108114 +~~ total memory allocated....: 5387921 bytes +~~ total memory freed........: 5387921 bytes +~~ total allocations/frees...: 119996/119996 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 454 chars ~~ json string max len.......: 1585 chars diff --git a/test/results/avast_securedns.pcapng.out b/test/results/avast_securedns.pcapng.out index 977e6a16d..20bfdaca6 100644 --- a/test/results/avast_securedns.pcapng.out +++ b/test/results/avast_securedns.pcapng.out @@ -215,9 +215,9 @@ ~~ total active/idle flows...: 39/39 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4714879 bytes -~~ total memory freed........: 4714879 bytes -~~ total allocations/frees...: 101334/101334 +~~ total memory allocated....: 5213786 bytes +~~ total memory freed........: 5213786 bytes +~~ total allocations/frees...: 113216/113216 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 473 chars ~~ json string max len.......: 842 chars diff --git a/test/results/bad-dns-traffic.pcap.out b/test/results/bad-dns-traffic.pcap.out index 614ebc793..416010ba5 100644 --- a/test/results/bad-dns-traffic.pcap.out +++ b/test/results/bad-dns-traffic.pcap.out @@ -35,9 +35,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4692332 bytes -~~ total memory freed........: 4692332 bytes -~~ total allocations/frees...: 101531/101531 +~~ total memory allocated....: 5191239 bytes +~~ total memory freed........: 5191239 bytes +~~ total allocations/frees...: 113413/113413 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 471 chars ~~ json string max len.......: 978 chars diff --git a/test/results/badpackets.pcap.out b/test/results/badpackets.pcap.out index 6ceee7d0e..d6e292032 100644 --- a/test/results/badpackets.pcap.out +++ b/test/results/badpackets.pcap.out @@ -210,9 +210,9 @@ ~~ total active/idle flows...: 0/0 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4678638 bytes -~~ total memory freed........: 4678638 bytes -~~ total allocations/frees...: 101140/101140 +~~ total memory allocated....: 5177545 bytes +~~ total memory freed........: 5177545 bytes +~~ total allocations/frees...: 113022/113022 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 209 chars ~~ json string max len.......: 2303 chars diff --git a/test/results/bitcoin.pcap.out b/test/results/bitcoin.pcap.out index 507aa50ac..12f2f40b7 100644 --- a/test/results/bitcoin.pcap.out +++ b/test/results/bitcoin.pcap.out @@ -2,59 +2,55 @@ 00544{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"bitcoin.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1301327937725} 00587{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1301327937725,"flow_last_seen":1301327937725,"flow_idle_time":7440000,"flow_min_l4_payload_len":105,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":105,"flow_avg_l4_payload_len":105,"midstream":1,"thread_ts_msec":1301327937725,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"188.165.213.169","src_port":55317,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00615{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1301327937725,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"thread_ts_msec":1301327937725,"pkt":"ACPrIpS0ACNshovhCABFAACdb3BAAEAGdmXAqAGOvKXVqdgVII1UFpaF9ORId4AY\/\/\/XwQAAAQEICicy22Mwkrss+b602XZlcnNpb24AAAAAAFUAAAABfQAAAQAAAAAAAABBsJBNAAAAAAEAAAAAAAAAAAAAAAAAAAAAAP\/\/vKXVqSCNAQAAAAAAAAAAAAAAAAAAAAAA\/\/\/AqAGOII3ZMDrPGxAeDAD6vQEA"} +00762{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1301327937725,"flow_last_seen":1301327937725,"flow_idle_time":7440000,"flow_min_l4_payload_len":105,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":105,"flow_avg_l4_payload_len":105,"midstream":1,"thread_ts_msec":1301327937725,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"188.165.213.169","src_port":55317,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} 00612{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1301327937800,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"thread_ts_msec":1301327937800,"pkt":"ACNshovhACPrIpS0CABFAACd8zJAADQG\/qK8pdWpwKgBjiCN2BX05Eh3VBaWhYAYAC7fMwAAAQEICjCSu0gnMttj+b602XZlcnNpb24AAAAAAFUAAACcfAAAAQAAAAAAAABqsJBNAAAAAAEAAAAAAAAAAAAAAAAAAAAAAP\/\/JmCEHtgVAQAAAAAAAAAAAAAAAAAAAAAA\/\/+8pdWpII1MLcnArv8XlgAGwwEA"} 01828{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1301327937931,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1067,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1067,"pkt_l4_len":1033,"thread_ts_msec":1301327937931,"pkt":"ACPrIpS0ACNshovhCABFAAQdZEVAAEAGfhDAqAGOvKXVqdgVII1UFpbu9ORI4IAY\/\/\/JGQAAAQEICicy22UwkrtL+b602XZlcmFjawAAAAAAAAAAAAD5vrTZZ2V0YWRkcgAAAAAAAAAAAF324OL5vrTZZ2V0YmxvY2tzAAAApQMAAGlfIuqcfAAAHKh7ybVTxuZIQjrl7yTcgS++hNhBt1zq9NegAAAAAAAA0isW7TPLR9+QJv0A5WbZVCvm695mFYsw+RcAAAAAAAAKtKqLikjG018uz8LfLAtdjFIkeP\/i1erq1gAAAAAAAJBdQRxOhTejsSgFAkOe4jLdh+MgkNThEJ18AAAAAAAAuqLvaBfSt3u\/xIqIdA14a1vMRWgufw\/9NSQAAAAAAABmO+ZaHQMV8GVsd2tLL4rFQTc0+9Vfwkt\/KAAAAAAAAJT+LTuh4xfC31zGm\/GrV7uiO60OaIRMkzcNAAAAAAAAuhdRV0aXd6Zg2v\/d1GRW41CXeTNnyZ2lADQAAAAAAADN6C3MlB3uxd0izHdkP3dhS0au0yU7AWAQZwAAAAAAAL+B7POHga71M99A8Eu3CYdV7ruvTTFqTRaEAAAAAAAA3UsnAThWfVMwqZa+fYK\/+mnwaocTsbQIG1kAAAAAAADey3zxujtbDGk\/QTgO92YcU4PswnA6nOZ6FgAAAAAAAMDzxV+Dq1G5LChOJMi\/klliIw7dOCRLUwU1AAAAAAAAPos8A4n6clF7nKE4hFivm22s790lzTk\/xUsAAAAAAAC0sS5A1Mm4fwV3yc3Q1LndsofGdqv023cDhAAAAAAAAGvuGwU2Et\/fX33Zfbvd3fo\/8TaDBcaUcU3CAAAAAAAAP2JWK5H+eMf+Pv\/jSxNvOoqfqtxRlUdLIhEAAAAAAADJveYZh3372qwQQlL9GVXITa9jJ6DXXZhGDQAAAAAAAKMYV6DpTz6VcKhTn2GDUxJn1w6c\/OztngqRAAAAAAAABDCPkjdagfw0FOqHQEeRGYOTGUOY4U7Z+TMAAAAAAABH73UkZZo8i3KUfaLV4BIT5FRuJgLU9+S6PwAAAAAAAEhKQKlsPJI3JIw8Tb+HHwelgYW13heoG+NwAAAAAAAAGoeNNbO0PKw7FoNOsSIzS8W\/U8wXt9nuho8AAAAAAADVlxLK6O44NewFXywS+BNdzYycb7g7WSY\/qQEAAAAAAKqI+qWcSpEbTrldQNWUJik+3hdENRtaz0ynBAAAAAAA\/6kPGMjbu4hU+GZN83C9X6Hc1si6bqd\/l3UhAAAAAABKw0jIrFFXJp9oPx6NizqHl5jwjXfMij2VrHIgAAAAAG\/ijAq28bNywaaiRq5j90+THoNl4VoInGjWGQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="} 00586{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":20,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1301328089970,"flow_last_seen":1301328089970,"flow_idle_time":7440000,"flow_min_l4_payload_len":105,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":105,"flow_avg_l4_payload_len":105,"midstream":1,"thread_ts_msec":1301328089970,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"69.118.54.122","src_port":55328,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00615{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1301328089970,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"thread_ts_msec":1301328089970,"pkt":"ACPrIpS0ACNshovhCABFAACdrppAAEAGTZrAqAGORXY2etggII0QKtRyRVLzIYAY\/\/\/YagAAAQEICicy4VQAPPkD+b602XZlcnNpb24AAAAAAFUAAAABfQAAAQAAAAAAAADZsJBNAAAAAAEAAAAAAAAAAAAAAAAAAAAAAP\/\/RXY2eiCNAQAAAAAAAAAAAAAAAAAAAAAA\/\/8mYIQeII3pIMJ+i724nwBQvgEA"} +00761{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":20,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1301328089970,"flow_last_seen":1301328089970,"flow_idle_time":7440000,"flow_min_l4_payload_len":105,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":105,"flow_avg_l4_payload_len":105,"midstream":1,"thread_ts_msec":1301328089970,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"69.118.54.122","src_port":55328,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} 00612{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1301328090023,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"thread_ts_msec":1301328090023,"pkt":"ACNshovhACPrIpS0CABFAACdT81AAHYGdmdFdjZ6wKgBjiCN2CBFUvMhECrU24AYAQRFgAAAAQEICgA8+QknMuFU+b602XZlcnNpb24AAAAAAFUAAAACfQAAAQAAAAAAAADZsJBNAAAAAAEAAAAAAAAAAAAAAAAAAAAAAP\/\/JmCEHtggAQAAAAAAAAAAAAAAAAAAAAAA\/\/9FdjZ6II3xDaOK7c9BwgAGwwEA"} 00493{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1301328090082,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"thread_ts_msec":1301328090082,"pkt":"ACNshovhACPrIpS0CABFAABIT85AAHYGdrtFdjZ6wKgBjiCN2CBFUvOKECrU24AYAQQkRgAAAQEICgA8+RAnMuFV+b602XZlcmFjawAAAAAAAAAAAAA="} -00774{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":51,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":32,"flow_first_seen":1301328089970,"flow_last_seen":1301328234475,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":36182,"flow_avg_l4_payload_len":1130,"midstream":1,"thread_ts_msec":1301328234475,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"69.118.54.122","src_port":55328,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} -00775{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":51,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":32,"flow_first_seen":1301328089970,"flow_last_seen":1301328234475,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":36182,"flow_avg_l4_payload_len":1130,"midstream":1,"thread_ts_msec":1301328234475,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"69.118.54.122","src_port":55328,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} 00586{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":81,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1301328319392,"flow_last_seen":1301328319392,"flow_idle_time":7440000,"flow_min_l4_payload_len":105,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":105,"flow_avg_l4_payload_len":105,"midstream":1,"thread_ts_msec":1301328319392,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"74.89.181.229","src_port":55348,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00617{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":81,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":1301328319392,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"thread_ts_msec":1301328319392,"pkt":"ACPrIpS0ACNshovhCABFAACdlslAAEAG4RzAqAGOSlm15dg0II2cIEOJr5xIoIAY\/\/\/04QAAAQEICicy6kgDS\/0c+b602XZlcnNpb24AAAAAAFUAAAABfQAAAQAAAAAAAAC\/sZBNAAAAAAEAAAAAAAAAAAAAAAAAAAAAAP\/\/Slm15SCNAQAAAAAAAAAAAAAAAAAAAAAA\/\/8mYIQeII2qu+Pk33arXQC9vgEA"} +00761{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":81,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1301328319392,"flow_last_seen":1301328319392,"flow_idle_time":7440000,"flow_min_l4_payload_len":105,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":105,"flow_avg_l4_payload_len":105,"midstream":1,"thread_ts_msec":1301328319392,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"74.89.181.229","src_port":55348,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} 00614{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":82,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":1301328319451,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"thread_ts_msec":1301328319451,"pkt":"ACNshovhACPrIpS0CABFAACdR2RAAHYG+oFKWbXlwKgBjiCN2DSvnEignCBD8oAYAQSuQgAAAQEICgNL\/SInMupI+b602XZlcnNpb24AAAAAAFUAAAAAfQAAAQAAAAAAAAC4sZBNAAAAAAEAAAAAAAAAAAAAAAAAAAAAAP\/\/JmCEHtg0AQAAAAAAAAAAAAAAAAAAAAAA\/\/9KWbXlII1O39\/bLGJPkgAHwwEA"} 00494{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":83,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_last_seen":1301328319554,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"thread_ts_msec":1301328319554,"pkt":"ACNshovhACPrIpS0CABFAABIR4lAAHYG+rFKWbXlwKgBjiCN2DSvnEkJnCBD8oAYAQTU7AAAAQEICgNL\/S8nMupI+b602XZlcmFjawAAAAAAAAAAAAA="} -00775{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":157,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":32,"flow_first_seen":1301328319392,"flow_last_seen":1301328420325,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":35307,"flow_avg_l4_payload_len":1103,"midstream":1,"thread_ts_msec":1301328420325,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"74.89.181.229","src_port":55348,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} -00776{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":157,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":32,"flow_first_seen":1301328319392,"flow_last_seen":1301328420325,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":35307,"flow_avg_l4_payload_len":1103,"midstream":1,"thread_ts_msec":1301328420325,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"74.89.181.229","src_port":55348,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} 00585{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":201,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1301328472925,"flow_last_seen":1301328472925,"flow_idle_time":7440000,"flow_min_l4_payload_len":105,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":105,"flow_avg_l4_payload_len":105,"midstream":1,"thread_ts_msec":1301328472925,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"66.68.83.22","src_port":55383,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00615{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":201,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_last_seen":1301328472925,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"thread_ts_msec":1301328472925,"pkt":"ACPrIpS0ACNshovhCABFAACde+1AAEAGZt3AqAGOQkRTFthXII0tj7Vf9ZidkYAY\/\/+IsAAAAQEICicy8EYAAAAA+b602XZlcnNpb24AAAAAAFUAAAABfQAAAQAAAAAAAABYspBNAAAAAAEAAAAAAAAAAAAAAAAAAAAAAP\/\/QkRTFiCNAQAAAAAAAAAAAAAAAAAAAAAA\/\/8mYIQeII21Dgd4gTLgpgDgvgEA"} +00760{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":201,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1301328472925,"flow_last_seen":1301328472925,"flow_idle_time":7440000,"flow_min_l4_payload_len":105,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":105,"flow_avg_l4_payload_len":105,"midstream":1,"thread_ts_msec":1301328472925,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"66.68.83.22","src_port":55383,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} 00614{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":202,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_last_seen":1301328472987,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"thread_ts_msec":1301328472987,"pkt":"ACNshovhACPrIpS0CABFAACdMqtAAG8GgR9CRFMWwKgBjiCN2Ff1mJ2RLY+1yIAY\/5aM3QAAAQEICgBK7W0nMvBG+b602XZlcnNpb24AAAAAAFUAAACcfAAAAQAAAAAAAABZspBNAAAAAAEAAAAAAAAAAAAAAAAAAAAAAP\/\/JmCEHthXAQAAAAAAAAAAAAAAAAAAAAAA\/\/9CRFMWII0z3Rs+AfeDdwAHwwEA"} 00495{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":203,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":3,"flow_last_seen":1301328473077,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"thread_ts_msec":1301328473077,"pkt":"ACNshovhACPrIpS0CABFAABIMqxAAG8GgXNCRFMWwKgBjiCN2Ff1mJ36LY+1yIAY\/5avrAAAAQEICgBK7W4nMvBG+b602XZlcmFjawAAAAAAAAAAAAA="} -00556{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":215,"source":"bitcoin.pcap","alias":"nDPId-test","packets-captured":215,"packets-processed":214,"total-skipped-flows":0,"total-l4-data-len":260266,"total-not-detected-flows":0,"total-guessed-flows":2,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":4,"total-active-flows":4,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":23,"global_ts_msec":1301328538215} -00773{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":284,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":32,"flow_first_seen":1301328472925,"flow_last_seen":1301328616076,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":32755,"flow_avg_l4_payload_len":1023,"midstream":1,"thread_ts_msec":1301328616076,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"66.68.83.22","src_port":55383,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} -00774{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":284,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":32,"flow_first_seen":1301328472925,"flow_last_seen":1301328616076,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":32755,"flow_avg_l4_payload_len":1023,"midstream":1,"thread_ts_msec":1301328616076,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"66.68.83.22","src_port":55383,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00556{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":215,"source":"bitcoin.pcap","alias":"nDPId-test","packets-captured":215,"packets-processed":214,"total-skipped-flows":0,"total-l4-data-len":260266,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":4,"total-detection-updates":0,"total-updates":0,"current-active-flows":4,"total-active-flows":4,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":23,"global_ts_msec":1301328538215} 00588{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":348,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1301328699728,"flow_last_seen":1301328699728,"flow_idle_time":7440000,"flow_min_l4_payload_len":105,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":105,"flow_avg_l4_payload_len":105,"midstream":1,"thread_ts_msec":1301328699728,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"195.218.16.178","src_port":55400,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00615{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":348,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_last_seen":1301328699728,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"thread_ts_msec":1301328699728,"pkt":"ACPrIpS0ACNshovhCABFAACdK9RAAEAGd8TAqAGOw9oQsthoII1BDXcu4yOzE4AY\/\/9L7wAAAQEICicy+R8AACIN+b602XZlcnNpb24AAAAAAFUAAAABfQAAAQAAAAAAAAA7s5BNAAAAAAEAAAAAAAAAAAAAAAAAAAAAAP\/\/w9oQsiCNAQAAAAAAAAAAAAAAAAAAAAAA\/\/8mYIQeII38Ree1v7hQ3gC4wAEA"} +00763{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":348,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1301328699728,"flow_last_seen":1301328699728,"flow_idle_time":7440000,"flow_min_l4_payload_len":105,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":105,"flow_avg_l4_payload_len":105,"midstream":1,"thread_ts_msec":1301328699728,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"195.218.16.178","src_port":55400,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} 00614{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":349,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_last_seen":1301328699856,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"thread_ts_msec":1301328699856,"pkt":"ACNshovhACPrIpS0CABFAACdBc9AAHUGaMnD2hCywKgBjiCN2GjjI7MTQQ13l4AYAQQ8gQAAAQEICgAAIhwnMvkf+b602XZlcnNpb24AAAAAAFUAAAACfQAAAQAAAAAAAAA4s5BNAAAAAAEAAAAAAAAAAAAAAAAAAAAAAP\/\/JmCEHthoAQAAAAAAAAAAAAAAAAAAAAAA\/\/\/D2hCyII0FGo5IhpYwXgAKwwEA"} 00494{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":350,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_last_seen":1301328699969,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"thread_ts_msec":1301328699969,"pkt":"ACNshovhACPrIpS0CABFAABIBdlAAHUGaRTD2hCywKgBjiCN2GjjI7N8QQ13l4AYAQRZWQAAAQEICgAAIignMvkg+b602XZlcmFjawAAAAAAAAAAAAA="} -00776{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":390,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":32,"flow_first_seen":1301328699728,"flow_last_seen":1301328743741,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":33744,"flow_avg_l4_payload_len":1054,"midstream":1,"thread_ts_msec":1301328743741,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"195.218.16.178","src_port":55400,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} -00777{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":390,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":32,"flow_first_seen":1301328699728,"flow_last_seen":1301328743741,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":33744,"flow_avg_l4_payload_len":1054,"midstream":1,"thread_ts_msec":1301328743741,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"195.218.16.178","src_port":55400,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} -00556{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":495,"source":"bitcoin.pcap","alias":"nDPId-test","packets-captured":495,"packets-processed":494,"total-skipped-flows":0,"total-l4-data-len":520135,"total-not-detected-flows":0,"total-guessed-flows":4,"total-detected-flows":4,"total-detection-updates":0,"total-updates":0,"current-active-flows":5,"total-active-flows":5,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":32,"global_ts_msec":1301329138452} +00556{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":495,"source":"bitcoin.pcap","alias":"nDPId-test","packets-captured":495,"packets-processed":494,"total-skipped-flows":0,"total-l4-data-len":520135,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":5,"total-detection-updates":0,"total-updates":0,"current-active-flows":5,"total-active-flows":5,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":29,"global_ts_msec":1301329138452} 00588{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":521,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1301329304767,"flow_last_seen":1301329304767,"flow_idle_time":7440000,"flow_min_l4_payload_len":105,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":105,"flow_avg_l4_payload_len":105,"midstream":1,"thread_ts_msec":1301329304767,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"184.58.165.119","src_port":55487,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00616{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":521,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_last_seen":1301329304767,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"thread_ts_msec":1301329304767,"pkt":"ACPrIpS0ACNshovhCABFAACdDAhAAEAGDmvAqAGOuDqld9i\/II0stRatNDMFDIAY\/\/9S8AAAAQEICiczELoAVdzf+b602XZlcnNpb24AAAAAAFUAAAABfQAAAQAAAAAAAACYtZBNAAAAAAEAAAAAAAAAAAAAAAAAAAAAAP\/\/uDqldyCNAQAAAAAAAAAAAAAAAAAAAAAA\/\/8mYIQeII0b7ZMAlkQ1dwALwwEA"} +00763{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":521,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1301329304767,"flow_last_seen":1301329304767,"flow_idle_time":7440000,"flow_min_l4_payload_len":105,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":105,"flow_avg_l4_payload_len":105,"midstream":1,"thread_ts_msec":1301329304767,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"184.58.165.119","src_port":55487,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} 00614{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":522,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_last_seen":1301329304813,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"thread_ts_msec":1301329304813,"pkt":"ACNshovhACPrIpS0CABFAACdBMxAAHQG4aa4OqV3wKgBjiCN2L80MwUMLLUWrYAYAQTgGAAAAQEICgBV3OcnMxC6+b602XZlcnNpb24AAAAAAFUAAAACfQAAAQAAAAAAAACQtZBNAAAAAAEAAAAAAAAAAAAAAAAAAAAAAP\/\/JmCEHti\/AQAAAAAAAAAAAAAAAAAAAAAA\/\/+4OqV3II2BHa1kLxLeCgCuwgEA"} 00606{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":523,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_last_seen":1301329305005,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":165,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":165,"pkt_l4_len":131,"thread_ts_msec":1301329305005,"pkt":"ACPrIpS0ACNshovhCABFAACX6RJAAEAGMWbAqAGOuDqld9i\/II0stRcWNDMFdYAY\/\/+hogAAAQEICiczEL0AVdz7+b602XZlcmFjawAAAAAAAAAAAAD5vrTZZ2V0YWRkcgAAAAAAAAAAAF324OL5vrTZYWRkcgAAAAAAAAAAHwAAAKr+QCYBbLWQTQEAAAAAAAAAAAAAAAAAAAAAAP\/\/JmCEHiCN"} -00556{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":622,"source":"bitcoin.pcap","alias":"nDPId-test","packets-captured":622,"packets-processed":621,"total-skipped-flows":0,"total-l4-data-len":537564,"total-not-detected-flows":0,"total-guessed-flows":4,"total-detected-flows":4,"total-detection-updates":0,"total-updates":0,"current-active-flows":6,"total-active-flows":6,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":37,"global_ts_msec":1301329743430} -00816{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":172,"flow_first_seen":1301328319392,"flow_last_seen":1301329810648,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":152141,"flow_avg_l4_payload_len":884,"midstream":1,"thread_ts_msec":1301329810839,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"74.89.181.229","src_port":55348,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} -00816{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"finished","flow_packets_processed":119,"flow_first_seen":1301328699728,"flow_last_seen":1301329807659,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":74897,"flow_avg_l4_payload_len":629,"midstream":1,"thread_ts_msec":1301329810839,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"195.218.16.178","src_port":55400,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} -00773{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":27,"flow_first_seen":1301329304767,"flow_last_seen":1301329810839,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1061,"flow_tot_l4_payload_len":2684,"flow_avg_l4_payload_len":99,"midstream":1,"thread_ts_msec":1301329810839,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"184.58.165.119","src_port":55487,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} -00590{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":27,"flow_first_seen":1301329304767,"flow_last_seen":1301329810839,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1061,"flow_tot_l4_payload_len":2684,"flow_avg_l4_payload_len":99,"midstream":1,"thread_ts_msec":1301329810839,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"184.58.165.119","src_port":55487,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} -00814{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":161,"flow_first_seen":1301328472925,"flow_last_seen":1301329809936,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":104984,"flow_avg_l4_payload_len":652,"midstream":1,"thread_ts_msec":1301329810839,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"66.68.83.22","src_port":55383,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} -00777{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":19,"flow_first_seen":1301327937725,"flow_last_seen":1301327939000,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":22190,"flow_avg_l4_payload_len":1167,"midstream":1,"thread_ts_msec":1301329810839,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"188.165.213.169","src_port":55317,"dst_port":8333,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} -00594{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":19,"flow_first_seen":1301327937725,"flow_last_seen":1301327939000,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":22190,"flow_avg_l4_payload_len":1167,"midstream":1,"thread_ts_msec":1301329810839,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"188.165.213.169","src_port":55317,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} -00817{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":139,"flow_first_seen":1301328089970,"flow_last_seen":1301328420526,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":182136,"flow_avg_l4_payload_len":1310,"midstream":1,"thread_ts_msec":1301329810839,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"69.118.54.122","src_port":55328,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} -00558{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","packets-captured":637,"packets-processed":637,"total-skipped-flows":0,"total-l4-data-len":539032,"total-not-detected-flows":0,"total-guessed-flows":6,"total-detected-flows":4,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":6,"total-idle-flows":6,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":46,"global_ts_msec":1301329810839} +00556{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":622,"source":"bitcoin.pcap","alias":"nDPId-test","packets-captured":622,"packets-processed":621,"total-skipped-flows":0,"total-l4-data-len":537564,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":6,"total-detection-updates":0,"total-updates":0,"current-active-flows":6,"total-active-flows":6,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":35,"global_ts_msec":1301329743430} +00806{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":172,"flow_first_seen":1301328319392,"flow_last_seen":1301329810648,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":152141,"flow_avg_l4_payload_len":884,"midstream":1,"thread_ts_msec":1301329810839,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"74.89.181.229","src_port":55348,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00806{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"finished","flow_packets_processed":119,"flow_first_seen":1301328699728,"flow_last_seen":1301329807659,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":74897,"flow_avg_l4_payload_len":629,"midstream":1,"thread_ts_msec":1301329810839,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"195.218.16.178","src_port":55400,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00803{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"finished","flow_packets_processed":27,"flow_first_seen":1301329304767,"flow_last_seen":1301329810839,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1061,"flow_tot_l4_payload_len":2684,"flow_avg_l4_payload_len":99,"midstream":1,"thread_ts_msec":1301329810839,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"184.58.165.119","src_port":55487,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00804{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":161,"flow_first_seen":1301328472925,"flow_last_seen":1301329809936,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":104984,"flow_avg_l4_payload_len":652,"midstream":1,"thread_ts_msec":1301329810839,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"66.68.83.22","src_port":55383,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00807{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":19,"flow_first_seen":1301327937725,"flow_last_seen":1301327939000,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":22190,"flow_avg_l4_payload_len":1167,"midstream":1,"thread_ts_msec":1301329810839,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"188.165.213.169","src_port":55317,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00807{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":139,"flow_first_seen":1301328089970,"flow_last_seen":1301328420526,"flow_idle_time":7440000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":182136,"flow_avg_l4_payload_len":1310,"midstream":1,"thread_ts_msec":1301329810839,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"69.118.54.122","src_port":55328,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00558{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","packets-captured":637,"packets-processed":637,"total-skipped-flows":0,"total-l4-data-len":539032,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":6,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":6,"total-idle-flows":6,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":42,"global_ts_msec":1301329810839} ~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ ~~ packets captured/processed: 637/637 ~~ skipped flows.............: 0 ~~ total layer4 data length..: 539032 bytes -~~ total detected protocols..: 4 +~~ total detected protocols..: 6 ~~ total active/idle flows...: 6/6 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5747214 bytes -~~ total memory freed........: 5747214 bytes -~~ total allocations/frees...: 101871/101871 +~~ total memory allocated....: 5221746 bytes +~~ total memory freed........: 5221746 bytes +~~ total allocations/frees...: 113685/113685 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 1833 chars diff --git a/test/results/bittorrent.pcap.out b/test/results/bittorrent.pcap.out index 4fd207ad5..6ac1a3f79 100644 --- a/test/results/bittorrent.pcap.out +++ b/test/results/bittorrent.pcap.out @@ -140,9 +140,9 @@ ~~ total active/idle flows...: 24/24 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5015453 bytes -~~ total memory freed........: 5015453 bytes -~~ total allocations/frees...: 101535/101535 +~~ total memory allocated....: 5514360 bytes +~~ total memory freed........: 5514360 bytes +~~ total allocations/frees...: 113417/113417 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 466 chars ~~ json string max len.......: 1461 chars diff --git a/test/results/bittorrent_utp.pcap.out b/test/results/bittorrent_utp.pcap.out index b44b2a4f2..49562b04b 100644 --- a/test/results/bittorrent_utp.pcap.out +++ b/test/results/bittorrent_utp.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4944164 bytes -~~ total memory freed........: 4944164 bytes -~~ total allocations/frees...: 101231/101231 +~~ total memory allocated....: 5443071 bytes +~~ total memory freed........: 5443071 bytes +~~ total allocations/frees...: 113113/113113 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 470 chars ~~ json string max len.......: 852 chars diff --git a/test/results/bjnp.pcap.out b/test/results/bjnp.pcap.out new file mode 100644 index 000000000..96e61ec8c --- /dev/null +++ b/test/results/bjnp.pcap.out @@ -0,0 +1,38 @@ +00455{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"bjnp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00541{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"bjnp.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1467725378685} +00170{"error_event_id":3,"error_event_name":"Unsupported datalink layer","datalink":12,"packet_id":1,"source":"bjnp.pcap","alias":"nDPId-test","global_ts_msec":1467725378685} +00313{"packet_event_id":1,"packet_event_name":"packet","packet_id":1,"source":"bjnp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":46,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":46,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"RQAALAmDAAB5EfxOwKi5jcCoARHDpyGkABg0Q0JKTlACAQAAF6QAAAAAAADK6w=="} +00170{"error_event_id":3,"error_event_name":"Unsupported datalink layer","datalink":12,"packet_id":2,"source":"bjnp.pcap","alias":"nDPId-test","global_ts_msec":1467725383705} +00313{"packet_event_id":1,"packet_event_name":"packet","packet_id":2,"source":"bjnp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":46,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":46,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"RQAALAmRAAB5EfxQwKi5jcCoAQHDqSGkABg0T0JKTlACAQAAF6YAAAAAAACF3A=="} +00170{"error_event_id":3,"error_event_name":"Unsupported datalink layer","datalink":12,"packet_id":3,"source":"bjnp.pcap","alias":"nDPId-test","global_ts_msec":1467725383909} +00313{"packet_event_id":1,"packet_event_name":"packet","packet_id":3,"source":"bjnp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":46,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":46,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"RQAALAmSAAB5EfxOwKi5jcCoAQLDqSGkABg0TUJKTlACAQAAF6cAAAAAAAAfDQ=="} +00170{"error_event_id":3,"error_event_name":"Unsupported datalink layer","datalink":12,"packet_id":4,"source":"bjnp.pcap","alias":"nDPId-test","global_ts_msec":1467725384113} +00313{"packet_event_id":1,"packet_event_name":"packet","packet_id":4,"source":"bjnp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":46,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":46,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"RQAALAmTAAB5EfxMwKi5jcCoAQPDqSGkABg0S0JKTlACAQAAF6gAAAAAAACCRA=="} +00170{"error_event_id":3,"error_event_name":"Unsupported datalink layer","datalink":12,"packet_id":5,"source":"bjnp.pcap","alias":"nDPId-test","global_ts_msec":1467725384313} +00313{"packet_event_id":1,"packet_event_name":"packet","packet_id":5,"source":"bjnp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":46,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":46,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"RQAALAmVAAB5EfxJwKi5jcCoAQTDqSGkABg0SUJKTlACAQAAF6kAAAAAAADs+w=="} +00170{"error_event_id":3,"error_event_name":"Unsupported datalink layer","datalink":12,"packet_id":6,"source":"bjnp.pcap","alias":"nDPId-test","global_ts_msec":1467725384517} +00313{"packet_event_id":1,"packet_event_name":"packet","packet_id":6,"source":"bjnp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":46,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":46,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"RQAALAmWAAB5EfxHwKi5jcCoAQXDqSGkABg0R0JKTlACAQAAF6oAAAAAAADhdg=="} +00170{"error_event_id":3,"error_event_name":"Unsupported datalink layer","datalink":12,"packet_id":7,"source":"bjnp.pcap","alias":"nDPId-test","global_ts_msec":1467725384721} +00313{"packet_event_id":1,"packet_event_name":"packet","packet_id":7,"source":"bjnp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":46,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":46,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"RQAALAmXAAB5EfxFwKi5jcCoAQbDqSGkABg0RUJKTlACAQAAF6sAAAAAAACzRQ=="} +00170{"error_event_id":3,"error_event_name":"Unsupported datalink layer","datalink":12,"packet_id":8,"source":"bjnp.pcap","alias":"nDPId-test","global_ts_msec":1467725384921} +00313{"packet_event_id":1,"packet_event_name":"packet","packet_id":8,"source":"bjnp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":46,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":46,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"RQAALAmYAAB5EfxDwKi5jcCoAQfDqSGkABg0Q0JKTlACAQAAF6wAAAAAAAC5aQ=="} +00170{"error_event_id":3,"error_event_name":"Unsupported datalink layer","datalink":12,"packet_id":9,"source":"bjnp.pcap","alias":"nDPId-test","global_ts_msec":1467725385125} +00313{"packet_event_id":1,"packet_event_name":"packet","packet_id":9,"source":"bjnp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":46,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":46,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"RQAALAmaAAB5EfxAwKi5jcCoAQjDqSGkABg0QUJKTlACAQAAF60AAAAAAACvDw=="} +00171{"error_event_id":3,"error_event_name":"Unsupported datalink layer","datalink":12,"packet_id":10,"source":"bjnp.pcap","alias":"nDPId-test","global_ts_msec":1467725385329} +00314{"packet_event_id":1,"packet_event_name":"packet","packet_id":10,"source":"bjnp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":46,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":46,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"RQAALAmbAAB5Efw+wKi5jcCoAQnDqSGkABg0P0JKTlACAQAAF64AAAAAAABjbw=="} +00546{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":10,"source":"bjnp.pcap","alias":"nDPId-test","packets-captured":10,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":23,"global_ts_msec":1467725385329} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 10/0 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 0 bytes +~~ total detected protocols..: 0 +~~ total active/idle flows...: 0/0 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5177545 bytes +~~ total memory freed........: 5177545 bytes +~~ total allocations/frees...: 113022/113022 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 175 chars +~~ json string max len.......: 551 chars +~~ json string avg len.......: 361 chars diff --git a/test/results/bot.pcap.out b/test/results/bot.pcap.out index 7f6d57588..fab45ae60 100644 --- a/test/results/bot.pcap.out +++ b/test/results/bot.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4691326 bytes -~~ total memory freed........: 4691326 bytes -~~ total allocations/frees...: 101549/101549 +~~ total memory allocated....: 5190233 bytes +~~ total memory freed........: 5190233 bytes +~~ total allocations/frees...: 113431/113431 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 459 chars ~~ json string max len.......: 877 chars diff --git a/test/results/bt_search.pcap.out b/test/results/bt_search.pcap.out index 4f0eddd2e..1e6568e87 100644 --- a/test/results/bt_search.pcap.out +++ b/test/results/bt_search.pcap.out @@ -14,9 +14,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4941728 bytes -~~ total memory freed........: 4941728 bytes -~~ total allocations/frees...: 101147/101147 +~~ total memory allocated....: 5440635 bytes +~~ total memory freed........: 5440635 bytes +~~ total allocations/frees...: 113029/113029 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 692 chars diff --git a/test/results/capwap.pcap.out b/test/results/capwap.pcap.out index 13ebfd2c1..67657e9ef 100644 --- a/test/results/capwap.pcap.out +++ b/test/results/capwap.pcap.out @@ -54,9 +54,9 @@ ~~ total active/idle flows...: 5/5 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4694511 bytes -~~ total memory freed........: 4694511 bytes -~~ total allocations/frees...: 101552/101552 +~~ total memory allocated....: 5193418 bytes +~~ total memory freed........: 5193418 bytes +~~ total allocations/frees...: 113434/113434 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 186 chars ~~ json string max len.......: 806 chars diff --git a/test/results/cassandra.pcap.out b/test/results/cassandra.pcap.out index 0cd3c4a38..c02266d2d 100644 --- a/test/results/cassandra.pcap.out +++ b/test/results/cassandra.pcap.out @@ -21,9 +21,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4688676 bytes -~~ total memory freed........: 4688676 bytes -~~ total allocations/frees...: 101432/101432 +~~ total memory allocated....: 5187583 bytes +~~ total memory freed........: 5187583 bytes +~~ total allocations/frees...: 113314/113314 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 693 chars diff --git a/test/results/check_mk_new.pcap.out b/test/results/check_mk_new.pcap.out index d2752575e..6caee100f 100644 --- a/test/results/check_mk_new.pcap.out +++ b/test/results/check_mk_new.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682352 bytes -~~ total memory freed........: 4682352 bytes -~~ total allocations/frees...: 101241/101241 +~~ total memory allocated....: 5181259 bytes +~~ total memory freed........: 5181259 bytes +~~ total allocations/frees...: 113123/113123 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 468 chars ~~ json string max len.......: 705 chars diff --git a/test/results/chrome.pcap.out b/test/results/chrome.pcap.out index 392a21147..5d1106297 100644 --- a/test/results/chrome.pcap.out +++ b/test/results/chrome.pcap.out @@ -51,9 +51,9 @@ ~~ total active/idle flows...: 6/6 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4859809 bytes -~~ total memory freed........: 4859809 bytes -~~ total allocations/frees...: 106809/106809 +~~ total memory allocated....: 5358716 bytes +~~ total memory freed........: 5358716 bytes +~~ total allocations/frees...: 118691/118691 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 943 chars diff --git a/test/results/citrix.pcap.out b/test/results/citrix.pcap.out new file mode 100644 index 000000000..ab2a25dec --- /dev/null +++ b/test/results/citrix.pcap.out @@ -0,0 +1,23 @@ +00457{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"citrix.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00530{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"citrix.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":0,"flow_last_seen":0,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":0,"l3_proto":"ip4","src_ip":"21.0.0.8","dst_ip":"22.0.0.7","src_port":45225,"dst_port":1494,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00440{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"citrix.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":0,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":24,"thread_ts_msec":0,"pkt":"4F+5aekiABUXp3WjCABFAAAsrYMAAIAGYjoVAAAIFgAAB7CpBdYP1me4AAAAAGACgAC\/CQAAAgQFtAAA6CmQmA=="} +00439{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"citrix.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":2,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":24,"thread_ts_msec":2,"pkt":"ABUXp3Wj4F+5aekiCABFAAAsrVIAAH4GZGsWAAAHFQAACAXWsKkP1nFlD9ZnuWASgAA9vQAAAgQFtAAA3WOanQ=="} +00439{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"citrix.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":2,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":20,"thread_ts_msec":2,"pkt":"4F+5aekiABUXp3WjCABFAAAorYQAAIAGYj0VAAAIFgAAB7CpBdYP1me5D9ZxZlAQgABVegAAAAAAAAAAIuNIFQ=="} +00591{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"citrix.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":2,"flow_last_seen":8,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":6,"flow_tot_l4_payload_len":6,"flow_avg_l4_payload_len":1,"midstream":0,"thread_ts_msec":8,"l3_proto":"ip4","src_ip":"21.0.0.8","dst_ip":"22.0.0.7","src_port":45225,"dst_port":1494,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"Citrix","breed":"Acceptable","category":"Network"}} +00646{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":100,"source":"citrix.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":100,"flow_first_seen":2,"flow_last_seen":1605,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":855,"flow_tot_l4_payload_len":5490,"flow_avg_l4_payload_len":54,"midstream":0,"thread_ts_msec":1605,"l3_proto":"ip4","src_ip":"21.0.0.8","dst_ip":"22.0.0.7","src_port":45225,"dst_port":1494,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"Citrix","breed":"Acceptable","category":"Network"}} +00545{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":100,"source":"citrix.pcap","alias":"nDPId-test","packets-captured":100,"packets-processed":100,"total-skipped-flows":0,"total-l4-data-len":5490,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":8,"global_ts_msec":1605} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 100/100 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 5490 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5181317 bytes +~~ total memory freed........: 5181317 bytes +~~ total allocations/frees...: 113125/113125 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 444 chars +~~ json string max len.......: 651 chars +~~ json string avg len.......: 534 chars diff --git a/test/results/coap_mqtt.pcap.out b/test/results/coap_mqtt.pcap.out index 481e9d2a2..48dbc38a7 100644 --- a/test/results/coap_mqtt.pcap.out +++ b/test/results/coap_mqtt.pcap.out @@ -97,9 +97,9 @@ ~~ total active/idle flows...: 16/16 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4947688 bytes -~~ total memory freed........: 4947688 bytes -~~ total allocations/frees...: 109706/109706 +~~ total memory allocated....: 5446595 bytes +~~ total memory freed........: 5446595 bytes +~~ total allocations/frees...: 121588/121588 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 458 chars ~~ json string max len.......: 832 chars diff --git a/test/results/corba.pcap.out b/test/results/corba.pcap.out new file mode 100644 index 000000000..33e882133 --- /dev/null +++ b/test/results/corba.pcap.out @@ -0,0 +1,36 @@ +00456{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"corba.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00542{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"corba.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1614768020788} +00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4,"source":"corba.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1614768020789,"flow_last_seen":1614768020789,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1614768020789,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8726,"dst_port":900,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00458{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"corba.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1614768020789,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614768020789,"pkt":"5kBKB+riApXG95NLCABFAAAwnOsAAIAGAAAKZQACCmYAAiIWA4SwjQfnAAAAAHACgAEU8QAAAgQFtAMDAQA="} +00458{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"corba.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1614768020790,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614768020790,"pkt":"ApXG95NL5kBKB+riCABFAAAwnN4AAH8GihsKZgACCmUAAgOEIhawjRxgsI0H6HASgAFEQgAAAgQFtAMDAQA="} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"corba.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1614768020790,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_msec":1614768020790,"pkt":"5kBKB+riApXG95NLCABFAAAonOwAAIAGAAAKZQACCmYAAiIWA4SwjQfosI0cYVAQgAEU6QAAAAAAAAAA"} +00628{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"corba.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1614768020789,"flow_last_seen":1614768020790,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":268,"flow_tot_l4_payload_len":268,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":1614768020790,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8726,"dst_port":900,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"Corba","breed":"Acceptable","category":"RPC"}} +00569{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":10,"source":"corba.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1614768020792,"flow_last_seen":1614768020792,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1614768020792,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8727,"dst_port":1049,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00459{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"corba.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1614768020792,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614768020792,"pkt":"5kBKB+riApXG95NLCABFAAAwnO8AAIAGAAAKZQACCmYAAiIXBBmwjThoAAAAAHACgAEU8QAAAgQFtAMDAQA="} +00459{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"corba.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1614768020793,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614768020793,"pkt":"ApXG95NL5kBKB+riCABFAAAwnOEAAH8GihgKZgACCmUAAgQZIhewjUFJsI04aXASgAHuQQAAAgQFtAMDAQA="} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"corba.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1614768020793,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_msec":1614768020793,"pkt":"5kBKB+riApXG95NLCABFAAAonPAAAIAGAAAKZQACCmYAAiIXBBmwjThpsI1BSlAQgAEU6QAAAAAAAAAA"} +00630{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":14,"source":"corba.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1614768020792,"flow_last_seen":1614768020793,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":383,"flow_tot_l4_payload_len":383,"flow_avg_l4_payload_len":95,"midstream":0,"thread_ts_msec":1614768020793,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8727,"dst_port":1049,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"Corba","breed":"Acceptable","category":"RPC"}} +00570{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":19,"source":"corba.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1614768020794,"flow_last_seen":1614768020794,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1614768020794,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8728,"dst_port":61191,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00459{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"corba.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":1614768020794,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614768020794,"pkt":"5kBKB+riApXG95NLCABFAAAwnPQAAIAGAAAKZQACCmYAAiIY7wewjV4NAAAAAHACgAEU8QAAAgQFtAMDAQA="} +00459{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"corba.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":1614768020795,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614768020795,"pkt":"ApXG95NL5kBKB+riCABFAAAwnOUAAH8GihQKZgACCmUAAu8HIhiwjWV0sI1eDnASgAG5gQAAAgQFtAMDAQA="} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"corba.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_last_seen":1614768020795,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_msec":1614768020795,"pkt":"5kBKB+riApXG95NLCABFAAAonPUAAIAGAAAKZQACCmYAAiIY7wewjV4OsI1ldVAQgAEU6QAAAAAAAAAA"} +00631{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":23,"source":"corba.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1614768020794,"flow_last_seen":1614768020795,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":322,"flow_tot_l4_payload_len":322,"flow_avg_l4_payload_len":80,"midstream":0,"thread_ts_msec":1614768020795,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8728,"dst_port":61191,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"Corba","breed":"Acceptable","category":"RPC"}} +00668{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":25,"source":"corba.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":1614768020789,"flow_last_seen":1614768020792,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":494,"flow_tot_l4_payload_len":762,"flow_avg_l4_payload_len":108,"midstream":0,"thread_ts_msec":1614768020795,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8726,"dst_port":900,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"Corba","breed":"Acceptable","category":"RPC"}} +00670{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":25,"source":"corba.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":1614768020792,"flow_last_seen":1614768020794,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":383,"flow_tot_l4_payload_len":1047,"flow_avg_l4_payload_len":116,"midstream":0,"thread_ts_msec":1614768020795,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8727,"dst_port":1049,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"Corba","breed":"Acceptable","category":"RPC"}} +00669{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":25,"source":"corba.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":1614768020794,"flow_last_seen":1614768020795,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":322,"flow_tot_l4_payload_len":588,"flow_avg_l4_payload_len":98,"midstream":0,"thread_ts_msec":1614768020795,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8728,"dst_port":61191,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"Corba","breed":"Acceptable","category":"RPC"}} +00551{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":25,"source":"corba.pcap","alias":"nDPId-test","packets-captured":25,"packets-processed":22,"total-skipped-flows":0,"total-l4-data-len":2397,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":3,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":3,"total-idle-flows":3,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":21,"global_ts_msec":1614768020795} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 25/22 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 2397 bytes +~~ total detected protocols..: 3 +~~ total active/idle flows...: 3/3 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5186943 bytes +~~ total memory freed........: 5186943 bytes +~~ total allocations/frees...: 113056/113056 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 459 chars +~~ json string max len.......: 675 chars +~~ json string avg len.......: 565 chars diff --git a/test/results/cpha.pcap.out b/test/results/cpha.pcap.out index 9df3b5bb9..d39e56476 100644 --- a/test/results/cpha.pcap.out +++ b/test/results/cpha.pcap.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679539 bytes -~~ total memory freed........: 4679539 bytes -~~ total allocations/frees...: 101144/101144 +~~ total memory allocated....: 5178446 bytes +~~ total memory freed........: 5178446 bytes +~~ total allocations/frees...: 113026/113026 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 460 chars ~~ json string max len.......: 663 chars diff --git a/test/results/dcerpc.pcap.out b/test/results/dcerpc.pcap.out index cc26ec256..fa3a7fbb9 100644 --- a/test/results/dcerpc.pcap.out +++ b/test/results/dcerpc.pcap.out @@ -31,9 +31,9 @@ ~~ total active/idle flows...: 4/4 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682590 bytes -~~ total memory freed........: 4682590 bytes -~~ total allocations/frees...: 101168/101168 +~~ total memory allocated....: 5181497 bytes +~~ total memory freed........: 5181497 bytes +~~ total allocations/frees...: 113050/113050 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 1732 chars diff --git a/test/results/dhcp-fuzz.pcapng.out b/test/results/dhcp-fuzz.pcapng.out index 1dbb1511f..c34252f42 100644 --- a/test/results/dhcp-fuzz.pcapng.out +++ b/test/results/dhcp-fuzz.pcapng.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679539 bytes -~~ total memory freed........: 4679539 bytes -~~ total allocations/frees...: 101144/101144 +~~ total memory allocated....: 5178446 bytes +~~ total memory freed........: 5178446 bytes +~~ total allocations/frees...: 113026/113026 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 467 chars ~~ json string max len.......: 857 chars diff --git a/test/results/diameter.pcap.out b/test/results/diameter.pcap.out index 60cd4dd10..b29efcc9b 100644 --- a/test/results/diameter.pcap.out +++ b/test/results/diameter.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679684 bytes -~~ total memory freed........: 4679684 bytes -~~ total allocations/frees...: 101149/101149 +~~ total memory allocated....: 5178591 bytes +~~ total memory freed........: 5178591 bytes +~~ total allocations/frees...: 113031/113031 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 938 chars diff --git a/test/results/discord.pcap.out b/test/results/discord.pcap.out new file mode 100644 index 000000000..49b0b1f86 --- /dev/null +++ b/test/results/discord.pcap.out @@ -0,0 +1,25 @@ +00458{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"discord.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00550{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"discord.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":42193,"flow_last_seen":42193,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":42193,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"162.159.128.233","src_port":42834,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00461{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"discord.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":42193,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":42193,"pkt":"UlQAEjUCCAAnW\/mGCABFAAA8+ptAAEAGEIkKAAIPop+A6adSAbuGXfMIAAAAAKAC+vDjjQAAAgQFtAQCCAqmenD7AAAAAAEDAwc="} +00443{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"discord.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":42208,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":42208,"pkt":"CAAnW\/mGUlQAEjUCCABFAAAsAYYAAEAGSa+in4DpCgACDwG7p1IAKQQBhl3zCWAS\/\/9B4AAAAgQFtA=="} +00674{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"discord.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":42209,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":230,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":230,"pkt_l4_len":196,"thread_ts_msec":42209,"pkt":"UlQAEjUCCAAnW\/mGCABFAADY+p1AAEAGD+sKAAIPop+A6adSAbuGXfMJACkEAlAY+vBAZwAAFgMBAKsBAACnAwPx8xjD5ySSyjBvN4nq\/yhxDwDcyJh8lqatQ2ebeRUbCgAAGMArwCzMqcAvwDDMqMATwBQAnACdAC8ANQEAAGb\/AQABAAAAABAADgAAC2Rpc2NvcmQuY29tABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEABQAFAQAAAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAACgAIAAYAHQAXABg="} +00820{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"discord.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":42193,"flow_last_seen":42209,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":176,"flow_tot_l4_payload_len":176,"flow_avg_l4_payload_len":58,"midstream":0,"thread_ts_msec":42209,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"162.159.128.233","src_port":42834,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Discord","breed":"Fun","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"discord.com","ja3":"6f5e62edfa5933b1332ddf8b9fb3ef9d","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}} +00879{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":4,"source":"discord.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":42193,"flow_last_seen":42225,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":1628,"flow_avg_l4_payload_len":407,"midstream":0,"thread_ts_msec":42225,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"162.159.128.233","src_port":42834,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Discord","breed":"Fun","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"discord.com","ja3":"6f5e62edfa5933b1332ddf8b9fb3ef9d","ja3s":"9ebc57def2efb523f25c77af13aa6d48","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}} +01301{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":5,"source":"discord.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":42193,"flow_last_seen":42225,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":2886,"flow_avg_l4_payload_len":577,"midstream":0,"thread_ts_msec":42225,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"162.159.128.233","src_port":42834,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"9": {"risk":"TLS Expired Certificate","severity":"High","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"TLS.Discord","breed":"Fun","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"discord.com","server_names":"discord.com,sni.cloudflaressl.com,*.discord.com","ja3":"6f5e62edfa5933b1332ddf8b9fb3ef9d","ja3s":"9ebc57def2efb523f25c77af13aa6d48","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3","subjectDN":"C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com","alpn":"h2,http\/1.1","fingerprint":"31:3B:70:94:D5:DF:90:78:9C:A0:74:26:20:24:E4:3D:92:A7:57:9D"}} +00788{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7,"source":"discord.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":42193,"flow_last_seen":42247,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":3306,"flow_avg_l4_payload_len":472,"midstream":0,"thread_ts_msec":42247,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"162.159.128.233","src_port":42834,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"9": {"risk":"TLS Expired Certificate","severity":"High","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"TLS.Discord","breed":"Fun","category":"Collaborative"}} +00542{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":7,"source":"discord.pcap","alias":"nDPId-test","packets-captured":7,"packets-processed":7,"total-skipped-flows":0,"total-l4-data-len":3306,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":2,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":10,"global_ts_msec":42247} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 7/7 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 3306 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5183528 bytes +~~ total memory freed........: 5183528 bytes +~~ total allocations/frees...: 113040/113040 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 448 chars +~~ json string max len.......: 1306 chars +~~ json string avg len.......: 845 chars diff --git a/test/results/dlt_ppp.pcap.out b/test/results/dlt_ppp.pcap.out index 4966b0d09..95682240a 100644 --- a/test/results/dlt_ppp.pcap.out +++ b/test/results/dlt_ppp.pcap.out @@ -10,9 +10,9 @@ ~~ total active/idle flows...: 0/0 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4678638 bytes -~~ total memory freed........: 4678638 bytes -~~ total allocations/frees...: 101140/101140 +~~ total memory allocated....: 5177545 bytes +~~ total memory freed........: 5177545 bytes +~~ total allocations/frees...: 113022/113022 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 175 chars ~~ json string max len.......: 1932 chars diff --git a/test/results/dnp3.pcap.out b/test/results/dnp3.pcap.out index 2e7baaccc..faeb8c552 100644 --- a/test/results/dnp3.pcap.out +++ b/test/results/dnp3.pcap.out @@ -64,9 +64,9 @@ ~~ total active/idle flows...: 8/8 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4703409 bytes -~~ total memory freed........: 4703409 bytes -~~ total allocations/frees...: 101708/101708 +~~ total memory allocated....: 5202316 bytes +~~ total memory freed........: 5202316 bytes +~~ total allocations/frees...: 113590/113590 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 460 chars ~~ json string max len.......: 678 chars diff --git a/test/results/dns-invalid-chars.pcap.out b/test/results/dns-invalid-chars.pcap.out index 446779b84..17a923aae 100644 --- a/test/results/dns-invalid-chars.pcap.out +++ b/test/results/dns-invalid-chars.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679568 bytes -~~ total memory freed........: 4679568 bytes -~~ total allocations/frees...: 101145/101145 +~~ total memory allocated....: 5178475 bytes +~~ total memory freed........: 5178475 bytes +~~ total allocations/frees...: 113027/113027 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 473 chars ~~ json string max len.......: 802 chars diff --git a/test/results/dns-tunnel-iodine.pcap.out b/test/results/dns-tunnel-iodine.pcap.out index 231ab6b4f..dbe27f460 100644 --- a/test/results/dns-tunnel-iodine.pcap.out +++ b/test/results/dns-tunnel-iodine.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4692096 bytes -~~ total memory freed........: 4692096 bytes -~~ total allocations/frees...: 101577/101577 +~~ total memory allocated....: 5191003 bytes +~~ total memory freed........: 5191003 bytes +~~ total allocations/frees...: 113459/113459 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 473 chars ~~ json string max len.......: 919 chars diff --git a/test/results/dns_ambiguous_names.pcap.out b/test/results/dns_ambiguous_names.pcap.out index 64ed7e889..de261ecb9 100644 --- a/test/results/dns_ambiguous_names.pcap.out +++ b/test/results/dns_ambiguous_names.pcap.out @@ -69,9 +69,9 @@ ~~ total active/idle flows...: 10/10 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4687938 bytes -~~ total memory freed........: 4687938 bytes -~~ total allocations/frees...: 101190/101190 +~~ total memory allocated....: 5186845 bytes +~~ total memory freed........: 5186845 bytes +~~ total allocations/frees...: 113072/113072 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 475 chars ~~ json string max len.......: 901 chars diff --git a/test/results/dns_doh.pcap.out b/test/results/dns_doh.pcap.out index f8889aefa..b2f8e53f4 100644 --- a/test/results/dns_doh.pcap.out +++ b/test/results/dns_doh.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685718 bytes -~~ total memory freed........: 4685718 bytes -~~ total allocations/frees...: 101288/101288 +~~ total memory allocated....: 5184625 bytes +~~ total memory freed........: 5184625 bytes +~~ total allocations/frees...: 113170/113170 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 453 chars ~~ json string max len.......: 958 chars diff --git a/test/results/dns_dot.pcap.out b/test/results/dns_dot.pcap.out index 1424dc74e..39e3683cf 100644 --- a/test/results/dns_dot.pcap.out +++ b/test/results/dns_dot.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4686463 bytes -~~ total memory freed........: 4686463 bytes -~~ total allocations/frees...: 101182/101182 +~~ total memory allocated....: 5185370 bytes +~~ total memory freed........: 5185370 bytes +~~ total allocations/frees...: 113064/113064 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 1648 chars diff --git a/test/results/dns_exfiltration.pcap.out b/test/results/dns_exfiltration.pcap.out index ad0e3ede9..0d1116264 100644 --- a/test/results/dns_exfiltration.pcap.out +++ b/test/results/dns_exfiltration.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4688210 bytes -~~ total memory freed........: 4688210 bytes -~~ total allocations/frees...: 101443/101443 +~~ total memory allocated....: 5187117 bytes +~~ total memory freed........: 5187117 bytes +~~ total allocations/frees...: 113325/113325 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 472 chars ~~ json string max len.......: 993 chars diff --git a/test/results/dns_fragmented.pcap.out b/test/results/dns_fragmented.pcap.out index 24736c59d..27794f79c 100644 --- a/test/results/dns_fragmented.pcap.out +++ b/test/results/dns_fragmented.pcap.out @@ -154,9 +154,9 @@ ~~ total active/idle flows...: 21/21 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4698661 bytes -~~ total memory freed........: 4698661 bytes -~~ total allocations/frees...: 101262/101262 +~~ total memory allocated....: 5197568 bytes +~~ total memory freed........: 5197568 bytes +~~ total allocations/frees...: 113144/113144 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 214 chars ~~ json string max len.......: 2446 chars diff --git a/test/results/dns_invert_query.pcapng.out b/test/results/dns_invert_query.pcapng.out index 951d2a3f0..be9ecb1a7 100644 --- a/test/results/dns_invert_query.pcapng.out +++ b/test/results/dns_invert_query.pcapng.out @@ -14,9 +14,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679568 bytes -~~ total memory freed........: 4679568 bytes -~~ total allocations/frees...: 101145/101145 +~~ total memory allocated....: 5178475 bytes +~~ total memory freed........: 5178475 bytes +~~ total allocations/frees...: 113027/113027 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 781 chars diff --git a/test/results/dns_long_domainname.pcap.out b/test/results/dns_long_domainname.pcap.out index 211f4217c..d0ebd8890 100644 --- a/test/results/dns_long_domainname.pcap.out +++ b/test/results/dns_long_domainname.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679568 bytes -~~ total memory freed........: 4679568 bytes -~~ total allocations/frees...: 101145/101145 +~~ total memory allocated....: 5178475 bytes +~~ total memory freed........: 5178475 bytes +~~ total allocations/frees...: 113027/113027 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 475 chars ~~ json string max len.......: 819 chars diff --git a/test/results/dnscrypt-v1-and-resolver-pings.pcap.out b/test/results/dnscrypt-v1-and-resolver-pings.pcap.out index 64f4b0c43..2e91e2a7b 100644 --- a/test/results/dnscrypt-v1-and-resolver-pings.pcap.out +++ b/test/results/dnscrypt-v1-and-resolver-pings.pcap.out @@ -1473,9 +1473,9 @@ ~~ total active/idle flows...: 245/245 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4906430 bytes -~~ total memory freed........: 4906430 bytes -~~ total allocations/frees...: 102363/102363 +~~ total memory allocated....: 5405337 bytes +~~ total memory freed........: 5405337 bytes +~~ total allocations/frees...: 114245/114245 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 228 chars ~~ json string max len.......: 2433 chars diff --git a/test/results/dnscrypt-v2-doh.pcap.out b/test/results/dnscrypt-v2-doh.pcap.out index ce6fde897..b11327d22 100644 --- a/test/results/dnscrypt-v2-doh.pcap.out +++ b/test/results/dnscrypt-v2-doh.pcap.out @@ -249,9 +249,9 @@ ~~ total active/idle flows...: 34/34 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4871427 bytes -~~ total memory freed........: 4871427 bytes -~~ total allocations/frees...: 101955/101955 +~~ total memory allocated....: 5370334 bytes +~~ total memory freed........: 5370334 bytes +~~ total allocations/frees...: 113837/113837 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 470 chars ~~ json string max len.......: 4713 chars diff --git a/test/results/dnscrypt-v2.pcap.out b/test/results/dnscrypt-v2.pcap.out index 7c5beebac..d8cbbe678 100644 --- a/test/results/dnscrypt-v2.pcap.out +++ b/test/results/dnscrypt-v2.pcap.out @@ -24,9 +24,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681428 bytes -~~ total memory freed........: 4681428 bytes -~~ total allocations/frees...: 101155/101155 +~~ total memory allocated....: 5180335 bytes +~~ total memory freed........: 5180335 bytes +~~ total allocations/frees...: 113037/113037 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 467 chars ~~ json string max len.......: 1924 chars diff --git a/test/results/dnscrypt_skype_false_positive.pcapng.out b/test/results/dnscrypt_skype_false_positive.pcapng.out index e7c62f645..b4a3b1069 100644 --- a/test/results/dnscrypt_skype_false_positive.pcapng.out +++ b/test/results/dnscrypt_skype_false_positive.pcapng.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679684 bytes -~~ total memory freed........: 4679684 bytes -~~ total allocations/frees...: 101149/101149 +~~ total memory allocated....: 5178591 bytes +~~ total memory freed........: 5178591 bytes +~~ total allocations/frees...: 113031/113031 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 487 chars ~~ json string max len.......: 1159 chars diff --git a/test/results/doq.pcapng.out b/test/results/doq.pcapng.out index 09da57139..3d9c68f44 100644 --- a/test/results/doq.pcapng.out +++ b/test/results/doq.pcapng.out @@ -21,9 +21,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4686414 bytes -~~ total memory freed........: 4686414 bytes -~~ total allocations/frees...: 101178/101178 +~~ total memory allocated....: 5190003 bytes +~~ total memory freed........: 5190003 bytes +~~ total allocations/frees...: 113069/113069 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 2144 chars diff --git a/test/results/doq_adguard.pcapng.out b/test/results/doq_adguard.pcapng.out index a8cb13e6b..f66ad7c0c 100644 --- a/test/results/doq_adguard.pcapng.out +++ b/test/results/doq_adguard.pcapng.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4693498 bytes -~~ total memory freed........: 4693498 bytes -~~ total allocations/frees...: 101451/101451 +~~ total memory allocated....: 5197071 bytes +~~ total memory freed........: 5197071 bytes +~~ total allocations/frees...: 113342/113342 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 2120 chars diff --git a/test/results/dos_win98_smb_netbeui.pcap.out b/test/results/dos_win98_smb_netbeui.pcap.out index f62d5bdd4..86ab7029e 100644 --- a/test/results/dos_win98_smb_netbeui.pcap.out +++ b/test/results/dos_win98_smb_netbeui.pcap.out @@ -347,9 +347,9 @@ ~~ total active/idle flows...: 4/4 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4683924 bytes -~~ total memory freed........: 4683924 bytes -~~ total allocations/frees...: 101214/101214 +~~ total memory allocated....: 5182831 bytes +~~ total memory freed........: 5182831 bytes +~~ total allocations/frees...: 113096/113096 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 200 chars ~~ json string max len.......: 1903 chars diff --git a/test/results/drda_db2.pcap.out b/test/results/drda_db2.pcap.out index ab6b64943..f3d1fc16f 100644 --- a/test/results/drda_db2.pcap.out +++ b/test/results/drda_db2.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682660 bytes -~~ total memory freed........: 4682660 bytes -~~ total allocations/frees...: 101182/101182 +~~ total memory allocated....: 5181567 bytes +~~ total memory freed........: 5181567 bytes +~~ total allocations/frees...: 113064/113064 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 457 chars ~~ json string max len.......: 692 chars diff --git a/test/results/dropbox.pcap.out b/test/results/dropbox.pcap.out index 871d39362..352a4ad41 100644 --- a/test/results/dropbox.pcap.out +++ b/test/results/dropbox.pcap.out @@ -109,9 +109,9 @@ ~~ total active/idle flows...: 15/15 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4716310 bytes -~~ total memory freed........: 4716310 bytes -~~ total allocations/frees...: 102033/102033 +~~ total memory allocated....: 5215217 bytes +~~ total memory freed........: 5215217 bytes +~~ total allocations/frees...: 113915/113915 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 830 chars diff --git a/test/results/dtls.pcap.out b/test/results/dtls.pcap.out index 9ba3f19c8..563da21c5 100644 --- a/test/results/dtls.pcap.out +++ b/test/results/dtls.pcap.out @@ -14,9 +14,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679568 bytes -~~ total memory freed........: 4679568 bytes -~~ total allocations/frees...: 101145/101145 +~~ total memory allocated....: 5178475 bytes +~~ total memory freed........: 5178475 bytes +~~ total allocations/frees...: 113027/113027 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 460 chars ~~ json string max len.......: 1058 chars diff --git a/test/results/dtls2.pcap.out b/test/results/dtls2.pcap.out index 9bfb83832..8bf0df23c 100644 --- a/test/results/dtls2.pcap.out +++ b/test/results/dtls2.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680424 bytes -~~ total memory freed........: 4680424 bytes -~~ total allocations/frees...: 101175/101175 +~~ total memory allocated....: 5179331 bytes +~~ total memory freed........: 5179331 bytes +~~ total allocations/frees...: 113057/113057 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 1353 chars diff --git a/test/results/dtls_certificate.pcapng.out b/test/results/dtls_certificate.pcapng.out index 0c0bef6b0..dc2b1b1b4 100644 --- a/test/results/dtls_certificate.pcapng.out +++ b/test/results/dtls_certificate.pcapng.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4687924 bytes -~~ total memory freed........: 4687924 bytes -~~ total allocations/frees...: 101148/101148 +~~ total memory allocated....: 5186831 bytes +~~ total memory freed........: 5186831 bytes +~~ total allocations/frees...: 113030/113030 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 474 chars ~~ json string max len.......: 2405 chars diff --git a/test/results/dtls_certificate_fragments.pcap.out b/test/results/dtls_certificate_fragments.pcap.out index 0f01eadfb..ce1e843a8 100644 --- a/test/results/dtls_certificate_fragments.pcap.out +++ b/test/results/dtls_certificate_fragments.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680090 bytes -~~ total memory freed........: 4680090 bytes -~~ total allocations/frees...: 101163/101163 +~~ total memory allocated....: 5178997 bytes +~~ total memory freed........: 5178997 bytes +~~ total allocations/frees...: 113045/113045 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 482 chars ~~ json string max len.......: 1249 chars diff --git a/test/results/dtls_session_id_and_coockie_both.pcap.out b/test/results/dtls_session_id_and_coockie_both.pcap.out index d8faa3f4d..3ff9cc040 100644 --- a/test/results/dtls_session_id_and_coockie_both.pcap.out +++ b/test/results/dtls_session_id_and_coockie_both.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679626 bytes -~~ total memory freed........: 4679626 bytes -~~ total allocations/frees...: 101147/101147 +~~ total memory allocated....: 5178533 bytes +~~ total memory freed........: 5178533 bytes +~~ total allocations/frees...: 113029/113029 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 488 chars ~~ json string max len.......: 1144 chars diff --git a/test/results/encrypted_sni.pcap.out b/test/results/encrypted_sni.pcap.out index a15bf9b4f..2595b322e 100644 --- a/test/results/encrypted_sni.pcap.out +++ b/test/results/encrypted_sni.pcap.out @@ -21,9 +21,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4689366 bytes -~~ total memory freed........: 4689366 bytes -~~ total allocations/frees...: 101164/101164 +~~ total memory allocated....: 5188273 bytes +~~ total memory freed........: 5188273 bytes +~~ total allocations/frees...: 113046/113046 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 1431 chars diff --git a/test/results/esp.pcapng.out b/test/results/esp.pcapng.out new file mode 100644 index 000000000..68541aea4 --- /dev/null +++ b/test/results/esp.pcapng.out @@ -0,0 +1,29 @@ +00456{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"esp.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00542{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"esp.pcapng","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1587340723655} +00569{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"esp.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1587340723655,"flow_last_seen":1587340723655,"flow_idle_time":180000,"flow_min_l4_payload_len":358,"flow_max_l4_payload_len":358,"flow_tot_l4_payload_len":358,"flow_avg_l4_payload_len":358,"midstream":0,"thread_ts_msec":1587340723655,"l3_proto":"ip4","src_ip":"10.2.3.2","dst_ip":"10.3.4.4","src_port":500,"dst_port":500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00918{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"esp.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1587340723655,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":400,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":400,"pkt_l4_len":366,"thread_ts_msec":1587340723655,"pkt":"qrvMAAMQqrvMAAIQCABFwAGCAN8AAP8RncEKAgMCCgMEBAH0AfQBbm9jBawPTRIgE\/QAAAAAAAAAACEgIggAAAAAAAABZiIAADAAAAAsAQEABAMAAAwBAAAMgA4BAAMAAAgCAAAGAwAACAMAAA0AAAAIBAAAFCgAAGgAFAAADDsDka\/duvsZYQytelWlC6NzARHfxQ9jT\/JU2Un7NCQA+jXJ08WlF7e\/NDuPTB526R8Cb4Zuk\/QhNNiyysAyBZ0W7cfOpAFmMETkjg2lvpSaO0W743zdwZbhwL5xtEDwKwAAJBinv2eNdHZsJ29wVvPTnOU5tMnnhBtj26lK3VUpGlaPKwAAF0NJU0NPLURFTEVURS1SRUFTT04rAAATQ0lTQ09WUE4tUkVWLTAyKwAAF0NJU0NPLURZTkFNSUMtUk9VVEUpAAAVRkxFWFZQTi1TVVBQT1JURUQpAAAcAABABE++qlf\/rnDMCHdomXQhhbbCu7VdAAAAHAAAQAWxbxU4srTSjW8apuj3nZ6SyjPUCQ=="} +00915{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"esp.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1587340723662,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":400,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":400,"pkt_l4_len":366,"thread_ts_msec":1587340723662,"pkt":"qrvMAAIQqrvMAAMQCABFwAGCALsAAP4RnuUKAwQECgIDAgH0AfQBbq1OBawPTRIgE\/RfRu5wvExdDSEgIiAAAAAAAAABZiIAADAAAAAsAQEABAMAAAwBAAAMgA4BAAMAAAgCAAAGAwAACAMAAA0AAAAIBAAAFCgAAGgAFAAAeXKfqwaHkiVcMu+s4hPX5cnikVUBSUWhEvjp8uoOs40Tz5cGWTSvQJV6y1mRBbxFiQyb2IMgnjb1iZi0xKtA\/z0+EIGKekMJYxfmbb\/4xwAcTsSdkiXWBGpDjFPvtwoFKwAAJFV3ojUiOZ96AboWM1NGpIwiUnFn+cWbLdwgiG0miL+8KwAAF0NJU0NPLURFTEVURS1SRUFTT04rAAATQ0lTQ09WUE4tUkVWLTAyKwAAF0NJU0NPLURZTkFNSUMtUk9VVEUpAAAVRkxFWFZQTi1TVVBQT1JURUQpAAAcAABABM9z9pZZgKD+9ZzdamlEsYrKkUeFAAAAHAAAQAW1v1HiklqGfJbwATvaTOUm2F82pg=="} +00903{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"esp.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1587340723670,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":386,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":386,"pkt_l4_len":352,"thread_ts_msec":1587340723670,"pkt":"qrvMAAMQqrvMAAIQCABFwAF0AOAAAP8Rnc4KAgMCCgMEBAH0AfQBYJxOBawPTRIgE\/RfRu5wvExdDS4gIwgAAAABAAABWCsAATwo9kmU8gXj0EedKmJNK+VWGrNk6m7d+9Hkki0QPpJ2UQ5K8xYpTzRz1oZI364ZkaSAYAohIEiUwnprO5bmbmb9qIM0+fTiZw1DojFlouyNg03a\/0kz6o8jRJv4PqCaYhITIh\/4NKPCOB9tcYohRiSgu\/5zHv5JvWQ3XksC8IcgVNMiE\/5aFElRFljlmMpjAGXZkK5XnvWJkamx2rhcvcJAij70Uj\/oD\/j\/w0o\/c6VbgHLqoRwpcPmMvxRAwmOQ9oz2xcYWrhIQBi3xWUKWjmz+pxNn90bdNL3SDkdsODmIIBQap7G54zol1jJWQerYPntwLshRMgA0rGIBYYU+04lQqf81IAAxPlDlMj5Hwsr6MJ2wlEyY2dKouxpx9+iHwUGg8fELtW5lR77T\/2mt7GtUUmU2DqAv\/QQ="} +00536{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5,"source":"esp.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1587340725658,"flow_last_seen":1587340725658,"flow_idle_time":600000,"flow_min_l4_payload_len":132,"flow_max_l4_payload_len":132,"flow_tot_l4_payload_len":132,"flow_avg_l4_payload_len":132,"midstream":0,"thread_ts_msec":1587340725658,"l3_proto":"ip4","src_ip":"10.2.3.2","dst_ip":"10.3.4.4","l4_proto":50,"flow_datalink":1,"flow_max_packets":3} +00601{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"esp.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1587340725658,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":166,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":166,"pkt_l4_len":132,"thread_ts_msec":1587340725658,"pkt":"qrvMAAMQqrvMAAIQCABFAACYACQAAP8yoAUKAgMCCgMEBCNgsOMAAAABectfgWUl04YUbzWcC+4xd1UOV3SUluMVSc1O+uGKzjlWG3KV9r0S61l07FAMCtvDlpgFzU5YdVATZgur7sMbrkC7o3l\/upPdN3M20ENHGJg7SyVgEI8QrdTAVpl1VXAu7t+SCLVFZwaCQYUWnFFZvKSDZFqF6SACpTMBZA=="} +00586{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":5,"source":"esp.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1587340725658,"flow_last_seen":1587340725658,"flow_idle_time":600000,"flow_min_l4_payload_len":132,"flow_max_l4_payload_len":132,"flow_tot_l4_payload_len":132,"flow_avg_l4_payload_len":132,"midstream":0,"thread_ts_msec":1587340725658,"l3_proto":"ip4","src_ip":"10.2.3.2","dst_ip":"10.3.4.4","l4_proto":50,"ndpi": {"confidence": {"4":"DPI"},"proto":"IPsec","breed":"Safe","category":"VPN"}} +00603{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"esp.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1587340725659,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":166,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":166,"pkt_l4_len":132,"thread_ts_msec":1587340725659,"pkt":"qrvMAAIQqrvMAAMQCABFAACYACQAAP4yoQUKAwQECgIDAvAJLLUAAAABLX+WjVQswRpYbFeiaZdQW6eWJsw6BS2eB7OP9\/5eHwi2mYpUZ6G3t755XGwuYLanMk25K6hMBwBSxcZ\/ydNZPrrxBrySAlcBAFV4v6tDTuHpnnv89BSOnoK6gF0SG3nSCAMIxyxKQV4U+ecInNO5d\/EnrgCW7OWI7NuXZg=="} +00629{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":6,"source":"esp.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1587340723655,"flow_last_seen":1587340723676,"flow_idle_time":180000,"flow_min_l4_payload_len":296,"flow_max_l4_payload_len":358,"flow_tot_l4_payload_len":1356,"flow_avg_l4_payload_len":339,"midstream":0,"thread_ts_msec":1587340725659,"l3_proto":"ip4","src_ip":"10.2.3.2","dst_ip":"10.3.4.4","src_port":500,"dst_port":500,"l4_proto":"udp","ndpi": {"confidence": {"1":"Match by port"},"proto":"IPsec","breed":"Safe","category":"VPN"}} +00571{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6,"source":"esp.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1587340723655,"flow_last_seen":1587340723676,"flow_idle_time":180000,"flow_min_l4_payload_len":296,"flow_max_l4_payload_len":358,"flow_tot_l4_payload_len":1356,"flow_avg_l4_payload_len":339,"midstream":0,"thread_ts_msec":1587340725659,"l3_proto":"ip4","src_ip":"10.2.3.2","dst_ip":"10.3.4.4","src_port":500,"dst_port":500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00625{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6,"source":"esp.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1587340725658,"flow_last_seen":1587340725659,"flow_idle_time":600000,"flow_min_l4_payload_len":132,"flow_max_l4_payload_len":132,"flow_tot_l4_payload_len":264,"flow_avg_l4_payload_len":132,"midstream":0,"thread_ts_msec":1587340725659,"l3_proto":"ip4","src_ip":"10.2.3.2","dst_ip":"10.3.4.4","l4_proto":50,"flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"IPsec","breed":"Safe","category":"VPN"}} +00548{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":6,"source":"esp.pcapng","alias":"nDPId-test","packets-captured":6,"packets-processed":6,"total-skipped-flows":0,"total-l4-data-len":1620,"total-not-detected-flows":0,"total-guessed-flows":1,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":14,"global_ts_msec":1587340725659} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 6/6 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 1620 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 2/2 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5179463 bytes +~~ total memory freed........: 5179463 bytes +~~ total allocations/frees...: 113034/113034 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 461 chars +~~ json string max len.......: 923 chars +~~ json string avg len.......: 691 chars diff --git a/test/results/ethereum.pcap.out b/test/results/ethereum.pcap.out index bbe501173..e8dd8f2e0 100644 --- a/test/results/ethereum.pcap.out +++ b/test/results/ethereum.pcap.out @@ -438,9 +438,9 @@ ~~ total active/idle flows...: 74/74 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4917918 bytes -~~ total memory freed........: 4917918 bytes -~~ total allocations/frees...: 103417/103417 +~~ total memory allocated....: 5416825 bytes +~~ total memory freed........: 5416825 bytes +~~ total allocations/frees...: 115299/115299 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 459 chars ~~ json string max len.......: 1985 chars diff --git a/test/results/ethernetIP.pcap.out b/test/results/ethernetIP.pcap.out index 6b0e88f30..40a68e403 100644 --- a/test/results/ethernetIP.pcap.out +++ b/test/results/ethernetIP.pcap.out @@ -33,9 +33,9 @@ ~~ total active/idle flows...: 4/4 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685026 bytes -~~ total memory freed........: 4685026 bytes -~~ total allocations/frees...: 101252/101252 +~~ total memory allocated....: 5183933 bytes +~~ total memory freed........: 5183933 bytes +~~ total allocations/frees...: 113134/113134 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 458 chars ~~ json string max len.......: 2075 chars diff --git a/test/results/exe_download.pcap.out b/test/results/exe_download.pcap.out index 23c14fbca..7d0868d72 100644 --- a/test/results/exe_download.pcap.out +++ b/test/results/exe_download.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4699977 bytes -~~ total memory freed........: 4699977 bytes -~~ total allocations/frees...: 101849/101849 +~~ total memory allocated....: 5198884 bytes +~~ total memory freed........: 5198884 bytes +~~ total allocations/frees...: 113731/113731 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 459 chars ~~ json string max len.......: 1072 chars diff --git a/test/results/exe_download_as_png.pcap.out b/test/results/exe_download_as_png.pcap.out index 8a42b1ce3..04762428c 100644 --- a/test/results/exe_download_as_png.pcap.out +++ b/test/results/exe_download_as_png.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4695051 bytes -~~ total memory freed........: 4695051 bytes -~~ total allocations/frees...: 101680/101680 +~~ total memory allocated....: 5193958 bytes +~~ total memory freed........: 5193958 bytes +~~ total allocations/frees...: 113562/113562 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 466 chars ~~ json string max len.......: 1050 chars diff --git a/test/results/facebook.pcap.out b/test/results/facebook.pcap.out index 0dc526252..1f4d7629f 100644 --- a/test/results/facebook.pcap.out +++ b/test/results/facebook.pcap.out @@ -24,9 +24,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4693443 bytes -~~ total memory freed........: 4693443 bytes -~~ total allocations/frees...: 101227/101227 +~~ total memory allocated....: 5192350 bytes +~~ total memory freed........: 5192350 bytes +~~ total allocations/frees...: 113109/113109 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 1368 chars diff --git a/test/results/firefox.pcap.out b/test/results/firefox.pcap.out index e581625a1..457ac2a05 100644 --- a/test/results/firefox.pcap.out +++ b/test/results/firefox.pcap.out @@ -51,9 +51,9 @@ ~~ total active/idle flows...: 6/6 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4854115 bytes -~~ total memory freed........: 4854115 bytes -~~ total allocations/frees...: 106617/106617 +~~ total memory allocated....: 5353022 bytes +~~ total memory freed........: 5353022 bytes +~~ total allocations/frees...: 118499/118499 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 921 chars diff --git a/test/results/fix.pcap.out b/test/results/fix.pcap.out index 378f9c910..9b5b7c822 100644 --- a/test/results/fix.pcap.out +++ b/test/results/fix.pcap.out @@ -81,9 +81,9 @@ ~~ total active/idle flows...: 12/12 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4750247 bytes -~~ total memory freed........: 4750247 bytes -~~ total allocations/frees...: 102449/102449 +~~ total memory allocated....: 5249154 bytes +~~ total memory freed........: 5249154 bytes +~~ total allocations/frees...: 114331/114331 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 453 chars ~~ json string max len.......: 676 chars diff --git a/test/results/fix2.pcap.out b/test/results/fix2.pcap.out new file mode 100644 index 000000000..6e5b08a04 --- /dev/null +++ b/test/results/fix2.pcap.out @@ -0,0 +1,30 @@ +00455{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"fix2.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00541{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"fix2.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1614758889587} +00568{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4,"source":"fix2.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1614758889588,"flow_last_seen":1614758889588,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1614758889588,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":34962,"dst_port":1024,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"fix2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1614758889588,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614758889588,"pkt":"5kBKB+riApXG95NLCABFAAAweTwAAIAGAAAKZQACCmYAAoiSBAAt1D8pAAAAAHACgAEU8QAAAgQFtAMDAQA="} +00568{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5,"source":"fix2.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1614758889589,"flow_last_seen":1614758889589,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1614758889589,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.9","src_port":34963,"dst_port":1024,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"fix2.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1614758889589,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614758889589,"pkt":"5kBKB+riApXG95NLCABFAAAweT0AAIAGAAAKZQACCmYACYiTBAAt1EIqAAAAAHACgAEU+AAAAgQFtAMDAQA="} +00458{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"fix2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1614758889589,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614758889589,"pkt":"WgXZu6TVApXG95WRCABFAAAweT4AAIAGrLsKZgACCmUAAgQAiJIt1EL8LdQ\/KnASgAGE3gAAAgQFtAMDAQA="} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"fix2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1614758889589,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_msec":1614758889589,"pkt":"5kBKB+riApXG95NLCABFAAAoeT4AAIAGAAAKZQACCmYAAoiSBAAt1D8qLdRC\/VAQgAEU6QAAAAAAAAAA"} +00619{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"fix2.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1614758889588,"flow_last_seen":1614758889589,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":85,"flow_tot_l4_payload_len":85,"flow_avg_l4_payload_len":21,"midstream":0,"thread_ts_msec":1614758889589,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":34962,"dst_port":1024,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"FIX","breed":"Safe","category":"RPC"}} +00458{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"fix2.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1614758889589,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1614758889589,"pkt":"WgXZu6TVApXG95WRCABFAAAweT8AAIAGrLMKZgAJCmUAAgQAiJMt1EWWLdRCK3ASgAF\/OwAAAgQFtAMDAQA="} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"fix2.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1614758889589,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_msec":1614758889589,"pkt":"5kBKB+riApXG95NLCABFAAAoeUAAAIAGAAAKZQACCmYACYiTBAAt1EIrLdRFl1AQgAEU8AAAAAAAAAAA"} +00620{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"fix2.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1614758889589,"flow_last_seen":1614758889589,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":85,"flow_tot_l4_payload_len":85,"flow_avg_l4_payload_len":21,"midstream":0,"thread_ts_msec":1614758889589,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.9","src_port":34963,"dst_port":1024,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"FIX","breed":"Safe","category":"RPC"}} +00667{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3049,"source":"fix2.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":1987,"flow_first_seen":1614758889588,"flow_last_seen":1614758889595,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":120,"flow_tot_l4_payload_len":39543,"flow_avg_l4_payload_len":19,"midstream":0,"thread_ts_msec":1614758889595,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":34962,"dst_port":1024,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"FIX","breed":"Safe","category":"RPC"}} +00667{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3049,"source":"fix2.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":1059,"flow_first_seen":1614758889589,"flow_last_seen":1614758889595,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":120,"flow_tot_l4_payload_len":28413,"flow_avg_l4_payload_len":26,"midstream":0,"thread_ts_msec":1614758889595,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.9","src_port":34963,"dst_port":1024,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"FIX","breed":"Safe","category":"RPC"}} +00557{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":3049,"source":"fix2.pcap","alias":"nDPId-test","packets-captured":3049,"packets-processed":3046,"total-skipped-flows":0,"total-l4-data-len":67956,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":15,"global_ts_msec":1614758889595} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 3049/3046 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 67956 bytes +~~ total detected protocols..: 2 +~~ total active/idle flows...: 2/2 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5271719 bytes +~~ total memory freed........: 5271719 bytes +~~ total allocations/frees...: 116076/116076 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 459 chars +~~ json string max len.......: 672 chars +~~ json string avg len.......: 561 chars diff --git a/test/results/forticlient.pcap.out b/test/results/forticlient.pcap.out index 9093b6a3b..70e857474 100644 --- a/test/results/forticlient.pcap.out +++ b/test/results/forticlient.pcap.out @@ -49,9 +49,9 @@ ~~ total active/idle flows...: 5/5 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4772071 bytes -~~ total memory freed........: 4772071 bytes -~~ total allocations/frees...: 103178/103178 +~~ total memory allocated....: 5270978 bytes +~~ total memory freed........: 5270978 bytes +~~ total allocations/frees...: 115060/115060 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 467 chars ~~ json string max len.......: 1479 chars diff --git a/test/results/ftp-start-tls.pcap.out b/test/results/ftp-start-tls.pcap.out index 1197b693f..a32b4305c 100644 --- a/test/results/ftp-start-tls.pcap.out +++ b/test/results/ftp-start-tls.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4683037 bytes -~~ total memory freed........: 4683037 bytes -~~ total allocations/frees...: 101195/101195 +~~ total memory allocated....: 5181944 bytes +~~ total memory freed........: 5181944 bytes +~~ total allocations/frees...: 113077/113077 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 467 chars ~~ json string max len.......: 821 chars diff --git a/test/results/ftp.pcap.out b/test/results/ftp.pcap.out index 0cfa2c858..3f35a85a5 100644 --- a/test/results/ftp.pcap.out +++ b/test/results/ftp.pcap.out @@ -27,9 +27,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4721966 bytes -~~ total memory freed........: 4721966 bytes -~~ total allocations/frees...: 102344/102344 +~~ total memory allocated....: 5220873 bytes +~~ total memory freed........: 5220873 bytes +~~ total allocations/frees...: 114226/114226 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 459 chars ~~ json string max len.......: 831 chars diff --git a/test/results/ftp_failed.pcap.out b/test/results/ftp_failed.pcap.out index 436bf87ca..86588df82 100644 --- a/test/results/ftp_failed.pcap.out +++ b/test/results/ftp_failed.pcap.out @@ -4,21 +4,21 @@ 00510{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"ftp_failed.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1574361625864,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":94,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":94,"pkt_l4_len":40,"thread_ts_msec":1574361625864,"pkt":"9LUv\/K\/wZABqYzXMht1gC5eXACgGQCoADUAAAQADAZIAEgGTABEqAAgAEBAAAAAAAAAAAAABrrQAFZk3QbUAAAAAoAJwgHzLAAACBAWgBAIICpYFXqIAAAAAAQMDBw=="} 00512{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"ftp_failed.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1574361625878,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":94,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":94,"pkt_l4_len":40,"thread_ts_msec":1574361625878,"pkt":"ZABqYzXM9LUv\/K\/wht1gC1mOACgGOioACAAQEAAAAAAAAAAAAAEqAA1AAAEAAwGSABIBkwARABWutHAVBmyZN0G2oBL\/\/zbpAAACBAWgBAIIClbTSMOWBV6iAQMDDg=="} 00498{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"ftp_failed.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1574361625878,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"thread_ts_msec":1574361625878,"pkt":"9LUv\/K\/wZABqYzXMht1gC5eXACAGQCoADUAAAQADAZIAEgGTABEqAAgAEBAAAAAAAAAAAAABrrQAFZk3QbZwFQZtgBAA4XzDAAABAQgKlgVesFbTSMM="} -00844{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":18,"source":"ftp_failed.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":18,"flow_first_seen":1574361625864,"flow_last_seen":1574361633102,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":136,"flow_avg_l4_payload_len":7,"midstream":0,"thread_ts_msec":1574361633102,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:192:12:193:11","dst_ip":"2a00:800:1010::1","src_port":44724,"dst_port":21,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"1":"Match by port"},"proto":"FTP_CONTROL","breed":"Unsafe","category":"Download"},"ftp": {"user":"hello","password":"","auth_failed":1}} -00599{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":18,"source":"ftp_failed.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":18,"flow_first_seen":1574361625864,"flow_last_seen":1574361633102,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":136,"flow_avg_l4_payload_len":7,"midstream":0,"thread_ts_msec":1574361633102,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:192:12:193:11","dst_ip":"2a00:800:1010::1","src_port":44724,"dst_port":21,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} -00554{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":18,"source":"ftp_failed.pcap","alias":"nDPId-test","packets-captured":18,"packets-processed":18,"total-skipped-flows":0,"total-l4-data-len":136,"total-not-detected-flows":0,"total-guessed-flows":1,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1574361633102} +00832{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"ftp_failed.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":1574361625864,"flow_last_seen":1574361631296,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":9,"midstream":0,"thread_ts_msec":1574361631296,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:192:12:193:11","dst_ip":"2a00:800:1010::1","src_port":44724,"dst_port":21,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"FTP_CONTROL","breed":"Unsafe","category":"Download"},"ftp": {"user":"hello","password":"","auth_failed":1}} +00819{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":18,"source":"ftp_failed.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":18,"flow_first_seen":1574361625864,"flow_last_seen":1574361633102,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":136,"flow_avg_l4_payload_len":7,"midstream":0,"thread_ts_msec":1574361633102,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:192:12:193:11","dst_ip":"2a00:800:1010::1","src_port":44724,"dst_port":21,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"FTP_CONTROL","breed":"Unsafe","category":"Download"}} +00554{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":18,"source":"ftp_failed.pcap","alias":"nDPId-test","packets-captured":18,"packets-processed":18,"total-skipped-flows":0,"total-l4-data-len":136,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1574361633102} ~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ ~~ packets captured/processed: 18/18 ~~ skipped flows.............: 0 ~~ total layer4 data length..: 136 bytes -~~ total detected protocols..: 0 +~~ total detected protocols..: 1 ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682080 bytes -~~ total memory freed........: 4682080 bytes -~~ total allocations/frees...: 101162/101162 +~~ total memory allocated....: 5180987 bytes +~~ total memory freed........: 5180987 bytes +~~ total allocations/frees...: 113044/113044 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 466 chars -~~ json string max len.......: 849 chars -~~ json string avg len.......: 640 chars +~~ json string max len.......: 837 chars +~~ json string avg len.......: 634 chars diff --git a/test/results/fuzz-2006-06-26-2594.pcap.out b/test/results/fuzz-2006-06-26-2594.pcap.out index b3e3410a4..b6213131b 100644 --- a/test/results/fuzz-2006-06-26-2594.pcap.out +++ b/test/results/fuzz-2006-06-26-2594.pcap.out @@ -1441,9 +1441,9 @@ ~~ total active/idle flows...: 249/249 ~~ total timeout flows.......: 28 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4938456 bytes -~~ total memory freed........: 4938456 bytes -~~ total allocations/frees...: 102454/102454 +~~ total memory allocated....: 5437363 bytes +~~ total memory freed........: 5437363 bytes +~~ total allocations/frees...: 114336/114336 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 200 chars ~~ json string max len.......: 1897 chars diff --git a/test/results/fuzz-2006-09-29-28586.pcap.out b/test/results/fuzz-2006-09-29-28586.pcap.out index 2d6caffff..33e460250 100644 --- a/test/results/fuzz-2006-09-29-28586.pcap.out +++ b/test/results/fuzz-2006-09-29-28586.pcap.out @@ -212,9 +212,9 @@ ~~ total active/idle flows...: 38/38 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4736026 bytes -~~ total memory freed........: 4736026 bytes -~~ total allocations/frees...: 101394/101394 +~~ total memory allocated....: 5234933 bytes +~~ total memory freed........: 5234933 bytes +~~ total allocations/frees...: 113276/113276 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 201 chars ~~ json string max len.......: 2426 chars diff --git a/test/results/fuzz-2020-02-16-11740.pcap.out b/test/results/fuzz-2020-02-16-11740.pcap.out index 4fea17463..1703f248d 100644 --- a/test/results/fuzz-2020-02-16-11740.pcap.out +++ b/test/results/fuzz-2020-02-16-11740.pcap.out @@ -490,9 +490,9 @@ ~~ total active/idle flows...: 79/79 ~~ total timeout flows.......: 16 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4756197 bytes -~~ total memory freed........: 4756197 bytes -~~ total allocations/frees...: 101676/101676 +~~ total memory allocated....: 5255104 bytes +~~ total memory freed........: 5255104 bytes +~~ total allocations/frees...: 113558/113558 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 201 chars ~~ json string max len.......: 1566 chars diff --git a/test/results/fuzz-2021-06-07-c6c72a0a56.pcap.out b/test/results/fuzz-2021-06-07-c6c72a0a56.pcap.out index 82dbbe178..b56480211 100644 --- a/test/results/fuzz-2021-06-07-c6c72a0a56.pcap.out +++ b/test/results/fuzz-2021-06-07-c6c72a0a56.pcap.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 0/0 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4678638 bytes -~~ total memory freed........: 4678638 bytes -~~ total allocations/frees...: 101140/101140 +~~ total memory allocated....: 5177545 bytes +~~ total memory freed........: 5177545 bytes +~~ total allocations/frees...: 113022/113022 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 229 chars ~~ json string max len.......: 574 chars diff --git a/test/results/fuzz-2021-10-13.pcap.out b/test/results/fuzz-2021-10-13.pcap.out index ce1cd4d58..2cf6b36ee 100644 --- a/test/results/fuzz-2021-10-13.pcap.out +++ b/test/results/fuzz-2021-10-13.pcap.out @@ -11,9 +11,9 @@ ~~ total active/idle flows...: 0/0 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4678638 bytes -~~ total memory freed........: 4678638 bytes -~~ total allocations/frees...: 101140/101140 +~~ total memory allocated....: 5177545 bytes +~~ total memory freed........: 5177545 bytes +~~ total allocations/frees...: 113022/113022 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 208 chars ~~ json string max len.......: 558 chars diff --git a/test/results/genshin-impact.pcap.out b/test/results/genshin-impact.pcap.out index 478bafa23..6ce7a462a 100644 --- a/test/results/genshin-impact.pcap.out +++ b/test/results/genshin-impact.pcap.out @@ -29,9 +29,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682559 bytes -~~ total memory freed........: 4682559 bytes -~~ total allocations/frees...: 101194/101194 +~~ total memory allocated....: 5181466 bytes +~~ total memory freed........: 5181466 bytes +~~ total allocations/frees...: 113076/113076 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 470 chars ~~ json string max len.......: 837 chars diff --git a/test/results/git.pcap.out b/test/results/git.pcap.out index 12f95bfeb..8ee34d26d 100644 --- a/test/results/git.pcap.out +++ b/test/results/git.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682120 bytes -~~ total memory freed........: 4682120 bytes -~~ total allocations/frees...: 101233/101233 +~~ total memory allocated....: 5181027 bytes +~~ total memory freed........: 5181027 bytes +~~ total allocations/frees...: 113115/113115 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 459 chars ~~ json string max len.......: 683 chars diff --git a/test/results/gnutella.pcap.out b/test/results/gnutella.pcap.out new file mode 100644 index 000000000..572e3c6dc --- /dev/null +++ b/test/results/gnutella.pcap.out @@ -0,0 +1,4266 @@ +00459{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"gnutella.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00174{"error_event_id":4,"error_event_name":"Packet too short","datalink":1,"packet_id":1,"source":"gnutella.pcap","alias":"nDPId-test","size":4,"expected":14,"global_ts_msec":0} +00259{"packet_event_id":1,"packet_event_name":"packet","packet_id":1,"source":"gnutella.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":4,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":4,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"AAAAAA=="} +00516{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":120000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ffa4:e108","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":9752,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":78,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":78,"pkt_l4_len":24,"thread_ts_msec":9752,"pkt":"MzP\/pOEICAAn5uVZht1gAAAAABg6\/wAAAAAAAAAAAAAAAAAAAAD\/AgAAAAAAAAAAAAH\/pOEIhwAMIAAAAAD+gAAAAAAAAMUNUZ+WpOEI"} +00577{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":120000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ffa4:e108","l4_proto":"icmp6","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}} +00525{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":120000,"flow_min_l4_payload_len":8,"flow_max_l4_payload_len":8,"flow_tot_l4_payload_len":8,"flow_avg_l4_payload_len":8,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3} +00445{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":9752,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":62,"pkt_l4_len":8,"thread_ts_msec":9752,"pkt":"MzMAAAACCAAn5uVZht1gAAAAAAg6\/\/6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAChQDu3AAAAAA="} +00586{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":120000,"flow_min_l4_payload_len":8,"flow_max_l4_payload_len":8,"flow_tot_l4_payload_len":8,"flow_avg_l4_payload_len":8,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::2","l4_proto":"icmp6","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}} +00530{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":120000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3} +00482{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":9752,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":62,"pkt_len":90,"pkt_l4_len":28,"thread_ts_msec":9752,"pkt":"MzMAAAAWCAAn5uVZht1gAAAAACQAAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAWOgAFAgAAAQCPAAECAAAAAQQAAAD\/AgAAAAAAAAAAAAH\/pOEI"} +00591{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":120000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":9752,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":10250,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":62,"pkt_len":90,"pkt_l4_len":28,"thread_ts_msec":10250,"pkt":"MzMAAAAWCAAn5uVZht1gAAAAACQAAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAWOgAFAgAAAQCPAAECAAAAAQQAAAD\/AgAAAAAAAAAAAAH\/pOEI"} +00532{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":10750,"flow_last_seen":10750,"flow_idle_time":120000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":10750,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_last_seen":10750,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"thread_ts_msec":10750,"pkt":"MzMAAAABCAAn5uVZht1gAAAAACA6\/\/6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAABiAAnqSAAAAD+gAAAAAAAAMUNUZ+WpOEIAgEIACfm5Vk="} +00593{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":10750,"flow_last_seen":10750,"flow_idle_time":120000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":10750,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1","l4_proto":"icmp6","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}} +00552{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12446,"flow_last_seen":12446,"flow_idle_time":180000,"flow_min_l4_payload_len":314,"flow_max_l4_payload_len":314,"flow_tot_l4_payload_len":314,"flow_avg_l4_payload_len":314,"midstream":0,"thread_ts_msec":12446,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00853{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_last_seen":12446,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":356,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":356,"pkt_l4_len":322,"thread_ts_msec":12446,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAAFWW8sAAIAR3cwAAAAA\/\/\/\/\/wBEAEMBQgLkAQEGAKZ4S30AAAAAAAAAAAAAAAAAAAAAAAAAAAgAJ+blWQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEDPQcBCAAn5uVZMgQKAAIPDAtNU0VER0VXSU4xMFEOAAAATVNFREdFV0lOMTA8CE1TRlQgNS4wNw4BAwYPHyErLC4vd3n5\/P8="} +00718{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12446,"flow_last_seen":12446,"flow_idle_time":180000,"flow_min_l4_payload_len":314,"flow_max_l4_payload_len":314,"flow_tot_l4_payload_len":314,"flow_avg_l4_payload_len":314,"midstream":0,"thread_ts_msec":12446,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"hostname":"msedgewin10","fingerprint":"1,3,6,15,31,33,43,44,46,47,119","class_ident":"MSFT 5.0"}} +00547{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":8,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12447,"flow_last_seen":12447,"flow_idle_time":180000,"flow_min_l4_payload_len":548,"flow_max_l4_payload_len":548,"flow_tot_l4_payload_len":548,"flow_avg_l4_payload_len":548,"midstream":0,"thread_ts_msec":12447,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","src_port":67,"dst_port":68,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +01155{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_last_seen":12447,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"thread_ts_msec":12447,"pkt":"CAAn5uVZUlQAEjUCCABFEAJAAAAAAEARYI0KAAICCgACDwBDAEQCLAYSAgEGAKZ4S30AAAAACgACDwoAAg8KAAIEAAAAAAgAJ+blWQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATVNFZGdlIC0gV2luMTAucHhlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEFAQT\/\/\/8AAwQKAAICBgQKAAIDDwNsYW4zBAABUYA2BAoAAgL\/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="} +00664{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12447,"flow_last_seen":12447,"flow_idle_time":180000,"flow_min_l4_payload_len":548,"flow_max_l4_payload_len":548,"flow_tot_l4_payload_len":548,"flow_avg_l4_payload_len":548,"midstream":0,"thread_ts_msec":12447,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","src_port":67,"dst_port":68,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"hostname":"","fingerprint":"","class_ident":""}} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":9,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12461,"flow_last_seen":12461,"flow_idle_time":180000,"flow_min_l4_payload_len":91,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":91,"flow_avg_l4_payload_len":91,"midstream":0,"thread_ts_msec":12461,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00568{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_last_seen":12461,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":153,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":153,"pkt_l4_len":99,"thread_ts_msec":12461,"pkt":"MzMAAQACCAAn5uVZht1gDPpkAGMRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQACAiICIwBj3RcBE9HtAAgAAgAAAAEADgABAAEkIvGzCAAn5uVZAAMADAUIACcAAAAAAAAAAAAnAA0AC01TRURHRVdJTjEwABAADgAAATcACE1TRlQgNS4wAAYACAARABcAGAAn"} +00623{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":9,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12461,"flow_last_seen":12461,"flow_idle_time":180000,"flow_min_l4_payload_len":91,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":91,"flow_avg_l4_payload_len":91,"midstream":0,"thread_ts_msec":12461,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"DHCPV6","breed":"Acceptable","category":"Network"}} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_last_seen":12512,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":62,"pkt_len":90,"pkt_l4_len":28,"thread_ts_msec":12512,"pkt":"MzMAAAAWCAAn5uVZht1gAAAAACQAAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAWOgAFAgAAAQCPAOC1AAAAAQQAAAD\/AgAAAAAAAAAAAAAAAAD7"} +00514{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":11,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12513,"flow_last_seen":12513,"flow_idle_time":600000,"flow_min_l4_payload_len":16,"flow_max_l4_payload_len":16,"flow_tot_l4_payload_len":16,"flow_avg_l4_payload_len":16,"midstream":0,"thread_ts_msec":12513,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":3} +00433{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_last_seen":12513,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"thread_ts_msec":12513,"pkt":"AQBeAAAWCAAn5uVZCABGAAAoICwAAAECGH8KAAIP4AAAFpQEAAAiAPkCAAAAAQQAAADgAAD7"} +00573{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12513,"flow_last_seen":12513,"flow_idle_time":600000,"flow_min_l4_payload_len":16,"flow_max_l4_payload_len":16,"flow_tot_l4_payload_len":16,"flow_avg_l4_payload_len":16,"midstream":0,"thread_ts_msec":12513,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.22","l4_proto":2,"ndpi": {"confidence": {"4":"DPI"},"proto":"IGMP","breed":"Acceptable","category":"Network"}} +00433{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_last_seen":12524,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"thread_ts_msec":12524,"pkt":"AQBeAAAWCAAn5uVZCABGAAAoIC0AAAECGH4KAAIP4AAAFpQEAAAiAPkBAAAAAQQAAADgAAD8"} +00433{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":3,"flow_last_seen":12527,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"thread_ts_msec":12527,"pkt":"AQBeAAAWCAAn5uVZCABGAAAoIC4AAAECGH0KAAIP4AAAFpQEAAAiAPoBAAAAAQMAAADgAAD8"} +00551{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":18,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":180000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00468{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_last_seen":12529,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"thread_ts_msec":12529,"pkt":"AQBeAAD7CAAn5uVZCABFAAA\/aF0AAAERZEcKAAIP4AAA+xTpFOkAK6\/OAAAAAAABAAAAAAAAC01TRURHRVdJTjEwBWxvY2FsAAD\/AAE="} +00649{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":18,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":180000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"msedgewin10.local"}} +00565{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":19,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":180000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00496{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_last_seen":12529,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":97,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":97,"pkt_l4_len":43,"thread_ts_msec":12529,"pkt":"MzMAAAD7CAAn5uVZht1gATieACsRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAD7FOkU6QArEAAAAAAAAAEAAAAAAAALTVNFREdFV0lOMTAFbG9jYWwAAP8AAQ=="} +00663{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":19,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":180000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"msedgewin10.local"}} +00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":20,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":180000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":63717,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_last_seen":12529,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":91,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":91,"pkt_l4_len":37,"thread_ts_msec":12529,"pkt":"MzMAAQADCAAn5uVZht1gD+kJACURAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQAD+OUU6wAl\/+MDXAAAAAEAAAAAAAALTVNFREdFV0lOMTAAAP8AAQ=="} +00627{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":20,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":180000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":63717,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}} +00519{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_last_seen":12529,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":115,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":115,"pkt_l4_len":81,"thread_ts_msec":12529,"pkt":"AQBeAAD7CAAn5uVZCABFAABlaF4AAAERZCAKAAIP4AAA+xTpFOkAUYkoAACEAAAAAAIAAAAAC01TRURHRVdJTjEwBWxvY2FsAAAcAAEAAAA8ABD+gAAAAAAAAMUNUZ+WpOEIwAwAAQABAAAAPAAECgACDw=="} +00658{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":21,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":180000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":108,"flow_avg_l4_payload_len":54,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"msedgewin10.local"}} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":22,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":180000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":63717,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00460{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_last_seen":12529,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"thread_ts_msec":12529,"pkt":"AQBeAAD8CAAn5uVZCABFAAA5pMYAAAERJ+MKAAIP4AAA\/PjlFOsAJZ66A1wAAAABAAAAAAAAC01TRURHRVdJTjEwAAD\/AAE="} +00613{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":22,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":180000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":12529,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":63717,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}} +00546{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_last_seen":12530,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":135,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":135,"pkt_l4_len":81,"thread_ts_msec":12530,"pkt":"MzMAAAD7CAAn5uVZht1gATieAFERAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAD7FOkU6QBR6VkAAIQAAAAAAgAAAAALTVNFREdFV0lOMTAFbG9jYWwAABwAAQAAADwAEP6AAAAAAAAAxQ1Rn5ak4QjADAABAAEAAAA8AAQKAAIP"} +00672{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":23,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":12529,"flow_last_seen":12530,"flow_idle_time":180000,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":108,"flow_avg_l4_payload_len":54,"midstream":0,"thread_ts_msec":12530,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"msedgewin10.local"}} +00549{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":33,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12827,"flow_last_seen":12827,"flow_idle_time":180000,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":68,"flow_avg_l4_payload_len":68,"midstream":0,"thread_ts_msec":12827,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00521{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":33,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_last_seen":12827,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":110,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":110,"pkt_l4_len":76,"thread_ts_msec":12827,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAABgHOwAAIARBJQKAAIPCgAC\/wCJAIkATEdqnCkpEAABAAAAAAABIEVORkRFRkVFRUhFRkZIRUpFT0RCREFDQUNBQ0FDQUFBAAAgAAHADAAgAAEABJPgAAYAAAoAAg8="} +00610{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":33,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":12827,"flow_last_seen":12827,"flow_idle_time":180000,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":68,"flow_avg_l4_payload_len":68,"midstream":0,"thread_ts_msec":12827,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":137,"dst_port":137,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"NetBIOS","breed":"Acceptable","category":"System"}} +00521{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_last_seen":12827,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":110,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":110,"pkt_l4_len":76,"thread_ts_msec":12827,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAABgHO0AAIARBJMKAAIPCgAC\/wCJAIkATMtnnCopEAABAAAAAAABIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUFBAAAgAAHADAAgAAEABJPgAAaAAAoAAg8="} +00573{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":37,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":13118,"flow_last_seen":13118,"flow_idle_time":180000,"flow_min_l4_payload_len":1091,"flow_max_l4_payload_len":1091,"flow_tot_l4_payload_len":1091,"flow_avg_l4_payload_len":1091,"midstream":0,"thread_ts_msec":13118,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +01911{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":37,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_last_seen":13118,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1153,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1153,"pkt_l4_len":1099,"thread_ts_msec":13118,"pkt":"MzMAAAAMCAAn5uVZht1gB0PFBEsRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dYOdgRLOdU8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiIHhtbG5zOndzZHA9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDYvMDIvZGV2cHJvZiIgeG1sbnM6cHViPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvcHViLzIwMDUvMDciPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvSGVsbG88L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6YWMzNzRhY2YtOTJhYi00YWY1LWJkZDEtOTQ5ODVkYWViNDA3PC93c2E6TWVzc2FnZUlEPjx3c2Q6QXBwU2VxdWVuY2UgSW5zdGFuY2VJZD0iNDYiIFNlcXVlbmNlSWQ9InVybjp1dWlkOjc2NzM4OWUwLWVlOWEtNGMxYy1iOTAyLTIwY2I4MWQyMDNlMCIgTWVzc2FnZU51bWJlcj0iMSI+PC93c2Q6QXBwU2VxdWVuY2U+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6SGVsbG8+PHdzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NhOkFkZHJlc3M+dXJuOnV1aWQ6NzQ3ZjNkOTYtNjhhNy00M2YxLThjYmUtZThkNmRhZGQwMzU4PC93c2E6QWRkcmVzcz48L3dzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NkOlR5cGVzPndzZHA6RGV2aWNlIHB1YjpDb21wdXRlcjwvd3NkOlR5cGVzPjx3c2Q6WEFkZHJzPmh0dHA6Ly9bZmU4MDo6YzUwZDo1MTlmOjk2YTQ6ZTEwOF06NTM1Ny83NDdmM2Q5Ni02OGE3LTQzZjEtOGNiZS1lOGQ2ZGFkZDAzNTgvPC93c2Q6WEFkZHJzPjx3c2Q6TWV0YWRhdGFWZXJzaW9uPjI8L3dzZDpNZXRhZGF0YVZlcnNpb24+PC93c2Q6SGVsbG8+PC9zb2FwOkJvZHk+PC9zb2FwOkVudmVsb3BlPg=="} +00631{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":37,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":13118,"flow_last_seen":13118,"flow_idle_time":180000,"flow_min_l4_payload_len":1091,"flow_max_l4_payload_len":1091,"flow_tot_l4_payload_len":1091,"flow_avg_l4_payload_len":1091,"midstream":0,"thread_ts_msec":13118,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} +00565{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":38,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":13118,"flow_last_seen":13118,"flow_idle_time":180000,"flow_min_l4_payload_len":1073,"flow_max_l4_payload_len":1073,"flow_tot_l4_payload_len":1073,"flow_avg_l4_payload_len":1073,"midstream":0,"thread_ts_msec":13118,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +01861{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":38,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_last_seen":13118,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1115,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1115,"pkt_l4_len":1081,"thread_ts_msec":13118,"pkt":"AQBef\/\/6CAAn5uVZCABFAARN4IUAAAER2REKAAIP7\/\/\/+vnVDnYEOdZOPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5IiB4bWxuczp3c2RwPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA2LzAyL2RldnByb2YiIHhtbG5zOnB1Yj0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93aW5kb3dzL3B1Yi8yMDA1LzA3Ij48c29hcDpIZWFkZXI+PHdzYTpUbz51cm46c2NoZW1hcy14bWxzb2FwLW9yZzp3czoyMDA1OjA0OmRpc2NvdmVyeTwvd3NhOlRvPjx3c2E6QWN0aW9uPmh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5L0hlbGxvPC93c2E6QWN0aW9uPjx3c2E6TWVzc2FnZUlEPnVybjp1dWlkOmZhMTdjZDkwLThmMzktNGY1Yi05ZTI4LWJmZjA4ZmI1Y2QwZTwvd3NhOk1lc3NhZ2VJRD48d3NkOkFwcFNlcXVlbmNlIEluc3RhbmNlSWQ9IjQ2IiBTZXF1ZW5jZUlkPSJ1cm46dXVpZDo3NjczODllMC1lZTlhLTRjMWMtYjkwMi0yMGNiODFkMjAzZTAiIE1lc3NhZ2VOdW1iZXI9IjEiPjwvd3NkOkFwcFNlcXVlbmNlPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOkhlbGxvPjx3c2E6RW5kcG9pbnRSZWZlcmVuY2U+PHdzYTpBZGRyZXNzPnVybjp1dWlkOjc0N2YzZDk2LTY4YTctNDNmMS04Y2JlLWU4ZDZkYWRkMDM1ODwvd3NhOkFkZHJlc3M+PC93c2E6RW5kcG9pbnRSZWZlcmVuY2U+PHdzZDpUeXBlcz53c2RwOkRldmljZSBwdWI6Q29tcHV0ZXI8L3dzZDpUeXBlcz48d3NkOlhBZGRycz5odHRwOi8vMTAuMC4yLjE1OjUzNTcvNzQ3ZjNkOTYtNjhhNy00M2YxLThjYmUtZThkNmRhZGQwMzU4Lzwvd3NkOlhBZGRycz48d3NkOk1ldGFkYXRhVmVyc2lvbj4yPC93c2Q6TWV0YWRhdGFWZXJzaW9uPjwvd3NkOkhlbGxvPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="} +00623{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":38,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":13118,"flow_last_seen":13118,"flow_idle_time":180000,"flow_min_l4_payload_len":1073,"flow_max_l4_payload_len":1073,"flow_tot_l4_payload_len":1073,"flow_avg_l4_payload_len":1073,"midstream":0,"thread_ts_msec":13118,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} +01861{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":41,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_last_seen":13322,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1115,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1115,"pkt_l4_len":1081,"thread_ts_msec":13322,"pkt":"AQBef\/\/6CAAn5uVZCABFAARN4IYAAAER2RAKAAIP7\/\/\/+vnVDnYEOdZOPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5IiB4bWxuczp3c2RwPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA2LzAyL2RldnByb2YiIHhtbG5zOnB1Yj0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93aW5kb3dzL3B1Yi8yMDA1LzA3Ij48c29hcDpIZWFkZXI+PHdzYTpUbz51cm46c2NoZW1hcy14bWxzb2FwLW9yZzp3czoyMDA1OjA0OmRpc2NvdmVyeTwvd3NhOlRvPjx3c2E6QWN0aW9uPmh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5L0hlbGxvPC93c2E6QWN0aW9uPjx3c2E6TWVzc2FnZUlEPnVybjp1dWlkOmZhMTdjZDkwLThmMzktNGY1Yi05ZTI4LWJmZjA4ZmI1Y2QwZTwvd3NhOk1lc3NhZ2VJRD48d3NkOkFwcFNlcXVlbmNlIEluc3RhbmNlSWQ9IjQ2IiBTZXF1ZW5jZUlkPSJ1cm46dXVpZDo3NjczODllMC1lZTlhLTRjMWMtYjkwMi0yMGNiODFkMjAzZTAiIE1lc3NhZ2VOdW1iZXI9IjEiPjwvd3NkOkFwcFNlcXVlbmNlPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOkhlbGxvPjx3c2E6RW5kcG9pbnRSZWZlcmVuY2U+PHdzYTpBZGRyZXNzPnVybjp1dWlkOjc0N2YzZDk2LTY4YTctNDNmMS04Y2JlLWU4ZDZkYWRkMDM1ODwvd3NhOkFkZHJlc3M+PC93c2E6RW5kcG9pbnRSZWZlcmVuY2U+PHdzZDpUeXBlcz53c2RwOkRldmljZSBwdWI6Q29tcHV0ZXI8L3dzZDpUeXBlcz48d3NkOlhBZGRycz5odHRwOi8vMTAuMC4yLjE1OjUzNTcvNzQ3ZjNkOTYtNjhhNy00M2YxLThjYmUtZThkNmRhZGQwMzU4Lzwvd3NkOlhBZGRycz48d3NkOk1ldGFkYXRhVmVyc2lvbj4yPC93c2Q6TWV0YWRhdGFWZXJzaW9uPjwvd3NkOkhlbGxvPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="} +01911{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":42,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_last_seen":13322,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1153,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1153,"pkt_l4_len":1099,"thread_ts_msec":13322,"pkt":"MzMAAAAMCAAn5uVZht1gB0PFBEsRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dYOdgRLOdU8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiIHhtbG5zOndzZHA9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDYvMDIvZGV2cHJvZiIgeG1sbnM6cHViPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvcHViLzIwMDUvMDciPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvSGVsbG88L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6YWMzNzRhY2YtOTJhYi00YWY1LWJkZDEtOTQ5ODVkYWViNDA3PC93c2E6TWVzc2FnZUlEPjx3c2Q6QXBwU2VxdWVuY2UgSW5zdGFuY2VJZD0iNDYiIFNlcXVlbmNlSWQ9InVybjp1dWlkOjc2NzM4OWUwLWVlOWEtNGMxYy1iOTAyLTIwY2I4MWQyMDNlMCIgTWVzc2FnZU51bWJlcj0iMSI+PC93c2Q6QXBwU2VxdWVuY2U+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6SGVsbG8+PHdzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NhOkFkZHJlc3M+dXJuOnV1aWQ6NzQ3ZjNkOTYtNjhhNy00M2YxLThjYmUtZThkNmRhZGQwMzU4PC93c2E6QWRkcmVzcz48L3dzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NkOlR5cGVzPndzZHA6RGV2aWNlIHB1YjpDb21wdXRlcjwvd3NkOlR5cGVzPjx3c2Q6WEFkZHJzPmh0dHA6Ly9bZmU4MDo6YzUwZDo1MTlmOjk2YTQ6ZTEwOF06NTM1Ny83NDdmM2Q5Ni02OGE3LTQzZjEtOGNiZS1lOGQ2ZGFkZDAzNTgvPC93c2Q6WEFkZHJzPjx3c2Q6TWV0YWRhdGFWZXJzaW9uPjI8L3dzZDpNZXRhZGF0YVZlcnNpb24+PC93c2Q6SGVsbG8+PC9zb2FwOkJvZHk+PC9zb2FwOkVudmVsb3BlPg=="} +00521{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":43,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":3,"flow_last_seen":13443,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":110,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":110,"pkt_l4_len":76,"thread_ts_msec":13443,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAABgHO4AAIARBJIKAAIPCgAC\/wCJAIkATEdmnCspEAABAAAAAAABIEVORkRFRkVFRUhFRkZIRUpFT0RCREFDQUNBQ0FDQUNBAAAgAAHADAAgAAEABJPgAAYAAAoAAg8="} +00569{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":44,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_last_seen":13455,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":153,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":153,"pkt_l4_len":99,"thread_ts_msec":13455,"pkt":"MzMAAQACCAAn5uVZht1gA+R4AGMRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQACAiICIwBj3LMBE9HtAAgAAgBkAAEADgABAAEkIvGzCAAn5uVZAAMADAUIACcAAAAAAAAAAAAnAA0AC01TRURHRVdJTjEwABAADgAAATcACE1TRlQgNS4wAAYACAARABcAGAAn"} +01861{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":47,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":3,"flow_last_seen":13682,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1115,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1115,"pkt_l4_len":1081,"thread_ts_msec":13682,"pkt":"AQBef\/\/6CAAn5uVZCABFAARN4IcAAAER2Q8KAAIP7\/\/\/+vnVDnYEOdZOPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5IiB4bWxuczp3c2RwPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA2LzAyL2RldnByb2YiIHhtbG5zOnB1Yj0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93aW5kb3dzL3B1Yi8yMDA1LzA3Ij48c29hcDpIZWFkZXI+PHdzYTpUbz51cm46c2NoZW1hcy14bWxzb2FwLW9yZzp3czoyMDA1OjA0OmRpc2NvdmVyeTwvd3NhOlRvPjx3c2E6QWN0aW9uPmh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5L0hlbGxvPC93c2E6QWN0aW9uPjx3c2E6TWVzc2FnZUlEPnVybjp1dWlkOmZhMTdjZDkwLThmMzktNGY1Yi05ZTI4LWJmZjA4ZmI1Y2QwZTwvd3NhOk1lc3NhZ2VJRD48d3NkOkFwcFNlcXVlbmNlIEluc3RhbmNlSWQ9IjQ2IiBTZXF1ZW5jZUlkPSJ1cm46dXVpZDo3NjczODllMC1lZTlhLTRjMWMtYjkwMi0yMGNiODFkMjAzZTAiIE1lc3NhZ2VOdW1iZXI9IjEiPjwvd3NkOkFwcFNlcXVlbmNlPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOkhlbGxvPjx3c2E6RW5kcG9pbnRSZWZlcmVuY2U+PHdzYTpBZGRyZXNzPnVybjp1dWlkOjc0N2YzZDk2LTY4YTctNDNmMS04Y2JlLWU4ZDZkYWRkMDM1ODwvd3NhOkFkZHJlc3M+PC93c2E6RW5kcG9pbnRSZWZlcmVuY2U+PHdzZDpUeXBlcz53c2RwOkRldmljZSBwdWI6Q29tcHV0ZXI8L3dzZDpUeXBlcz48d3NkOlhBZGRycz5odHRwOi8vMTAuMC4yLjE1OjUzNTcvNzQ3ZjNkOTYtNjhhNy00M2YxLThjYmUtZThkNmRhZGQwMzU4Lzwvd3NkOlhBZGRycz48d3NkOk1ldGFkYXRhVmVyc2lvbj4yPC93c2Q6TWV0YWRhdGFWZXJzaW9uPjwvd3NkOkhlbGxvPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="} +01911{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":48,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":3,"flow_last_seen":13708,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1153,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1153,"pkt_l4_len":1099,"thread_ts_msec":13708,"pkt":"MzMAAAAMCAAn5uVZht1gB0PFBEsRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dYOdgRLOdU8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiIHhtbG5zOndzZHA9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDYvMDIvZGV2cHJvZiIgeG1sbnM6cHViPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvcHViLzIwMDUvMDciPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvSGVsbG88L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6YWMzNzRhY2YtOTJhYi00YWY1LWJkZDEtOTQ5ODVkYWViNDA3PC93c2E6TWVzc2FnZUlEPjx3c2Q6QXBwU2VxdWVuY2UgSW5zdGFuY2VJZD0iNDYiIFNlcXVlbmNlSWQ9InVybjp1dWlkOjc2NzM4OWUwLWVlOWEtNGMxYy1iOTAyLTIwY2I4MWQyMDNlMCIgTWVzc2FnZU51bWJlcj0iMSI+PC93c2Q6QXBwU2VxdWVuY2U+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6SGVsbG8+PHdzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NhOkFkZHJlc3M+dXJuOnV1aWQ6NzQ3ZjNkOTYtNjhhNy00M2YxLThjYmUtZThkNmRhZGQwMzU4PC93c2E6QWRkcmVzcz48L3dzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NkOlR5cGVzPndzZHA6RGV2aWNlIHB1YjpDb21wdXRlcjwvd3NkOlR5cGVzPjx3c2Q6WEFkZHJzPmh0dHA6Ly9bZmU4MDo6YzUwZDo1MTlmOjk2YTQ6ZTEwOF06NTM1Ny83NDdmM2Q5Ni02OGE3LTQzZjEtOGNiZS1lOGQ2ZGFkZDAzNTgvPC93c2Q6WEFkZHJzPjx3c2Q6TWV0YWRhdGFWZXJzaW9uPjI8L3dzZDpNZXRhZGF0YVZlcnNpb24+PC93c2Q6SGVsbG8+PC9zb2FwOkJvZHk+PC9zb2FwOkVudmVsb3BlPg=="} +00461{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":50,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":13765,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":70,"pkt_l4_len":16,"thread_ts_msec":13765,"pkt":"MzMAAAACCAAn5uVZht1gAAAAABA6\/\/6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAChQDYkwAAAAABAQgAJ+blWQ=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":82,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15284,"flow_last_seen":15284,"flow_idle_time":180000,"flow_min_l4_payload_len":137,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":137,"flow_avg_l4_payload_len":137,"midstream":0,"thread_ts_msec":15284,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00610{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":82,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_last_seen":15284,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":179,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":179,"pkt_l4_len":145,"thread_ts_msec":15284,"pkt":"AQBef\/\/6CAAn5uVZCABFAACl4I8AAAQR2a8KAAIP7\/\/\/+vnaB2wAkQ9eTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClNUOiB1cm46c2NoZW1hcy11cG5wLW9yZzpkZXZpY2U6SW50ZXJuZXRHYXRld2F5RGV2aWNlOjENCk1hbjogInNzZHA6ZGlzY292ZXIiDQpNWDogMw0KDQo="} +00619{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":82,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15284,"flow_last_seen":15284,"flow_idle_time":180000,"flow_min_l4_payload_len":137,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":137,"flow_avg_l4_payload_len":137,"midstream":0,"thread_ts_msec":15284,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00565{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":83,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15285,"flow_last_seen":15285,"flow_idle_time":180000,"flow_min_l4_payload_len":95,"flow_max_l4_payload_len":95,"flow_tot_l4_payload_len":95,"flow_avg_l4_payload_len":95,"midstream":0,"thread_ts_msec":15285,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63960,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":83,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_last_seen":15285,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":157,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":157,"pkt_l4_len":103,"thread_ts_msec":15285,"pkt":"MzMAAAAMCAAn5uVZht1gDyjoAGcRBP6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dgHbABnVAhNLVNFQVJDSCAqIEhUVFAvMS4xDQpIb3N0OiBbRkYwMjo6Q106MTkwMA0KU1Q6IHVwbnA6cm9vdGRldmljZQ0KTWFuOiAic3NkcDpkaXNjb3ZlciINCk1YOiAzDQoNCg=="} +00623{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":83,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15285,"flow_last_seen":15285,"flow_idle_time":180000,"flow_min_l4_payload_len":95,"flow_max_l4_payload_len":95,"flow_tot_l4_payload_len":95,"flow_avg_l4_payload_len":95,"midstream":0,"thread_ts_msec":15285,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63960,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00562{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":84,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_last_seen":15285,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":143,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":143,"pkt_l4_len":109,"thread_ts_msec":15285,"pkt":"AQBef\/\/6CAAn5uVZCABFAACB4JAAAAQR2dIKAAIP7\/\/\/+vnaB2wAbXqpTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClNUOiB1cG5wOnJvb3RkZXZpY2UNCk1hbjogInNzZHA6ZGlzY292ZXIiDQpNWDogMw0KDQo="} +00569{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":87,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":3,"flow_last_seen":15468,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":153,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":153,"pkt_l4_len":99,"thread_ts_msec":15468,"pkt":"MzMAAQACCAAn5uVZht1gA+R4AGMRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQACAiICIwBj2+oBE9HtAAgAAgEtAAEADgABAAEkIvGzCAAn5uVZAAMADAUIACcAAAAAAAAAAAAnAA0AC01TRURHRVdJTjEwABAADgAAATcACE1TRlQgNS4wAAYACAARABcAGAAn"} +00569{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":88,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15469,"flow_last_seen":15469,"flow_idle_time":180000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":624,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":15469,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63965,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +01284{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":88,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_last_seen":15469,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":686,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":686,"pkt_l4_len":632,"thread_ts_msec":15469,"pkt":"MzMAAAAMCAAn5uVZht1gCQFeAngRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+d0OdgJ4bjk8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiIHhtbG5zOndzZHA9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDYvMDIvZGV2cHJvZiI+PHNvYXA6SGVhZGVyPjx3c2E6VG8+dXJuOnNjaGVtYXMteG1sc29hcC1vcmc6d3M6MjAwNTowNDpkaXNjb3Zlcnk8L3dzYTpUbz48d3NhOkFjdGlvbj5odHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA0L2Rpc2NvdmVyeS9Qcm9iZTwvd3NhOkFjdGlvbj48d3NhOk1lc3NhZ2VJRD51cm46dXVpZDozODVlNjBkOC0wOTJhLTRiMmItYmRmYy02YzJkMWQ1MGFjNDI8L3dzYTpNZXNzYWdlSUQ+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6UHJvYmU+PHdzZDpUeXBlcz53c2RwOkRldmljZTwvd3NkOlR5cGVzPjwvd3NkOlByb2JlPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="} +00627{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":88,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15469,"flow_last_seen":15469,"flow_idle_time":180000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":624,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":15469,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63965,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":89,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15469,"flow_last_seen":15469,"flow_idle_time":180000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":624,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":15469,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63964,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +01258{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":89,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_last_seen":15469,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":666,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":666,"pkt_l4_len":632,"thread_ts_msec":15469,"pkt":"AQBef\/\/6CAAn5uVZCABFAAKM4JIAAAER2sUKAAIP7\/\/\/+vncDnYCeP4aPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5IiB4bWxuczp3c2RwPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA2LzAyL2RldnByb2YiPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvUHJvYmU8L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6Mzg1ZTYwZDgtMDkyYS00YjJiLWJkZmMtNmMyZDFkNTBhYzQyPC93c2E6TWVzc2FnZUlEPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOlByb2JlPjx3c2Q6VHlwZXM+d3NkcDpEZXZpY2U8L3dzZDpUeXBlcz48L3dzZDpQcm9iZT48L3NvYXA6Qm9keT48L3NvYXA6RW52ZWxvcGU+"} +00619{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":89,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":15469,"flow_last_seen":15469,"flow_idle_time":180000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":624,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":15469,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63964,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} +00579{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":90,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_last_seen":15500,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":157,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":157,"pkt_l4_len":103,"thread_ts_msec":15500,"pkt":"MzMAAAAMCAAn5uVZht1gDyjoAGcRBP6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dgHbABnVAhNLVNFQVJDSCAqIEhUVFAvMS4xDQpIb3N0OiBbRkYwMjo6Q106MTkwMA0KU1Q6IHVwbnA6cm9vdGRldmljZQ0KTWFuOiAic3NkcDpkaXNjb3ZlciINCk1YOiAzDQoNCg=="} +00562{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":91,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":3,"flow_last_seen":15500,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":143,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":143,"pkt_l4_len":109,"thread_ts_msec":15500,"pkt":"AQBef\/\/6CAAn5uVZCABFAACB4JMAAAQR2c8KAAIP7\/\/\/+vnaB2wAbXqpTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClNUOiB1cG5wOnJvb3RkZXZpY2UNCk1hbjogInNzZHA6ZGlzY292ZXIiDQpNWDogMw0KDQo="} +01284{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":93,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_last_seen":15624,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":686,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":686,"pkt_l4_len":632,"thread_ts_msec":15624,"pkt":"MzMAAAAMCAAn5uVZht1gCQFeAngRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+d0OdgJ4bjk8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiIHhtbG5zOndzZHA9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDYvMDIvZGV2cHJvZiI+PHNvYXA6SGVhZGVyPjx3c2E6VG8+dXJuOnNjaGVtYXMteG1sc29hcC1vcmc6d3M6MjAwNTowNDpkaXNjb3Zlcnk8L3dzYTpUbz48d3NhOkFjdGlvbj5odHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA0L2Rpc2NvdmVyeS9Qcm9iZTwvd3NhOkFjdGlvbj48d3NhOk1lc3NhZ2VJRD51cm46dXVpZDozODVlNjBkOC0wOTJhLTRiMmItYmRmYy02YzJkMWQ1MGFjNDI8L3dzYTpNZXNzYWdlSUQ+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6UHJvYmU+PHdzZDpUeXBlcz53c2RwOkRldmljZTwvd3NkOlR5cGVzPjwvd3NkOlByb2JlPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="} +01258{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":96,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_last_seen":15672,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":666,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":666,"pkt_l4_len":632,"thread_ts_msec":15672,"pkt":"AQBef\/\/6CAAn5uVZCABFAAKM4JYAAAER2sEKAAIP7\/\/\/+vncDnYCeP4aPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5IiB4bWxuczp3c2RwPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA2LzAyL2RldnByb2YiPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvUHJvYmU8L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6Mzg1ZTYwZDgtMDkyYS00YjJiLWJkZmMtNmMyZDFkNTBhYzQyPC93c2E6TWVzc2FnZUlEPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOlByb2JlPjx3c2Q6VHlwZXM+d3NkcDpEZXZpY2U8L3dzZDpUeXBlcz48L3dzZDpQcm9iZT48L3NvYXA6Qm9keT48L3NvYXA6RW52ZWxvcGU+"} +01284{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":99,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":3,"flow_last_seen":15953,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":686,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":686,"pkt_l4_len":632,"thread_ts_msec":15953,"pkt":"MzMAAAAMCAAn5uVZht1gCQFeAngRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+d0OdgJ4bjk8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiIHhtbG5zOndzZHA9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDYvMDIvZGV2cHJvZiI+PHNvYXA6SGVhZGVyPjx3c2E6VG8+dXJuOnNjaGVtYXMteG1sc29hcC1vcmc6d3M6MjAwNTowNDpkaXNjb3Zlcnk8L3dzYTpUbz48d3NhOkFjdGlvbj5odHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA0L2Rpc2NvdmVyeS9Qcm9iZTwvd3NhOkFjdGlvbj48d3NhOk1lc3NhZ2VJRD51cm46dXVpZDozODVlNjBkOC0wOTJhLTRiMmItYmRmYy02YzJkMWQ1MGFjNDI8L3dzYTpNZXNzYWdlSUQ+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6UHJvYmU+PHdzZDpUeXBlcz53c2RwOkRldmljZTwvd3NkOlR5cGVzPjwvd3NkOlByb2JlPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="} +01259{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":100,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":3,"flow_last_seen":16062,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":666,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":666,"pkt_l4_len":632,"thread_ts_msec":16062,"pkt":"AQBef\/\/6CAAn5uVZCABFAAKM4JcAAAER2sAKAAIP7\/\/\/+vncDnYCeP4aPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5IiB4bWxuczp3c2RwPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA2LzAyL2RldnByb2YiPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvUHJvYmU8L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6Mzg1ZTYwZDgtMDkyYS00YjJiLWJkZmMtNmMyZDFkNTBhYzQyPC93c2E6TWVzc2FnZUlEPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOlByb2JlPjx3c2Q6VHlwZXM+d3NkcDpEZXZpY2U8L3dzZDpUeXBlcz48L3dzZDpQcm9iZT48L3NvYXA6Qm9keT48L3NvYXA6RW52ZWxvcGU+"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":101,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":16487,"flow_last_seen":16487,"flow_idle_time":180000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":16487,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00699{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":101,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_last_seen":16487,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":243,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":243,"pkt_l4_len":209,"thread_ts_msec":16487,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAADlHPgAAIARBAMKAAIPCgAC\/wCKAIoA0aFXEQKcLAoAAg8AigC7AAAgRU5GREVGRUVFSEVGRkhFSkVPREJEQUNBQ0FDQUNBQ0EAIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUJOAP9TTUIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQAAIQAAAAAAAAAAAOgDAAAAAAAAAAAhAFYAAwABAAAAAgAyAFxNQUlMU0xPVFxCUk9XU0UAAQBg6gAATVNFREdFV0lOMTAAAAAAAAoAAxAAAA8BVaoA"} +00739{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":101,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":16487,"flow_last_seen":16487,"flow_idle_time":180000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":16487,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}} +00462{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":104,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":17749,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":70,"pkt_l4_len":16,"thread_ts_msec":17749,"pkt":"MzMAAAACCAAn5uVZht1gAAAAABA6\/\/6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAChQDYkwAAAAABAQgAJ+blWQ=="} +00580{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":107,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":3,"flow_last_seen":18297,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":157,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":157,"pkt_l4_len":103,"thread_ts_msec":18297,"pkt":"MzMAAAAMCAAn5uVZht1gDyjoAGcRBP6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dgHbABnVAhNLVNFQVJDSCAqIEhUVFAvMS4xDQpIb3N0OiBbRkYwMjo6Q106MTkwMA0KU1Q6IHVwbnA6cm9vdGRldmljZQ0KTWFuOiAic3NkcDpkaXNjb3ZlciINCk1YOiAzDQoNCg=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":125,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40005,"flow_last_seen":40005,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":40005,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":55708,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00659{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":125,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_last_seen":40005,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":40005,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4KUAAAER3HQKAAIP7\/\/\/+tmcB2wAthOSTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00620{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":125,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40005,"flow_last_seen":40005,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":40005,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":55708,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00474{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":126,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":3,"flow_last_seen":40185,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"thread_ts_msec":40185,"pkt":"AQBeAAD7CAAn5uVZCABFAABEaF8AAAERZEAKAAIP4AAA+xTpFOkAMJ6ZAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="} +00504{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":127,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":3,"flow_last_seen":40185,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"thread_ts_msec":40185,"pkt":"MzMAAAD7CAAn5uVZht1gBGNuADARAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw\/soAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"} +00568{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":133,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":62539,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":133,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_last_seen":40232,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"thread_ts_msec":40232,"pkt":"MzMAAQADCAAn5uVZht1gAihOACARAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQAD9EsU6wAgDPv9UAAAAAEAAAAAAAAGcHVwcGV0AAABAAE="} +00628{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":133,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":62539,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":134,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":62539,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":134,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_last_seen":40232,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":40232,"pkt":"AQBeAAD8CAAn5uVZCABFAAA0pMcAAAERJ+cKAAIP4AAA\/PRLFOsAIKvR\/VAAAAABAAAAAAAABnB1cHBldAAAAQAB"} +00614{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":134,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":62539,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}} +00568{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":135,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":50435,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":135,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_last_seen":40232,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"thread_ts_msec":40232,"pkt":"MzMAAQADCAAn5uVZht1gAiZUACARAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQADxQMU6wAgtlmDHwAAAAEAAAAAAAAGcHVwcGV0AAAcAAE="} +00628{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":135,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":50435,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":136,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":50435,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":136,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_last_seen":40232,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":40232,"pkt":"AQBeAAD8CAAn5uVZCABFAAA0pMgAAAERJ+YKAAIP4AAA\/MUDFOsAIFUwgx8AAAABAAAAAAAABnB1cHBldAAAHAAB"} +00614{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":136,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":40232,"flow_last_seen":40232,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":40232,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":50435,"dst_port":5355,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":137,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_last_seen":40630,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"thread_ts_msec":40630,"pkt":"MzMAAQADCAAn5uVZht1gAiZUACARAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQADxQMU6wAgtlmDHwAAAAEAAAAAAAAGcHVwcGV0AAAcAAE="} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":138,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_last_seen":40630,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"thread_ts_msec":40630,"pkt":"MzMAAQADCAAn5uVZht1gAihOACARAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAQAD9EsU6wAgDPv9UAAAAAEAAAAAAAAGcHVwcGV0AAABAAE="} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":139,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_last_seen":40630,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":40630,"pkt":"AQBeAAD8CAAn5uVZCABFAAA0pMkAAAERJ+UKAAIP4AAA\/MUDFOsAIFUwgx8AAAABAAAAAAAABnB1cHBldAAAHAAB"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":140,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_last_seen":40630,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":40630,"pkt":"AQBeAAD8CAAn5uVZCABFAAA0pMoAAAERJ+QKAAIP4AAA\/PRLFOsAIKvR\/VAAAAABAAAAAAAABnB1cHBldAAAAQAB"} +00659{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":142,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_last_seen":41020,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":41020,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4KYAAAER3HMKAAIP7\/\/\/+tmcB2wAthOSTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00659{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":152,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":3,"flow_last_seen":42037,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":42037,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4KcAAAER3HIKAAIP7\/\/\/+tmcB2wAthOSTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00547{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":157,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":26,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61191,"flow_last_seen":61191,"flow_idle_time":180000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":61191,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57619,"dst_port":5351,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00423{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":157,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_last_seen":61191,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":44,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":44,"pkt_l4_len":10,"thread_ts_msec":61191,"pkt":"UlQAEjUCCAAn5uVZCABFAAAegT8AAIARoX8KAAIPCgACAuETFOcACvHOAAA="} +00547{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":27,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61470,"flow_last_seen":61470,"flow_idle_time":180000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":61470,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57620,"dst_port":5351,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00423{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_last_seen":61470,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":44,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":44,"pkt_l4_len":10,"thread_ts_msec":61470,"pkt":"UlQAEjUCCAAn5uVZCABFAAAegUAAAIARoX4KAAIPCgACAuEUFOcACvHNAAA="} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":159,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61974,"flow_last_seen":61974,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":61974,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.140.63.147","src_port":50190,"dst_port":29545,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":159,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_last_seen":61974,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":61974,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0XhVAAIAGAIEKAAIPUIw\/k8QOc2l5awyyAAAAAIAC+vAaXAAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":160,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":29,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61974,"flow_last_seen":61974,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":61974,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"207.38.163.228","src_port":50191,"dst_port":6778,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":160,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_last_seen":61974,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":61974,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0N+lAAIAGQ8EKAAIPzyaj5MQPGnrqoUd3AAAAAIAC+vDkYgAAAgQFtAEDAwgBAQQC"} +00552{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":161,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":30,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61975,"flow_last_seen":61975,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":61975,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.65.87.24","src_port":50192,"dst_port":16201,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":161,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_last_seen":61975,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":61975,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0uv9AAIAGr1wKAAIPLUFXGMQQP0mE8cSsAAAAAIAC+vCWvwAAAgQFtAEDAwgBAQQC"} +00552{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":162,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":31,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61975,"flow_last_seen":61975,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":61975,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":50193,"dst_port":46010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":162,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_last_seen":61975,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":61975,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0RCxAAIAGHSsKAAIPWUs0E8QRs7p3YZmDAAAAAIAC+vBSAQAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":163,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":32,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61975,"flow_last_seen":61975,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":61975,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.152.66.153","src_port":50194,"dst_port":43771,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":163,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_last_seen":61975,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":61975,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0uHJAAIAGlxEKAAIPXJhCmcQSqvtQr5pUAAAAAIAC+vBuzQAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":164,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":33,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61977,"flow_last_seen":61977,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":61977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"162.157.143.201","src_port":50195,"dst_port":29762,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":164,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_last_seen":61977,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":61977,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0c7hAAIAGSJYKAAIPop2PycQTdELYuuv1AAAAAIAC+vA4owAAAgQFtAEDAwgBAQQC"} +00547{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":165,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":34,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61999,"flow_last_seen":61999,"flow_idle_time":180000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":61999,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57621,"dst_port":5351,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00423{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":165,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_last_seen":61999,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":44,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":44,"pkt_l4_len":10,"thread_ts_msec":61999,"pkt":"UlQAEjUCCAAn5uVZCABFAAAegUEAAIARoX0KAAIPCgACAuEVFOcACvHMAAA="} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":166,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_last_seen":62017,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":62017,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAoIAAEAG5+ItQVcYCgACDz9JxBAAXcABhPHErWAS\/\/\/6VgAAAgQFtA=="} +00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":167,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_last_seen":62020,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":62020,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAoMAAEAG3txZSzQTCgACD7O6xBEAXroBd2GZhGAS\/\/+7lwAAAgQFtA=="} +00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":168,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_last_seen":62023,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":62023,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAoQAAEAG3BpQjD+TCgACD3NpxA4AX7QBeWsMs2AS\/\/+J8QAAAgQFtA=="} +00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":169,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_last_seen":62081,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":62081,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAoUAAEAG+S3PJqPkCgACDxp6xA8AYK4B6qFHeGAS\/\/9Z9wAAAgQFtA=="} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":170,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":35,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":63000,"flow_last_seen":63000,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":63000,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.250.6.59","src_port":50196,"dst_port":12556,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":170,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_last_seen":63000,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":63000,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0LR1AAIAG4GIKAAIP2voGO8QUMQyspeBzAAAAAIAC+vAEoQAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":171,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":36,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":63001,"flow_last_seen":63001,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":63001,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":50197,"dst_port":3931,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":171,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_last_seen":63001,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":63001,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0TE9AAIAGHHcKAAIPdqgPR8QVD1shnh\/ZAAAAAIAC+vDNOQAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":172,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":63001,"flow_last_seen":63001,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":63001,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":50198,"dst_port":9915,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":172,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_last_seen":63001,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":63001,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0B1pAAIAGzIUKAAIPVoHEVMQWJrsID0+\/AAAAAIAC+vAKmwAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":173,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":38,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":63001,"flow_last_seen":63001,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":63001,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":50199,"dst_port":36728,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":173,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_last_seen":63001,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":63001,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0uwRAAIAG0AgKAAIPL5M0FcQXj3g4QcNOAAAAAIAC+vC1SAAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":174,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":39,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":63002,"flow_last_seen":63002,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":63002,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.128.217.128","src_port":50200,"dst_port":45194,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":174,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_last_seen":63002,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":63002,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xtpAAIAGndkKAAIPsIDZgMQYsIr8Y98AAAAAAIAC+vCOBwAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":175,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":40,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":63002,"flow_last_seen":63002,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":63002,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.122.93.185","src_port":50201,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":175,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_last_seen":63002,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":63002,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0IqxAAIAGH9YKAAIPTnpducQZGMpcVbolAAAAAIAC+vDIfgAAAgQFtAEDAwgBAQQC"} +00547{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":176,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":41,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":63029,"flow_last_seen":63029,"flow_idle_time":180000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":63029,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57622,"dst_port":5351,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00423{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":176,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_last_seen":63029,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":44,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":44,"pkt_l4_len":10,"thread_ts_msec":63029,"pkt":"UlQAEjUCCAAn5uVZCABFAAAegUIAAIARoXwKAAIPCgACAuEWFOcACvHLAAA="} +00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":177,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_last_seen":63233,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":63233,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAoYAAEAGCJAvkzQVCgACD494xBcAY5wBOEHDT2AS\/\/882gAAAgQFtA=="} +00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":178,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":3,"flow_last_seen":63234,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":63234,"pkt":"UlQAEjUCCAAn5uVZCABFAAAouwVAAIAG0BMKAAIPL5M0FcQXj3g4QcNPAGOcAlAQ+vBZpgAA"} +00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":179,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_last_seen":63250,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":63250,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAocAAEAGiwHa+gY7CgACDzEMxBQAZJYBrKXgdGAS\/\/+SMQAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":180,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":3,"flow_last_seen":63250,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":63250,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoLR5AAIAG4G0KAAIP2voGO8QUMQyspeB0AGSWAlAQ+vCu\/QAA"} +00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":181,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":38,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":63001,"flow_last_seen":63261,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":63261,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":50199,"dst_port":36728,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":182,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":35,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":63000,"flow_last_seen":63261,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":63261,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.250.6.59","src_port":50196,"dst_port":12556,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":185,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_last_seen":63297,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":63297,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAooAAEAG5kR2qA9HCgACDw9bxBUAZZABIZ4f2mAS\/\/9gyQAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":186,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":3,"flow_last_seen":63297,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":63297,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoTFBAAIAGHIIKAAIPdqgPR8QVD1shnh\/aAGWQAlAQ+vB9lQAA"} +00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":187,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":36,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":63001,"flow_last_seen":63309,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":63309,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":50197,"dst_port":3931,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":203,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":42,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":64030,"flow_last_seen":64030,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":64030,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":50202,"dst_port":57648,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":203,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_last_seen":64030,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":64030,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0GZhAAIAG6a4KAAIPPe6tgMQa4TAr3W0hAAAAAIAC+vA+WAAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":43,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":64031,"flow_last_seen":64031,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":64031,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":50203,"dst_port":18994,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_last_seen":64031,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":64031,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0cDRAAIAGoD8KAAIPPd6gY8QbSjIrqiNHAAAAAIAC+vAskAAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":205,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":44,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":64032,"flow_last_seen":64032,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":64032,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":50204,"dst_port":9728,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":205,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_last_seen":64032,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":64032,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0FX9AAIAGQkwKAAIPfNoaEMQcJgCBbg3uAAAAAIAC+vBXrQAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":206,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":45,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":64032,"flow_last_seen":64032,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":64032,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.46.139.171","src_port":50205,"dst_port":52120,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":206,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_last_seen":64032,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":64032,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0XTBAAIAGk6sKAAIPci6Lq8Qdy5gelScRAAAAAIAC+vCU2gAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":207,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":46,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":64032,"flow_last_seen":64032,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":64032,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.181.156.244","src_port":50206,"dst_port":8255,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":207,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_last_seen":64032,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":64032,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0yBFAAIAG2fkKAAIPr7Wc9MQeID9tpdrVAAAAAIAC+vDujQAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":208,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":47,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":64033,"flow_last_seen":64033,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":64033,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.78.171.204","src_port":50207,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":208,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_last_seen":64033,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":64033,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0kpNAAIAGVgcKAAIPWk6rzMQfGMqXoNUlAAAAAIAC+vAYRgAAAgQFtAEDAwgBAQQC"} +00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":209,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":2,"flow_last_seen":64213,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":64213,"pkt":"CAAn5uVZUlQAEjUCCABFAAAoApQAAP8Gwb497q2ACgACD+EwxBoAAAAAK91tIlAUAAB6CAAA"} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":210,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":2,"flow_last_seen":64275,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":64275,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsApUAAEAGjec93qBjCgACD0oyxBsAZ4QBK6ojSGAS\/\/\/MHQAAAgQFtA=="} +00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":211,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":3,"flow_last_seen":64276,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":64276,"pkt":"UlQAEjUCCAAn5uVZCABFAAAocDVAAIAGoEoKAAIPPd6gY8QbSjIrqiNIAGeEAlAQ+vDo6QAA"} +00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":212,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":43,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":64031,"flow_last_seen":64276,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":64276,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":50203,"dst_port":18994,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":214,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":2,"flow_last_seen":64291,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":64291,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsApcAAEAGH32vtZz0CgACDyA\/xB4AaH4BbaXa1mAS\/\/+UGgAAAgQFtA=="} +00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":215,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":3,"flow_last_seen":64291,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":64291,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoyBJAAIAG2gQKAAIPr7Wc9MQeID9tpdrWAGh+AlAQ+vCw5gAA"} +00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":216,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":46,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":64032,"flow_last_seen":64291,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":304,"flow_tot_l4_payload_len":304,"flow_avg_l4_payload_len":76,"midstream":0,"thread_ts_msec":64291,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.181.156.244","src_port":50206,"dst_port":8255,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":227,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":3,"flow_last_seen":64717,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":64717,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0GZlAAIAG6a0KAAIPPe6tgMQa4TAr3W0hAAAAAIAC+vA+WAAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":229,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":48,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":65061,"flow_last_seen":65061,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":65061,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":50208,"dst_port":8683,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":229,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_last_seen":65061,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":65061,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0q8tAAIAGVuYKAAIPd+10FsQgIevuSsSrAAAAAIAC+vDjCgAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":230,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":49,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":65061,"flow_last_seen":65061,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":65061,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.206.254","src_port":50209,"dst_port":49587,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":230,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_last_seen":65061,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":65061,"pkt":"UlQAEjUCCAAn5uVZCABFAAA02YBAAIAG1DkKAAIPcfzO\/sQhwbNg4z+5AAAAAIAC+vAApAAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":231,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":50,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":65062,"flow_last_seen":65062,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":65062,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.234.18.166","src_port":50210,"dst_port":61404,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":231,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_last_seen":65062,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":65062,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0pW5AAIAGEbcKAAIPJOoSpsQi79zHbZnNAAAAAIAC+vAbRgAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":232,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":51,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":65062,"flow_last_seen":65062,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":65062,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.199.10.60","src_port":50211,"dst_port":23458,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":232,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_last_seen":65062,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":65062,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0SFBAAIAGjWIKAAIPDscKPMQjW6L9nzYkAAAAAIAC+vD7gwAAAgQFtAEDAwgBAQQC"} +00552{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":233,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":52,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":65062,"flow_last_seen":65062,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":65062,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.17.124.40","src_port":50212,"dst_port":6776,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":233,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_last_seen":65062,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":65062,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0NVpAAIAG3iEKAAIPXxF8KMQkGnhkTfi6AAAAAIAC+vBRMgAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":234,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":53,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":65063,"flow_last_seen":65063,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":65063,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.117.153.7","src_port":50213,"dst_port":50138,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":234,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_last_seen":65063,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":65063,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0DWpAAIAG8s4KAAIPVXWZB8Qlw9oAc\/5TAAAAAIAC+vDyzAAAAgQFtAEDAwgBAQQC"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":54,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":65065,"flow_last_seen":65065,"flow_idle_time":180000,"flow_min_l4_payload_len":182,"flow_max_l4_payload_len":182,"flow_tot_l4_payload_len":182,"flow_avg_l4_payload_len":182,"midstream":0,"thread_ts_msec":65065,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57623,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00671{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_last_seen":65065,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":224,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":224,"pkt_l4_len":190,"thread_ts_msec":65065,"pkt":"AQBef\/\/6CAAn5uVZCABFAADS4KkAAAER3GgKAAIP7\/\/\/+uEXB2wAvizBTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClVTRVItQUdFTlQ6IGd0ay1nbnV0ZWxsYS8xLjIuMiAoMjAyMi0wMi0yNSkNCk1BTjogInNzZHA6ZGlzY292ZXIiDQpTVDogdXJuOnNjaGVtYXMtdXBucC1vcmc6ZGV2aWNlOkludGVybmV0R2F0ZXdheURldmljZToyDQpNWDogMw0KDQo="} +00620{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":54,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":65065,"flow_last_seen":65065,"flow_idle_time":180000,"flow_min_l4_payload_len":182,"flow_max_l4_payload_len":182,"flow_tot_l4_payload_len":182,"flow_avg_l4_payload_len":182,"midstream":0,"thread_ts_msec":65065,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57623,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00671{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":236,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":2,"flow_last_seen":65065,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":224,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":224,"pkt_l4_len":190,"thread_ts_msec":65065,"pkt":"AQBef\/\/6CAAn5uVZCABFAADS4KoAAAER3GcKAAIP7\/\/\/+uEXB2wAvi3BTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClVTRVItQUdFTlQ6IGd0ay1nbnV0ZWxsYS8xLjIuMiAoMjAyMi0wMi0yNSkNCk1BTjogInNzZHA6ZGlzY292ZXIiDQpTVDogdXJuOnNjaGVtYXMtdXBucC1vcmc6ZGV2aWNlOkludGVybmV0R2F0ZXdheURldmljZToxDQpNWDogMw0KDQo="} +00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":237,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":3,"flow_last_seen":65065,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":219,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":219,"pkt_l4_len":185,"thread_ts_msec":65065,"pkt":"AQBef\/\/6CAAn5uVZCABFAADN4KsAAAER3GsKAAIP7\/\/\/+uEXB2wAuZDETS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClVTRVItQUdFTlQ6IGd0ay1nbnV0ZWxsYS8xLjIuMiAoMjAyMi0wMi0yNSkNCk1BTjogInNzZHA6ZGlzY292ZXIiDQpTVDogdXJuOnNjaGVtYXMtdXBucC1vcmc6c2VydmljZTpXQU5JUENvbm5lY3Rpb246Mg0KTVg6IDMNCg0K"} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":241,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":2,"flow_last_seen":65240,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":65240,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAp8AAEAGUxwOxwo8CgACD1uixCMAa2wB\/Z82JWAS\/\/+zDQAAAgQFtA=="} +00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":242,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":3,"flow_last_seen":65241,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":65241,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoSFFAAIAGjW0KAAIPDscKPMQjW6L9nzYlAGtsAlAQ+vDP2QAA"} +00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":243,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":51,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":65062,"flow_last_seen":65241,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":65241,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.199.10.60","src_port":50211,"dst_port":23458,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":252,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_last_seen":66017,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":66017,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xttAAIAGndgKAAIPsIDZgMQYsIr8Y98AAAAAAIAC+vCOBwAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":253,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":2,"flow_last_seen":66017,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":66017,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0B1tAAIAGzIQKAAIPVoHEVMQWJrsID0+\/AAAAAIAC+vAKmwAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":254,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":2,"flow_last_seen":66017,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":66017,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Iq1AAIAGH9UKAAIPTnpducQZGMpcVbolAAAAAIAC+vDIfgAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":255,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":55,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":66076,"flow_last_seen":66076,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":66076,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.193.171.146","src_port":50214,"dst_port":53808,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":255,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":1,"flow_last_seen":66076,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":66076,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0FTdAAIAG3SoKAAIPUMGrksQm0jCYt6bIAAAAAIAC+vCV5QAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":256,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":56,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":66077,"flow_last_seen":66077,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":66077,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.244.64.237","src_port":50215,"dst_port":4704,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":256,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":1,"flow_last_seen":66077,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":66077,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0CoxAAIAGJkgKAAIPfPRA7cQnEmB1c07JAAAAAIAC+vAPawAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":257,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":57,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":66077,"flow_last_seen":66077,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":66077,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":50216,"dst_port":3256,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":257,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":1,"flow_last_seen":66077,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":66077,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0ZdlAAIAGUVwKAAIPtpuA5MQoDLg79XydAAAAAIAC+vCnHQAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":258,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":58,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":66078,"flow_last_seen":66078,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":66078,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":50217,"dst_port":54958,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":258,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_last_seen":66078,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":66078,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0d8JAAIAGrlQKAAIPcfxWosQp1q4KULlcAAAAAIAC+vBA7QAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":259,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":59,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":66078,"flow_last_seen":66078,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":66078,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.103.247.94","src_port":50218,"dst_port":59045,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":259,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":1,"flow_last_seen":66078,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":66078,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0EU5AAIAGi6EKAAIPWmf3XsQq5qXgntCpAAAAAIAC+vC6MQAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":260,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":60,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":66079,"flow_last_seen":66079,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":66079,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.121.165.12","src_port":50219,"dst_port":55376,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":260,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":1,"flow_last_seen":66079,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":66079,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gY5AAIAGBqEKAAIPwXmlDMQr2FBBRhZnAAAAAIAC+vANYQAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":261,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":2,"flow_last_seen":67044,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":67044,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0kpRAAIAGVgYKAAIPWk6rzMQfGMqXoNUlAAAAAIAC+vAYRgAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":262,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":2,"flow_last_seen":67044,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":67044,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0FYBAAIAGQksKAAIPfNoaEMQcJgCBbg3uAAAAAIAC+vBXrQAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":263,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_last_seen":67044,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":67044,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0XTFAAIAGk6oKAAIPci6Lq8Qdy5gelScRAAAAAIAC+vCU2gAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":264,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":61,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":67092,"flow_last_seen":67092,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":67092,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.196.226","src_port":50220,"dst_port":3820,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":264,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":1,"flow_last_seen":67092,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":67092,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0k7lAAIAGcTAKAAIPJOnE4sQsDuwTBJqfAAAAAIAC+vD9iAAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":265,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":62,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":67093,"flow_last_seen":67093,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":67093,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":50221,"dst_port":49956,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":265,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":1,"flow_last_seen":67093,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":67093,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0faFAAIAGiKYKAAIPO2itBcQtwyRMUgplAAAAAIAC+vChmQAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":266,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":63,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":67093,"flow_last_seen":67093,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":67093,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":50222,"dst_port":6523,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":266,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":1,"flow_last_seen":67093,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":67093,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0TEpAAIAGm28KAAIPdw6P7cQuGXtEBOluAAAAAIAC+vBV+AAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":267,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":64,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":67094,"flow_last_seen":67094,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":67094,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.167.248.220","src_port":50223,"dst_port":63108,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":267,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":1,"flow_last_seen":67094,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":67094,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0R0xAAIAGN+UKAAIPdqf43MQv9oQzn2SqAAAAAIAC+vCljgAAAgQFtAEDAwgBAQQC"} +00552{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":268,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":65,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":67094,"flow_last_seen":67094,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":67094,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.125.63.97","src_port":50224,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":268,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":1,"flow_last_seen":67094,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":67094,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0UtBAAIAGDgcKAAIPTn0\/YcQwGMq9KdLlAAAAAIAC+vBtKAAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":269,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":66,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":67095,"flow_last_seen":67095,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":67095,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.210.81.147","src_port":50225,"dst_port":24800,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":269,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":1,"flow_last_seen":67095,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":67095,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0+zZAAIAGNBkKAAIPbdJRk8QxYOCX52ZFAAAAAIAC+vCFbAAAAgQFtAEDAwgBAQQC"} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":270,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":2,"flow_last_seen":67457,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":67457,"pkt":"CAAn5uVZUlQAEjUCCABFAAAoAqUAAP8GpiB3Do\/tCgACDxl7xC4AAAAARATpb1AUAACRqAAA"} +00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":271,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":2,"flow_last_seen":67657,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":67657,"pkt":"CAAn5uVZUlQAEjUCCABFAAAoAqYAAP8Gw08k6cTiCgACDw7sxCwAAAAAEwSaoFAUAAA5OQAA"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":272,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":3,"flow_last_seen":67969,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":67969,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0TEtAAIAGm24KAAIPdw6P7cQuGXtEBOluAAAAAIAC+vBV+AAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":273,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":2,"flow_last_seen":68075,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68075,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0DWtAAIAG8s0KAAIPVXWZB8Qlw9oAc\/5TAAAAAIAC+vDyzAAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":274,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":2,"flow_last_seen":68075,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68075,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0q8xAAIAGVuUKAAIPd+10FsQgIevuSsSrAAAAAIAC+vDjCgAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":275,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":2,"flow_last_seen":68075,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68075,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0pW9AAIAGEbYKAAIPJOoSpsQi79zHbZnNAAAAAIAC+vAbRgAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":276,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":2,"flow_last_seen":68075,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68075,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0NVtAAIAG3iAKAAIPXxF8KMQkGnhkTfi6AAAAAIAC+vBRMgAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":277,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":2,"flow_last_seen":68075,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68075,"pkt":"UlQAEjUCCAAn5uVZCABFAAA02YFAAIAG1DgKAAIPcfzO\/sQhwbNg4z+5AAAAAIAC+vAApAAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":278,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":67,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":68108,"flow_last_seen":68108,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":68108,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":50226,"dst_port":15677,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":278,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":1,"flow_last_seen":68108,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68108,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0bmJAAIAGaL8KAAIPdPGiosQyPT31tKkaAAAAAIAC+vCwPQAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":279,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":68,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":68108,"flow_last_seen":68108,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":68108,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.246.157.94","src_port":50227,"dst_port":51175,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":279,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":1,"flow_last_seen":68108,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68108,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0K4hAAIAGtdgKAAIPb\/adXsQzx+daqkeOAAAAAIAC+vAsaAAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":280,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":69,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":68109,"flow_last_seen":68109,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":68109,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.241.31.96","src_port":50228,"dst_port":14384,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":280,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":1,"flow_last_seen":68109,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68109,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0KIlAAIAGNtsKAAIPb\/EfYMQ0ODBTVI35AAAAAIAC+vD7DAAAAgQFtAEDAwgBAQQC"} +00552{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":281,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":70,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":68109,"flow_last_seen":68109,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":68109,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.36.249.91","src_port":50229,"dst_port":64920,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":281,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":1,"flow_last_seen":68109,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68109,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0vGxAAIAGN8kKAAIPAST5W8Q1\/ZgxDGGiAAAAAIAC+vAZFAAAAgQFtAEDAwgBAQQC"} +00552{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":282,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":71,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":68110,"flow_last_seen":68110,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":68110,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.3.103.37","src_port":50230,"dst_port":17296,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":282,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":1,"flow_last_seen":68110,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68110,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0BKBAAIAGOe0KAAIPSQNnJcQ2Q5DEXLK5AAAAAIAC+vA5CwAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":283,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":72,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":68110,"flow_last_seen":68110,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":68110,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.68.138.207","src_port":50231,"dst_port":45079,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":283,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_last_seen":68110,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68110,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0ZZlAAIAGsggKAAIPTESKz8Q3sBfW5xLuAAAAAIAC+vAy2AAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":284,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":3,"flow_last_seen":68170,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68170,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0k7pAAIAGcS8KAAIPJOnE4sQsDuwTBJqfAAAAAIAC+vD9iAAAAgQFtAEDAwgBAQQC"} +00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":286,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":2,"flow_last_seen":68368,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":68368,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAqgAAEAGVIJ08aKiCgACDz09xDIAcUgB9bSpG2AS\/\/+LwQAAAgQFtA=="} +00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":287,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":3,"flow_last_seen":68368,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":68368,"pkt":"UlQAEjUCCAAn5uVZCABFAAAobmNAAIAGaMoKAAIPdPGiosQyPT31tKkbAHFIAlAQ+vCojQAA"} +00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":67,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":68108,"flow_last_seen":68372,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":68372,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":50226,"dst_port":15677,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":290,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":2,"flow_last_seen":68425,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":68425,"pkt":"CAAn5uVZUlQAEjUCCABFAAAoAqoAAP8GHcZv8R9gCgACDzgwxDQAAAAAU1SN+lAUAAA2vQAA"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":298,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":3,"flow_last_seen":68935,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":68935,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0KIpAAIAGNtoKAAIPb\/EfYMQ0ODBTVI35AAAAAIAC+vD7DAAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":299,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":2,"flow_last_seen":69076,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":69076,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0ZdpAAIAGUVsKAAIPtpuA5MQoDLg79XydAAAAAIAC+vCnHQAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":300,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":2,"flow_last_seen":69076,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":69076,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0d8NAAIAGrlMKAAIPcfxWosQp1q4KULlcAAAAAIAC+vBA7QAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":301,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":2,"flow_last_seen":69076,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":69076,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0FThAAIAG3SkKAAIPUMGrksQm0jCYt6bIAAAAAIAC+vCV5QAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":302,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":2,"flow_last_seen":69076,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":69076,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0EU9AAIAGi6AKAAIPWmf3XsQq5qXgntCpAAAAAIAC+vC6MQAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":303,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":2,"flow_last_seen":69076,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":69076,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Co1AAIAGJkcKAAIPfPRA7cQnEmB1c07JAAAAAIAC+vAPawAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":2,"flow_last_seen":69092,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":69092,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gY9AAIAGBqAKAAIPwXmlDMQr2FBBRhZnAAAAAIAC+vANYQAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":306,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":73,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":69141,"flow_last_seen":69141,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":69141,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.242.225","src_port":50232,"dst_port":15068,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":306,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":1,"flow_last_seen":69141,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":69141,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0LcBAAIAGF3gKAAIPtpvy4cQ4Otw6vMh+AAAAAIAC+vC8QwAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":307,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":74,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":69141,"flow_last_seen":69141,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":69141,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.163.14.246","src_port":50233,"dst_port":12854,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":307,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":1,"flow_last_seen":69141,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":69141,"pkt":"UlQAEjUCCAAn5uVZCABFAAA01LRAAIAGCWgKAAIPAaMO9sQ5MjZr2Fv\/AAAAAIAC+vCZMAAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":308,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":75,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":69142,"flow_last_seen":69142,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":69142,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.189.28.17","src_port":50234,"dst_port":16269,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":308,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":1,"flow_last_seen":69142,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":69142,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0VPxAAIAGOusKAAIPQr0cEcQ6P42S8gLxAAAAAIAC+vBvlwAAAgQFtAEDAwgBAQQC"} +00552{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":309,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":76,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":69142,"flow_last_seen":69142,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":69142,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.118.70","src_port":50235,"dst_port":6906,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":309,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":1,"flow_last_seen":69142,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":69142,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0AgNAAIAGSRQKAAIPLVh2RsQ7GvpGaqL3AAAAAIAC+vD72gAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":310,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":77,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":69142,"flow_last_seen":69142,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":69142,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.29.135.209","src_port":50236,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":310,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":1,"flow_last_seen":69142,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":69142,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Z6pAAIAGohwKAAIPXR2H0cQ8GMo64wwuAAAAAIAC+vBfCgAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":311,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":78,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":69142,"flow_last_seen":69142,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":69142,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.123.202.175","src_port":50237,"dst_port":37910,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":311,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":1,"flow_last_seen":69142,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":69142,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0lydAAIAGNGMKAAIPWHvKr8Q9lBZfEvXQAAAAAIAC+vCXrgAAAgQFtAEDAwgBAQQC"} +00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":312,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":2,"flow_last_seen":69169,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":69169,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAq8AAEAGhyBdHYfRCgACDxjKxDwAczwBOuMML2AS\/\/9GjAAAAgQFtA=="} +00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":313,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":3,"flow_last_seen":69169,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":69169,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoZ6tAAIAGoicKAAIPXR2H0cQ8GMo64wwvAHM8AlAQ+vBjWAAA"} +00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":314,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":77,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":69142,"flow_last_seen":69174,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":302,"flow_tot_l4_payload_len":302,"flow_avg_l4_payload_len":75,"midstream":0,"thread_ts_msec":69174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.29.135.209","src_port":50236,"dst_port":6346,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":316,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":2,"flow_last_seen":69182,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":69182,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsArEAAEAGyG4tWHZGCgACDxr6xDsAdDYBRmqi+GAS\/\/\/pWwAAAgQFtA=="} +00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":317,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":3,"flow_last_seen":69182,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":69182,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoAgRAAIAGSR8KAAIPLVh2RsQ7GvpGaqL4AHQ2AlAQ+vAGKAAA"} +00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":318,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":76,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":69142,"flow_last_seen":69182,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":69182,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.118.70","src_port":50235,"dst_port":6906,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":327,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":3,"flow_last_seen":69360,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":69360,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsArgAAEAG3qdZSzQTCgACD7O6xBEAXroBd2GZhGAS\/\/+7lwAAAgQFtA=="} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":328,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":3,"flow_last_seen":69360,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":69360,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsArkAAEAG56stQVcYCgACDz9JxBAAXcABhPHErWAS\/\/\/6VgAAAgQFtA=="} +00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":329,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":3,"flow_last_seen":69360,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":69360,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAroAAEAG+PjPJqPkCgACDxp6xA8AYK4B6qFHeGAS\/\/9Z9wAAAgQFtA=="} +00446{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":330,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":3,"flow_last_seen":69360,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":69360,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsArsAAEAG2+NQjD+TCgACD3NpxA4AX7QBeWsMs2AS\/\/+J8QAAAgQFtA=="} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":331,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":2,"flow_last_seen":69360,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":69360,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsArwAAEAGwoS2m\/LhCgACDzrcxDgAdioBOrzIf2AS\/\/+1wgAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":332,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":3,"flow_last_seen":69360,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":69360,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoLcFAAIAGF4MKAAIPtpvy4cQ4Otw6vMh\/AHYqAlAQ+vDSjgAA"} +00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":333,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":73,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":69141,"flow_last_seen":69361,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":69361,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.242.225","src_port":50232,"dst_port":15068,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":343,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":2,"flow_last_seen":70110,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70110,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0UtFAAIAGDgYKAAIPTn0\/YcQwGMq9KdLlAAAAAIAC+vBtKAAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":344,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":2,"flow_last_seen":70110,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70110,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0faJAAIAGiKUKAAIPO2itBcQtwyRMUgplAAAAAIAC+vChmQAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":345,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":2,"flow_last_seen":70110,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70110,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0R01AAIAGN+QKAAIPdqf43MQv9oQzn2SqAAAAAIAC+vCljgAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":346,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":2,"flow_last_seen":70110,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70110,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0+zdAAIAGNBgKAAIPbdJRk8QxYOCX52ZFAAAAAIAC+vCFbAAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":347,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":79,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":70170,"flow_last_seen":70170,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":70170,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.41.253","src_port":50238,"dst_port":59144,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":347,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":1,"flow_last_seen":70170,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70170,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0KcZAAIAGHhgKAAIPfNop\/cQ+5wgF3IcnAAAAAIAC+vCI7gAAAgQFtAEDAwgBAQQC"} +00552{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":348,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":80,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":70171,"flow_last_seen":70171,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":70171,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.105.52.2","src_port":50239,"dst_port":6384,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":348,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":1,"flow_last_seen":70171,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70171,"pkt":"UlQAEjUCCAAn5uVZCABFAAA01kJAAIAGdAcKAAIPcGk0AsQ\/GPASVmSCAAAAAIAC+vBvnQAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":349,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":81,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":70171,"flow_last_seen":70171,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":70171,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.10.152","src_port":50240,"dst_port":21293,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":349,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":1,"flow_last_seen":70171,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70171,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Rm9AAIAGeMEKAAIPJO0KmMRAUy2fhJtvAAAAAIAC+vDmKQAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":350,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":82,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":70171,"flow_last_seen":70171,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":70171,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.18.172.208","src_port":50241,"dst_port":63172,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":350,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":1,"flow_last_seen":70171,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70171,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0A95AAIAG2\/QKAAIPYhKs0MRB9sQLj4LfAAAAAIAC+vAPuQAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":83,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":70172,"flow_last_seen":70172,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":70172,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.210.203.131","src_port":50242,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":1,"flow_last_seen":70172,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70172,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0LJpAAIAGiMUKAAIPbdLLg8RCGMrxPNpbAAAAAIAC+vCGFQAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":352,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":84,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":70172,"flow_last_seen":70172,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":70172,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.138.129.252","src_port":50243,"dst_port":27962,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":352,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":1,"flow_last_seen":70172,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70172,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0UWtAAIAGasMKAAIPsIqB\/MRDbToYK0huAAAAAIAC+vCjcgAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":356,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":85,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":70230,"flow_last_seen":70230,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":70230,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.138.20.110","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":356,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_last_seen":70230,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70230,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0djYAAIARTnwKAAIPVYoUbnAJGMoAIKDVR05EED6PAQFUC1FLUlAGUk5BXS\/iNQlw"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":358,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":86,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":70230,"flow_last_seen":70230,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":70230,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.210.244.72","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":358,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":1,"flow_last_seen":70230,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70230,"pkt":"UlQAEjUCCAAn5uVZCABFAAA022gAAIARFCcKAAIPStL0SHAJGMoAIMuxR05EED6QAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":360,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":87,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":70230,"flow_last_seen":70230,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":70230,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.131.85.245","src_port":28681,"dst_port":31743,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":360,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":1,"flow_last_seen":70230,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70230,"pkt":"UlQAEjUCCAAn5uVZCABFAAA01LQAAIARp30KAAIPXINV9XAJe\/8AIPUdR05EED6RAQFUC1FLUlAGUk5BXS\/iNQlw"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":361,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":88,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":70230,"flow_last_seen":70230,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":70230,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.50.24.2","src_port":28681,"dst_port":17874,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":361,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":1,"flow_last_seen":70230,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":70230,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0tBIAAIAREWQKAAIPUTIYAnAJRdIAIHSOR05EED6SAQFUC1FLUlAGUk5BXS\/iNQlw"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":362,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":2,"flow_last_seen":71122,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71122,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0vG1AAIAGN8gKAAIPAST5W8Q1\/ZgxDGGiAAAAAIAC+vAZFAAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":363,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":2,"flow_last_seen":71122,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71122,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0K4lAAIAGtdcKAAIPb\/adXsQzx+daqkeOAAAAAIAC+vAsaAAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":364,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":2,"flow_last_seen":71122,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71122,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0ZZpAAIAGsgcKAAIPTESKz8Q3sBfW5xLuAAAAAIAC+vAy2AAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":365,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":2,"flow_last_seen":71122,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71122,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0BKFAAIAGOewKAAIPSQNnJcQ2Q5DEXLK5AAAAAIAC+vA5CwAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":366,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":89,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71203,"flow_last_seen":71203,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":71203,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":50244,"dst_port":63978,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":366,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":1,"flow_last_seen":71203,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71203,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0c0JAAIAGin4KAAIPvD00t8RE+erRmdziAAAAAIAC+vAKcAAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":367,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":90,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71204,"flow_last_seen":71204,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":71204,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.62.225.181","src_port":50245,"dst_port":46843,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":367,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":1,"flow_last_seen":71204,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71204,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0I3NAAIAGoE4KAAIPST7htcRFtvuqIJp6AAAAAIAC+vB9QAAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":368,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":91,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71204,"flow_last_seen":71204,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":71204,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":50246,"dst_port":45685,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":368,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":1,"flow_last_seen":71204,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71204,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0IwtAAIAGfuIKAAIPUAf8wMRGsnV8RDFlAAAAAIAC+vD24gAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":369,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":92,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71204,"flow_last_seen":71204,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":71204,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":50247,"dst_port":51560,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":369,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":1,"flow_last_seen":71204,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71204,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Dd1AAIAGwQQKAAIPQh7dtcRHyWh8xjFMAAAAAIAC+vAMegAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":370,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":93,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71205,"flow_last_seen":71205,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":71205,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.214.154.216","src_port":50248,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":370,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":1,"flow_last_seen":71205,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71205,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05AtAAIAGAfsKAAIPbdaa2MRIGMoc18X9AAAAAIAC+vCfegAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":371,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":94,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71205,"flow_last_seen":71205,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":71205,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.208.180.181","src_port":50249,"dst_port":45883,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":371,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":1,"flow_last_seen":71205,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71205,"pkt":"UlQAEjUCCAAn5uVZCABFAAA08yJAAIAG8AwKAAIPVtC0tcRJszsghBY3AAAAAIAC+vCuSgAAAgQFtAEDAwgBAQQC"} +00519{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":372,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71216,"flow_last_seen":71216,"flow_idle_time":120000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":71216,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3} +00461{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":372,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":1,"flow_last_seen":71216,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":71216,"pkt":"CAAn5uVZUlQAEjUCCABFwAA4AsYAAP8BoC4KAAICCgACDwMBntkAAAAARQAANGWZQAB\/BrMICgACD0xEis\/EN7AX1ucS7g=="} +00597{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":372,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71216,"flow_last_seen":71216,"flow_idle_time":120000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":71216,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":4.521641} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":373,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":2,"flow_last_seen":71312,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":71312,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAscAAEAGYHFW0LS1CgACD7M7xEkAehIBIIQWOGAS\/\/+\/xQAAAgQFtA=="} +00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":374,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":3,"flow_last_seen":71312,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":71312,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo8yNAAIAG8BcKAAIPVtC0tcRJszsghBY4AHoSAlAQ+vDckQAA"} +00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":375,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":94,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":71205,"flow_last_seen":71313,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":303,"flow_tot_l4_payload_len":303,"flow_avg_l4_payload_len":75,"midstream":0,"thread_ts_msec":71313,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.208.180.181","src_port":50249,"dst_port":45883,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":381,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":96,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71535,"flow_last_seen":71535,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71535,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.160.214.137","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":381,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":1,"flow_last_seen":71535,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71535,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gnYAAIARfQoKAAIPWKDWiXAJGMoAINufR05EED6TAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":382,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":97,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71535,"flow_last_seen":71535,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71535,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.78.134.188","src_port":28681,"dst_port":49046,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":382,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":1,"flow_last_seen":71535,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71535,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gnEAAIARDS8KAAIPGE6GvHAJv5YAIMTxR05EED6UAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":383,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":98,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71536,"flow_last_seen":71536,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71536,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.222.14.170","src_port":28681,"dst_port":23332,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":383,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":1,"flow_last_seen":71536,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71536,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0alYAAIAR6csKAAIPy94OqnAJWyQAIO3kR05EED6VAQFUC1FLUlAGUk5BXS\/iNQlw"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":384,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":99,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71536,"flow_last_seen":71536,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71536,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.38.9.82","src_port":28681,"dst_port":24223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":384,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":1,"flow_last_seen":71536,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71536,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0IoEAAIARkLEKAAIPciYJUnAJXp8AIEl5R05EED6WAQFUC1FLUlAGUk5BXS\/iNQlw"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":385,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":100,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71536,"flow_last_seen":71536,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71536,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.133.122.217","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":385,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":1,"flow_last_seen":71536,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71536,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xrwAAIAREI8KAAIP3IV62XAJW6IAIHCOR05EED6XAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":386,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":101,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71537,"flow_last_seen":71537,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71537,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.126.102","src_port":28681,"dst_port":5193,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":386,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":1,"flow_last_seen":71537,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71537,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0bocAAIARxe8KAAIPe81+ZnAJFEkAIBUSR05EED6YAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":387,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":102,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71537,"flow_last_seen":71537,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71537,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.39.233","src_port":28681,"dst_port":20855,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":387,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":1,"flow_last_seen":71537,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71537,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0oV4AAIARir4KAAIP2qQn6XAJUXcAIM+IR05EED6ZAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":388,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":103,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71537,"flow_last_seen":71537,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71537,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.134.167.82","src_port":28681,"dst_port":5820,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":388,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":1,"flow_last_seen":71537,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71537,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0nSoAAIARDacKAAIP3IanUnAJFrwAIIj3R05EED6aAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":389,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":104,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71538,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.98.115.128","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":389,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_last_seen":71538,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71538,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0RlgAAIARSnAKAAIPKmJzgHAJW6IAICoHR05EED6bAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":390,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":105,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71538,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.11.85","src_port":28681,"dst_port":10722,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":390,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":1,"flow_last_seen":71538,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71538,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09nMAAIARUYwKAAIP21ULVXAJKeIAIBL+R05EED6cAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":106,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71538,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.39.154.69","src_port":28681,"dst_port":4832,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":106,"flow_packet_id":1,"flow_last_seen":71538,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71538,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0wuYAAIARX1cKAAIPcieaRXAJEuAAIAQ9R05EED6dAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":392,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":107,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71538,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"202.151.63.59","src_port":28681,"dst_port":7624,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":392,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":1,"flow_last_seen":71538,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71538,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0odAAAIARgwcKAAIPypc\/O3AJHcgAIPvtR05EED6eAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":393,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":108,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71539,"flow_last_seen":71539,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71539,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.242.110","src_port":28681,"dst_port":7922,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":393,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":1,"flow_last_seen":71539,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71539,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0B\/4AAIARw8YKAAIPcHfybnAJHvIAIKGvR05EED6fAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":394,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":109,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71539,"flow_last_seen":71539,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71539,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.169.2.153","src_port":28681,"dst_port":52414,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":394,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":1,"flow_last_seen":71539,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71539,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0p7QAAIARK7QKAAIPWKkCmXAJzL4AIPuFR05EED6gAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":395,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":110,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71539,"flow_last_seen":71539,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71539,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.132.75.56","src_port":28681,"dst_port":56009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":395,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":110,"flow_packet_id":1,"flow_last_seen":71539,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71539,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0QZMAAIAR3loKAAIPw4RLOHAJ2skAIDn\/R05EED6hAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":396,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":111,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71540,"flow_last_seen":71540,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71540,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.65.141.157","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":396,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":1,"flow_last_seen":71540,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71540,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0JF0AAIARIm8KAAIPWkGNnXAJGMoAICLcR05EED6iAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":397,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":112,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71540,"flow_last_seen":71540,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71540,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.239.213.146","src_port":28681,"dst_port":21750,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":397,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":1,"flow_last_seen":71540,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71540,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0MesAAIARAj4KAAIPJO\/VknAJVPYAINQLR05EED6jAQFUC1FLUlAGUk5BXS\/iNQlw"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":398,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":113,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71540,"flow_last_seen":71540,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71540,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"105.101.132.146","src_port":28681,"dst_port":57746,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":398,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":1,"flow_last_seen":71540,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71540,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09PMAAIARS78KAAIPaWWEknAJ4ZIAIFP4R05EED6kAQFUC1FLUlAGUk5BXS\/iNQlw"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":399,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":114,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71540,"flow_last_seen":71540,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71540,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.23.75.69","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":399,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":1,"flow_last_seen":71540,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71540,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0WkwAAIARMwIKAAIPVhdLRXAJGMoAIGlbR05EED6lAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":400,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":115,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71540,"flow_last_seen":71540,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71540,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"154.3.42.104","src_port":28681,"dst_port":11804,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":400,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":115,"flow_packet_id":1,"flow_last_seen":71540,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71540,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05HkAAIARhcUKAAIPmgMqaHAJLhwAIDD5R05EED6mAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":401,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":116,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71540,"flow_last_seen":71540,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71540,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.44.190.145","src_port":28681,"dst_port":10170,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":401,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":1,"flow_last_seen":71540,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71540,"pkt":"UlQAEjUCCAAn5uVZCABFAAA00HAAAIARI3wKAAIPfCy+kXAJJ7oAIMEHR05EED6nAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":402,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":117,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71540,"flow_last_seen":71540,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71540,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.120.243.143","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":402,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":1,"flow_last_seen":71540,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71540,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0POoAAIARNbgKAAIPyHjzj3AJGMoAIE6sR05EED6oAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":403,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":118,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71541,"flow_last_seen":71541,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":71541,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"5.180.62.100","src_port":28681,"dst_port":46385,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":403,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":1,"flow_last_seen":71541,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":71541,"pkt":"UlQAEjUCCAAn5uVZCABFAAA02U0AAIAREUUKAAIPBbQ+ZHAJtTEAICo0R05EED6pAQFUC1FLUlAGUk5BXS\/iNQlw"} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":405,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":2,"flow_last_seen":71605,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":71605,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAswAAEAGY0Nt1prYCgACDxjKxEgAewwBHNfF\/mAS\/\/+29AAAAgQFtA=="} +00436{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":406,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":3,"flow_last_seen":71605,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":71605,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo5AxAAIAGAgYKAAIPbdaa2MRIGMoc18X+AHsMAlAQ+vDTwAAA"} +00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":407,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":93,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":71205,"flow_last_seen":71608,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":304,"flow_tot_l4_payload_len":304,"flow_avg_l4_payload_len":76,"midstream":0,"thread_ts_msec":71608,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.214.154.216","src_port":50248,"dst_port":6346,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":411,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":3,"flow_last_seen":72031,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72031,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0B1xAAIAGzIMKAAIPVoHEVMQWJrsID0+\/AAAAAIAC+vAKmwAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":412,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":3,"flow_last_seen":72031,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72031,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xtxAAIAGndcKAAIPsIDZgMQYsIr8Y98AAAAAAIAC+vCOBwAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":413,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":3,"flow_last_seen":72031,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72031,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Iq5AAIAGH9QKAAIPTnpducQZGMpcVbolAAAAAIAC+vDIfgAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":414,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":2,"flow_last_seen":72156,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72156,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0VP1AAIAGOuoKAAIPQr0cEcQ6P42S8gLxAAAAAIAC+vBvlwAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":415,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":2,"flow_last_seen":72157,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72157,"pkt":"UlQAEjUCCAAn5uVZCABFAAA01LVAAIAGCWcKAAIPAaMO9sQ5MjZr2Fv\/AAAAAIAC+vCZMAAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":416,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":2,"flow_last_seen":72157,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72157,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0lyhAAIAGNGIKAAIPWHvKr8Q9lBZfEvXQAAAAAIAC+vCXrgAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":417,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":119,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72264,"flow_last_seen":72264,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":72264,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"27.94.154.53","src_port":50250,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":417,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":1,"flow_last_seen":72264,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72264,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0alNAAIAGzs4KAAIPG16aNcRKGMq+PzReAAAAAIAC+vDiygAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":418,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":120,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72265,"flow_last_seen":72265,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":72265,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.127.1.235","src_port":50251,"dst_port":37814,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":418,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":1,"flow_last_seen":72265,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72265,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0cvdAAIAGYVQKAAIPGH8B68RLk7Zj+37vAAAAAIAC+vASugAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":419,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":121,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72266,"flow_last_seen":72266,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":72266,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.202.31.113","src_port":50252,"dst_port":19768,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":419,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":121,"flow_packet_id":1,"flow_last_seen":72266,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72266,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0VqVAAIAG\/NQKAAIPe8ofccRMTThVM2MAAAAAAIAC+vADHQAAAgQFtAEDAwgBAQQC"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":420,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":122,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72266,"flow_last_seen":72266,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":72266,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":50253,"dst_port":43508,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":420,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":1,"flow_last_seen":72266,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72266,"pkt":"UlQAEjUCCAAn5uVZCABFAAA00URAAIAGSiQKAAIPZ+hrZMRNqfSI7oMUAAAAAIAC+vAafwAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":123,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72267,"flow_last_seen":72267,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":72267,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.78.134.188","src_port":50254,"dst_port":49046,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":1,"flow_last_seen":72267,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72267,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gnJAAIAGzTgKAAIPGE6GvMROv5bJBoRLAAAAAIAC+vD3zgAAAgQFtAEDAwgBAQQC"} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":422,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":2,"flow_last_seen":72462,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":72462,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAs8AAEAGtlsbXpo1CgACDxjKxEoAfQABvj80X2AS\/\/8GQwAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":423,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":3,"flow_last_seen":72462,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":72462,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoalRAAIAGztkKAAIPG16aNcRKGMq+PzRfAH0AAlAQ+vAjDwAA"} +00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":424,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":119,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72264,"flow_last_seen":72463,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":72463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"27.94.154.53","src_port":50250,"dst_port":6346,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":426,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":121,"flow_packet_id":2,"flow_last_seen":72471,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":72471,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAtEAAEAG0LF7yh9xCgACD004xEwAfvQBVTNjAWAS\/\/8ykwAAAgQFtA=="} +00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":427,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":121,"flow_packet_id":3,"flow_last_seen":72472,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":72472,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoVqZAAIAG\/N8KAAIPe8ofccRMTThVM2MBAH70AlAQ+vBPXwAA"} +00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":428,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":121,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72266,"flow_last_seen":72472,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":72472,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.202.31.113","src_port":50252,"dst_port":19768,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":433,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":2,"flow_last_seen":72595,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":72595,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAtUAAEAGmJxn6GtkCgACD6n0xE0Af+4BiO6DFWAS\/\/9P9AAAAgQFtA=="} +00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":434,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":3,"flow_last_seen":72596,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":72596,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo0UVAAIAGSi8KAAIPZ+hrZMRNqfSI7oMVAH\/uAlAQ+vBswAAA"} +00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":435,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":122,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72266,"flow_last_seen":72596,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":72596,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":50253,"dst_port":43508,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":450,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":124,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72848,"flow_last_seen":72848,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72848,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"170.254.19.6","src_port":28681,"dst_port":24180,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":450,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":1,"flow_last_seen":72848,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72848,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0XAwAAIARFJoKAAIPqv4TBnAJXnQAIAcER05EED6qAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":125,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72849,"flow_last_seen":72849,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72849,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.92.178.182","src_port":28681,"dst_port":57302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":1,"flow_last_seen":72849,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72849,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0qfwAAIARfpsKAAIPU1yytnAJ39YAID2SR05EED6rAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":452,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":126,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72849,"flow_last_seen":72849,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72849,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.69.159.133","src_port":28681,"dst_port":28000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":452,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":1,"flow_last_seen":72849,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72849,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0M\/8AAIAR\/+AKAAIPW0WfhXAJbWAAILtPR05EED6sAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":453,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":127,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72850,"flow_last_seen":72850,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72850,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.191.49.159","src_port":28681,"dst_port":1024,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":453,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":1,"flow_last_seen":72850,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72850,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0NSIAAIARFyoKAAIPsL8xn3AJBAAAID0bR05EED6tAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":454,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":128,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72850,"flow_last_seen":72850,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72850,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.141.219.27","src_port":28681,"dst_port":37580,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":454,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":128,"flow_packet_id":1,"flow_last_seen":72850,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72850,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09U0AAIARELQKAAIPTY3bG3AJkswAIGgDR05EED6uAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":456,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":129,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72850,"flow_last_seen":72850,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72850,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.138.50.179","src_port":28681,"dst_port":29411,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":456,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":129,"flow_packet_id":1,"flow_last_seen":72850,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72850,"pkt":"UlQAEjUCCAAn5uVZCABFAAA079wAAIARW5AKAAIPsIoys3AJcuMAIM1WR05EED6vAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":457,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":130,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72851,"flow_last_seen":72851,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72851,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.224.95.97","src_port":28681,"dst_port":46356,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":457,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":1,"flow_last_seen":72851,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72851,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0f64AAIAR17oKAAIPd+BfYXAJtRQAIJcgR05EED6wAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":458,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":131,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72851,"flow_last_seen":72851,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72851,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.225.140.186","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":458,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_last_seen":72851,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72851,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0hfsAAIARxRMKAAIPVuGMunAJGMoAICcQR05EED6xAQFUC1FLUlAGUk5BXS\/iNQlw"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":459,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":132,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72851,"flow_last_seen":72851,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72851,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"79.86.173.45","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":459,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":1,"flow_last_seen":72851,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72851,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xSwAAIARbPoKAAIPT1atLXAJGMoAIA4nR05EED6yAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":460,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":133,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72852,"flow_last_seen":72852,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72852,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.175.220.161","src_port":28681,"dst_port":15721,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":460,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":1,"flow_last_seen":72852,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72852,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09RcAAIARAUIKAAIPW6\/coXAJPWkAIK25R05EED6zAQFUC1FLUlAGUk5BXS\/iNQlw"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":461,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":134,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72852,"flow_last_seen":72852,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72852,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.231.73.14","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":461,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":1,"flow_last_seen":72852,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72852,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05pIAAIARsCIKAAIPTudJDnAJGMoAIHKzR05EED60AQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":462,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":135,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72852,"flow_last_seen":72852,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72852,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.250.99.158","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":462,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":135,"flow_packet_id":1,"flow_last_seen":72852,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72852,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0fT0AAIARi9QKAAIPwfpjnnAJGMoAIOUOR05EED61AQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":464,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":136,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72852,"flow_last_seen":72852,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72852,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.236.247.120","src_port":28681,"dst_port":16047,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":464,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":136,"flow_packet_id":1,"flow_last_seen":72852,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72852,"pkt":"UlQAEjUCCAAn5uVZCABFAAA02w4AAIARCzcKAAIPUOz3eHAJPq8AIJxcR05EED62AQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":466,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":137,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72853,"flow_last_seen":72853,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72853,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.65.70.197","src_port":28681,"dst_port":21693,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":466,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":137,"flow_packet_id":1,"flow_last_seen":72853,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72853,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05U8AAIARsFQKAAIPUkFGxXAJVL0AIDWsR05EED63AQFUC1FLUlAGUk5BXS\/iNQlw"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":467,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":138,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72853,"flow_last_seen":72853,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72853,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"167.114.170.156","src_port":28681,"dst_port":23844,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":467,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":1,"flow_last_seen":72853,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72853,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0jJIAAIARUAkKAAIPp3KqnHAJXSQAIHQ7R05EED64AQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":468,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":139,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72853,"flow_last_seen":72853,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72853,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.226.142","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":468,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":139,"flow_packet_id":1,"flow_last_seen":72853,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72853,"pkt":"UlQAEjUCCAAn5uVZCABFAAA077sAAIARtrYKAAIPpanijnAJGMoAIIJrR05EED65AQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":469,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":140,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72853,"flow_last_seen":72853,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72853,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.197.111.186","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":469,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":140,"flow_packet_id":1,"flow_last_seen":72853,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72853,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0JXgAAIARS7MKAAIPTcVvunAJGMoAIE0jR05EED66AQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":470,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":141,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72853,"flow_last_seen":72853,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":72853,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"172.97.199.14","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":470,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":141,"flow_packet_id":1,"flow_last_seen":72853,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":72853,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0s0kAAIARB\/EKAAIPrGHHDnAJGMoAIJcxR05EED67AQFUC1FLUlAGUk5BXS\/iNQlw"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":478,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":3,"flow_last_seen":73064,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":73064,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0kpVAAIAGVgUKAAIPWk6rzMQfGMqXoNUlAAAAAIAC+vAYRgAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":479,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":3,"flow_last_seen":73065,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":73065,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0FYFAAIAGQkoKAAIPfNoaEMQcJgCBbg3uAAAAAIAC+vBXrQAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":480,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":3,"flow_last_seen":73065,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":73065,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0XTJAAIAGk6kKAAIPci6Lq8Qdy5gelScRAAAAAIAC+vCU2gAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":481,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":2,"flow_last_seen":73188,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":73188,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0KcdAAIAGHhcKAAIPfNop\/cQ+5wgF3IcnAAAAAIAC+vCI7gAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":482,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":2,"flow_last_seen":73188,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":73188,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0UWxAAIAGasIKAAIPsIqB\/MRDbToYK0huAAAAAIAC+vCjcgAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":483,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":2,"flow_last_seen":73188,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":73188,"pkt":"UlQAEjUCCAAn5uVZCABFAAA01kNAAIAGdAYKAAIPcGk0AsQ\/GPASVmSCAAAAAIAC+vBvnQAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":484,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":2,"flow_last_seen":73188,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":73188,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0LJtAAIAGiMQKAAIPbdLLg8RCGMrxPNpbAAAAAIAC+vCGFQAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":485,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":2,"flow_last_seen":73188,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":73188,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0RnBAAIAGeMAKAAIPJO0KmMRAUy2fhJtvAAAAAIAC+vDmKQAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":486,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":2,"flow_last_seen":73188,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":73188,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0A99AAIAG2\/MKAAIPYhKs0MRB9sQLj4LfAAAAAIAC+vAPuQAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":487,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":142,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":73299,"flow_last_seen":73299,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":73299,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":50255,"dst_port":52165,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":487,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":142,"flow_packet_id":1,"flow_last_seen":73299,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":73299,"pkt":"UlQAEjUCCAAn5uVZCABFAAA00EFAAIAGLmIKAAIPJOzLJcRPy8UyAvKaAAAAAIAC+vDDTAAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":488,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":143,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":73299,"flow_last_seen":73299,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":73299,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.201.161","src_port":50256,"dst_port":2886,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":488,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":143,"flow_packet_id":1,"flow_last_seen":73299,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":73299,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0\/FxAAIAGA84KAAIPJOnJocRQC0aEhFh7AAAAAIAC+vDM7wAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":489,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":144,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":73300,"flow_last_seen":73300,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":73300,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.48.23","src_port":50257,"dst_port":3054,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":489,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":144,"flow_packet_id":1,"flow_last_seen":73300,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":73300,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0+GxAAIAG6uoKAAIP20YwF8RRC+6AEyaiAAAAAIAC+vDlvQAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":490,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":145,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":73301,"flow_last_seen":73301,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":73301,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.100.216.210","src_port":50258,"dst_port":7097,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":490,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":145,"flow_packet_id":1,"flow_last_seen":73301,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":73301,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0hYZAAIAGFfgKAAIPemTY0sRSG7mAD45dAAAAAIAC+vAmYQAAAgQFtAEDAwgBAQQC"} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":143,"flow_packet_id":2,"flow_last_seen":73603,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":73603,"pkt":"CAAn5uVZUlQAEjUCCABFAAAoAuUAAP8GvlEk6cmhCgACDwtGxFAAAAAAhIRYfFAUAAAIoAAA"} +00700{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":492,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_last_seen":73950,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":243,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":243,"pkt_l4_len":209,"thread_ts_msec":73950,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAADlHPwAAIARA\/8KAAIPCgAC\/wCKAIoA0UBrEQKcLgoAAg8AigC7AAAgRU5GREVGRUVFSEVGRkhFSkVPREJEQUNBQ0FDQUNBQ0EAIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUJOAP9TTUIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQAAIQAAAAAAAAAAAOgDAAAAAAAAAAAhAFYAAwABAAAAAgAyAFxNQUlMU0xPVFxCUk9XU0UAAQDA1AEATVNFREdFV0lOMTAAAAAAAAoAAxAAAA8BVaoA"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":493,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":3,"flow_last_seen":74092,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74092,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0pXBAAIAGEbUKAAIPJOoSpsQi79zHbZnNAAAAAIAC+vAbRgAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":494,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":3,"flow_last_seen":74092,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74092,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0q81AAIAGVuQKAAIPd+10FsQgIevuSsSrAAAAAIAC+vDjCgAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":495,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":3,"flow_last_seen":74092,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74092,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0DWxAAIAG8swKAAIPVXWZB8Qlw9oAc\/5TAAAAAIAC+vDyzAAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":496,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":3,"flow_last_seen":74093,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74093,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0NVxAAIAG3h8KAAIPXxF8KMQkGnhkTfi6AAAAAIAC+vBRMgAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":497,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":3,"flow_last_seen":74093,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74093,"pkt":"UlQAEjUCCAAn5uVZCABFAAA02YJAAIAG1DcKAAIPcfzO\/sQhwbNg4z+5AAAAAIAC+vAApAAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":498,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":143,"flow_packet_id":3,"flow_last_seen":74108,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74108,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0\/F1AAIAGA80KAAIPJOnJocRQC0aEhFh7AAAAAIAC+vDM7wAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":499,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":2,"flow_last_seen":74217,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74217,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Dd5AAIAGwQMKAAIPQh7dtcRHyWh8xjFMAAAAAIAC+vAMegAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":500,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":2,"flow_last_seen":74218,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74218,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0IwxAAIAGfuEKAAIPUAf8wMRGsnV8RDFlAAAAAIAC+vD24gAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":2,"flow_last_seen":74218,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74218,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0c0NAAIAGin0KAAIPvD00t8RE+erRmdziAAAAAIAC+vAKcAAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":502,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":2,"flow_last_seen":74218,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74218,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0I3RAAIAGoE0KAAIPST7htcRFtvuqIJp6AAAAAIAC+vB9QAAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":503,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":146,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":74327,"flow_last_seen":74327,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":74327,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.90.112","src_port":50259,"dst_port":9852,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":503,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":1,"flow_last_seen":74327,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74327,"pkt":"UlQAEjUCCAAn5uVZCABFAAA04otAAIAG+gUKAAIPt7NacMRTJnw0vRokAAAAAIAC+vAcPAAAAgQFtAEDAwgBAQQC"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":504,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":147,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":74328,"flow_last_seen":74328,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":74328,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.200.161","src_port":50260,"dst_port":51394,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":504,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":147,"flow_packet_id":1,"flow_last_seen":74328,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74328,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xdJAAIAG7kEKAAIPcf\/IocRUyMI6N6PeAAAAAIAC+vDCQgAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":505,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":148,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":74328,"flow_last_seen":74328,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":74328,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"156.57.42.2","src_port":50261,"dst_port":33476,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":505,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":1,"flow_last_seen":74328,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74328,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0ZARAAIAGxHUKAAIPnDkqAsRVgsQy7nYLAAAAAIAC+vCxwQAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":506,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":149,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":74329,"flow_last_seen":74329,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":74329,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":50262,"dst_port":30577,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":506,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":1,"flow_last_seen":74329,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":74329,"pkt":"UlQAEjUCCAAn5uVZCABFAAA07XNAAIAG0w0KAAIPUD3d9sRWd3H5FzmMAAAAAIAC+vDLcAAAAgQFtAEDAwgBAQQC"} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":507,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":2,"flow_last_seen":74362,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":74362,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAuYAAEAGPaRQPd32CgACD3dxxFYAg9YB+Rc5jWAS\/\/8Y4gAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":508,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":3,"flow_last_seen":74362,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":74362,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo7XRAAIAG0xgKAAIPUD3d9sRWd3H5FzmNAIPWAlAQ+vA1rgAA"} +00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":509,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":149,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":74329,"flow_last_seen":74362,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":74362,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":50262,"dst_port":30577,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":517,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":2,"flow_last_seen":74510,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":74510,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAuwAAEAGWa63s1pwCgACDyZ8xFMAhNABNL0aJWAS\/\/9vrAAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":518,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":3,"flow_last_seen":74510,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":74510,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo4oxAAIAG+hAKAAIPt7NacMRTJnw0vRolAITQAlAQ+vCMeAAA"} +00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":519,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":146,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":74327,"flow_last_seen":74511,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":74511,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.90.112","src_port":50259,"dst_port":9852,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":527,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":3,"flow_last_seen":75077,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75077,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0ZdtAAIAGUVoKAAIPtpuA5MQoDLg79XydAAAAAIAC+vCnHQAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":528,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":3,"flow_last_seen":75077,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75077,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0FTlAAIAG3SgKAAIPUMGrksQm0jCYt6bIAAAAAIAC+vCV5QAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":529,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":3,"flow_last_seen":75077,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75077,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0d8RAAIAGrlIKAAIPcfxWosQp1q4KULlcAAAAAIAC+vBA7QAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":3,"flow_last_seen":75077,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75077,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0EVBAAIAGi58KAAIPWmf3XsQq5qXgntCpAAAAAIAC+vC6MQAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":531,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":3,"flow_last_seen":75077,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75077,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Co5AAIAGJkYKAAIPfPRA7cQnEmB1c07JAAAAAIAC+vAPawAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":532,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":3,"flow_last_seen":75108,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75108,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gZBAAIAGBp8KAAIPwXmlDMQr2FBBRhZnAAAAAIAC+vANYQAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":534,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":2,"flow_last_seen":75264,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75264,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gnNAAIAGzTcKAAIPGE6GvMROv5bJBoRLAAAAAIAC+vD3zgAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":535,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":2,"flow_last_seen":75280,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75280,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0cvhAAIAGYVMKAAIPGH8B68RLk7Zj+37vAAAAAIAC+vASugAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":536,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":150,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":75358,"flow_last_seen":75358,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":75358,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.182.136.42","src_port":50263,"dst_port":27873,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":536,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":1,"flow_last_seen":75358,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75358,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xOZAAIAGV+4KAAIPSbaIKsRXbOGIdOVZAAAAAIAC+vD3KAAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":537,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":151,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":75358,"flow_last_seen":75358,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":75358,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":50264,"dst_port":48380,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":537,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":151,"flow_packet_id":1,"flow_last_seen":75358,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75358,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0GYdAAIAGqOAKAAIPXwrNQ8RYvPy3IUp\/AAAAAIAC+vC4zAAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":538,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":152,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":75359,"flow_last_seen":75359,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":75359,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.250.32","src_port":50265,"dst_port":52647,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":538,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":152,"flow_packet_id":1,"flow_last_seen":75359,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75359,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0bsVAAIAGE9AKAAIPcf\/6IMRZzacG03PuAAAAAIAC+vDvLQAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":539,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":153,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":75359,"flow_last_seen":75359,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":75359,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.175.103","src_port":50266,"dst_port":4315,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":539,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":153,"flow_packet_id":1,"flow_last_seen":75359,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":75359,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0DLlAAIAGV04KAAIP20avZ8RaENsT5fMFAAAAAIAC+vABQgAAAgQFtAEDAwgBAQQC"} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":540,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":2,"flow_last_seen":75482,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":75482,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAvIAAEAGpZCcOSoCCgACD4LExFUAh74BMu52DGAS\/\/8XLwAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":541,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":3,"flow_last_seen":75482,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":75482,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoZAVAAIAGxIAKAAIPnDkqAsRVgsQy7nYMAIe+AlAQ+vAz+wAA"} +00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":542,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":148,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":74328,"flow_last_seen":75501,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":597,"flow_tot_l4_payload_len":597,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":75501,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"156.57.42.2","src_port":50261,"dst_port":33476,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":545,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":153,"flow_packet_id":2,"flow_last_seen":75731,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":75731,"pkt":"CAAn5uVZUlQAEjUCCABFAAAoAvQAAP8GIh\/bRq9nCgACDxDbxFoAAAAAE+XzBlAUAAA88gAA"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":546,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":3,"flow_last_seen":76122,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":76122,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0UtJAAIAGDgUKAAIPTn0\/YcQwGMq9KdLlAAAAAIAC+vBtKAAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":547,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":3,"flow_last_seen":76122,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":76122,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0R05AAIAGN+MKAAIPdqf43MQv9oQzn2SqAAAAAIAC+vCljgAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":548,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":3,"flow_last_seen":76122,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":76122,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0faNAAIAGiKQKAAIPO2itBcQtwyRMUgplAAAAAIAC+vChmQAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":549,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":3,"flow_last_seen":76122,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":76122,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0+zhAAIAGNBcKAAIPbdJRk8QxYOCX52ZFAAAAAIAC+vCFbAAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":550,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":153,"flow_packet_id":3,"flow_last_seen":76233,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":76233,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0DLpAAIAGV00KAAIP20avZ8RaENsT5fMFAAAAAIAC+vABQgAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":551,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":144,"flow_packet_id":2,"flow_last_seen":76326,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":76326,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0+G1AAIAG6ukKAAIP20YwF8RRC+6AEyaiAAAAAIAC+vDlvQAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":552,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":142,"flow_packet_id":2,"flow_last_seen":76326,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":76326,"pkt":"UlQAEjUCCAAn5uVZCABFAAA00EJAAIAGLmEKAAIPJOzLJcRPy8UyAvKaAAAAAIAC+vDDTAAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":553,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":145,"flow_packet_id":2,"flow_last_seen":76326,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":76326,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0hYdAAIAGFfcKAAIPemTY0sRSG7mAD45dAAAAAIAC+vAmYQAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":555,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":3,"flow_last_seen":77122,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":77122,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0K4pAAIAGtdYKAAIPb\/adXsQzx+daqkeOAAAAAIAC+vAsaAAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":556,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":3,"flow_last_seen":77122,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":77122,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0vG5AAIAGN8cKAAIPAST5W8Q1\/ZgxDGGiAAAAAIAC+vAZFAAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":557,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":3,"flow_last_seen":77122,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":77122,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0BKJAAIAGOesKAAIPSQNnJcQ2Q5DEXLK5AAAAAIAC+vA5CwAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":559,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":3,"flow_last_seen":77138,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":77138,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0ZZtAAIAGsgYKAAIPTESKz8Q3sBfW5xLuAAAAAIAC+vAy2AAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":560,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":147,"flow_packet_id":2,"flow_last_seen":77329,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":77329,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xdNAAIAG7kAKAAIPcf\/IocRUyMI6N6PeAAAAAIAC+vDCQgAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":562,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":3,"flow_last_seen":78169,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":78169,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0VP5AAIAGOukKAAIPQr0cEcQ6P42S8gLxAAAAAIAC+vBvlwAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":563,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":3,"flow_last_seen":78169,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":78169,"pkt":"UlQAEjUCCAAn5uVZCABFAAA01LZAAIAGCWYKAAIPAaMO9sQ5MjZr2Fv\/AAAAAIAC+vCZMAAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":564,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":3,"flow_last_seen":78169,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":78169,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0lylAAIAGNGEKAAIPWHvKr8Q9lBZfEvXQAAAAAIAC+vCXrgAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":565,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":151,"flow_packet_id":2,"flow_last_seen":78374,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":78374,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0GYhAAIAGqN8KAAIPXwrNQ8RYvPy3IUp\/AAAAAIAC+vC4zAAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":566,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":2,"flow_last_seen":78374,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":78374,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xOdAAIAGV+0KAAIPSbaIKsRXbOGIdOVZAAAAAIAC+vD3KAAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":567,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":152,"flow_packet_id":2,"flow_last_seen":78374,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":78374,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0bsZAAIAGE88KAAIPcf\/6IMRZzacG03PuAAAAAIAC+vDvLQAAAgQFtAEDAwgBAQQC"} +00752{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":570,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":63001,"flow_last_seen":78517,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":99,"midstream":0,"thread_ts_msec":78517,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":50198,"dst_port":9915,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":577,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":3,"flow_last_seen":79200,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":79200,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0KchAAIAGHhYKAAIPfNop\/cQ+5wgF3IcnAAAAAIAC+vCI7gAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":578,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":3,"flow_last_seen":79201,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":79201,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0UW1AAIAGasEKAAIPsIqB\/MRDbToYK0huAAAAAIAC+vCjcgAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":579,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":3,"flow_last_seen":79201,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":79201,"pkt":"UlQAEjUCCAAn5uVZCABFAAA01kRAAIAGdAUKAAIPcGk0AsQ\/GPASVmSCAAAAAIAC+vBvnQAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":3,"flow_last_seen":79201,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":79201,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0A+BAAIAG2\/IKAAIPYhKs0MRB9sQLj4LfAAAAAIAC+vAPuQAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":581,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":3,"flow_last_seen":79201,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":79201,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0LJxAAIAGiMMKAAIPbdLLg8RCGMrxPNpbAAAAAIAC+vCGFQAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":582,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":3,"flow_last_seen":79201,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":79201,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0RnFAAIAGeL8KAAIPJO0KmMRAUy2fhJtvAAAAAIAC+vDmKQAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":583,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":3,"flow_last_seen":80232,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":80232,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Dd9AAIAGwQIKAAIPQh7dtcRHyWh8xjFMAAAAAIAC+vAMegAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":584,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":3,"flow_last_seen":80232,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":80232,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Iw1AAIAGfuAKAAIPUAf8wMRGsnV8RDFlAAAAAIAC+vD24gAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":585,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":3,"flow_last_seen":80232,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":80232,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0c0RAAIAGinwKAAIPvD00t8RE+erRmdziAAAAAIAC+vAKcAAAAgQFtAEDAwgBAQQC"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":586,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":3,"flow_last_seen":80232,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":80232,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0I3VAAIAGoEwKAAIPST7htcRFtvuqIJp6AAAAAIAC+vB9QAAAAgQFtAEDAwgBAQQC"} +00462{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":587,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":2,"flow_last_seen":80247,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":80247,"pkt":"CAAn5uVZUlQAEjUCCABFwAA4AvwAAP8Bn\/gKAAICCgACDwMBntkAAAAARQAANGWbQAB\/BrMGCgACD0xEis\/EN7AX1ucS7g=="} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":588,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":3,"flow_last_seen":81278,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":81278,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gnRAAIAGzTYKAAIPGE6GvMROv5bJBoRLAAAAAIAC+vD3zgAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":589,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":3,"flow_last_seen":81294,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":81294,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0cvlAAIAGYVIKAAIPGH8B68RLk7Zj+37vAAAAAIAC+vASugAAAgQFtAEDAwgBAQQC"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":593,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":154,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82057,"flow_last_seen":82057,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82057,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"174.115.111.224","src_port":28681,"dst_port":51984,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":593,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":154,"flow_packet_id":1,"flow_last_seen":82057,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82057,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0vx8AAIARUTcKAAIPrnNv4HAJyxAAIDoGR05EED68AQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":594,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":155,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82057,"flow_last_seen":82057,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82057,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.168.182.103","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":594,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":155,"flow_packet_id":1,"flow_last_seen":82057,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82057,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0SSkAAIAR1nEKAAIPWKi2Z3AJGMoAIPuPR05EED69AQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":595,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":156,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82057,"flow_last_seen":82057,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82057,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.244.228.86","src_port":28681,"dst_port":10131,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":595,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":156,"flow_packet_id":1,"flow_last_seen":82057,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82057,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0lsIAAIARXJ0KAAIPVvTkVnAJJ5MAIMCKR05EED6+AQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":596,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":157,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82058,"flow_last_seen":82058,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82058,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.227.162.150","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":596,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":1,"flow_last_seen":82058,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82058,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0rD0AAIARiPMKAAIPVuOilnAJGMoAIBEkR05EED6\/AQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":597,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":158,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82058,"flow_last_seen":82058,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82058,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.166.226.70","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":597,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":1,"flow_last_seen":82058,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82058,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0SbkAAIARjAQKAAIPdqbiRnAJGMoAILGvR05EED7AAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":598,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":159,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82058,"flow_last_seen":82058,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82058,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.163.231.160","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":598,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":1,"flow_last_seen":82058,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82058,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0dT8AAIARIScKAAIPsKPnoHAJGMoAIHJXR05EED7BAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":599,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":160,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82058,"flow_last_seen":82058,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82058,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.150.49.35","src_port":28681,"dst_port":32448,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":599,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":160,"flow_packet_id":1,"flow_last_seen":82058,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82058,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0XrkAAIARSzgKAAIPU5YxI3AJfsAAIB\/rR05EED7CAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":600,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":161,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82058,"flow_last_seen":82058,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82058,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.120.26.86","src_port":28681,"dst_port":29946,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":600,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":161,"flow_packet_id":1,"flow_last_seen":82058,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82058,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0tpQAAIARiEcKAAIP1XgaVnAJdPoAIL6aR05EED7DAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":601,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":162,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82059,"flow_last_seen":82059,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82059,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.123.159.111","src_port":28681,"dst_port":44729,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":601,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":162,"flow_packet_id":1,"flow_last_seen":82059,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82059,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0COQAAIARLdwKAAIPWHufb3AJrrkAIHy+R05EED7EAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":602,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":163,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82059,"flow_last_seen":82059,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82059,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.126.160.158","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":602,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":163,"flow_packet_id":1,"flow_last_seen":82059,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82059,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0yVcAAIARbDYKAAIPWH6gnnAJGMoAIBF7R05EED7FAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":603,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":164,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82059,"flow_last_seen":82059,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82059,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.197.219.85","src_port":28681,"dst_port":26234,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":603,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":164,"flow_packet_id":1,"flow_last_seen":82059,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82059,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0MzgAAIARkVcKAAIPjsXbVXAJZnoAIFLLR05EED7GAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":604,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":165,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82059,"flow_last_seen":82059,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82059,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.75.43.182","src_port":28681,"dst_port":43502,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":604,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":165,"flow_packet_id":1,"flow_last_seen":82059,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82059,"pkt":"UlQAEjUCCAAn5uVZCABFAAA06P0AAIARw6sKAAIPVksrtnAJqe4AIPdvR05EED7HAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":605,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":166,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82059,"flow_last_seen":82059,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82059,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.59.253.186","src_port":28681,"dst_port":15555,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":605,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":166,"flow_packet_id":1,"flow_last_seen":82059,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82059,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0rnEAAIARKEMKAAIPWjv9unAJPMMAII6lR05EED7IAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":606,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":167,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82059,"flow_last_seen":82059,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82059,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.29.107.176","src_port":28681,"dst_port":20363,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":606,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":167,"flow_packet_id":1,"flow_last_seen":82059,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82059,"pkt":"UlQAEjUCCAAn5uVZCABFAAA08GUAAIARdXcKAAIPXR1rsHAJT4sAIAsFR05EED7JAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":607,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":168,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82059,"flow_last_seen":82059,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82059,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.157.59.43","src_port":28681,"dst_port":56919,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":607,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":168,"flow_packet_id":1,"flow_last_seen":82059,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82059,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0cs0AAIARJxUKAAIPWZ07K3AJ3lcAILA8R05EED7KAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":608,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":169,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82060,"flow_last_seen":82060,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82060,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.162.52.93","src_port":28681,"dst_port":34799,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":608,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":169,"flow_packet_id":1,"flow_last_seen":82060,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82060,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0VdQAAIARSNcKAAIPW6I0XXAJh+8AIAttR05EED7LAQFUC1FLUlAGUk5BXS\/iNQlw"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":609,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":170,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82060,"flow_last_seen":82060,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82060,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"67.193.8.52","src_port":28681,"dst_port":38584,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":609,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":170,"flow_packet_id":1,"flow_last_seen":82060,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82060,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0mmsAAIARSEoKAAIPQ8EINHAJlrgAIECtR05EED7MAQFUC1FLUlAGUk5BXS\/iNQlw"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":610,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":171,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82060,"flow_last_seen":82060,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82060,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"196.217.132.111","src_port":28681,"dst_port":25394,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":610,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":171,"flow_packet_id":1,"flow_last_seen":82060,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82060,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0mjkAAIARSygKAAIPxNmEb3AJYzIAIHbeR05EED7NAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":611,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":172,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82060,"flow_last_seen":82060,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82060,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.69.142.133","src_port":28681,"dst_port":15471,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":611,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":172,"flow_packet_id":1,"flow_last_seen":82060,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82060,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0dBwAAIAR1MMKAAIPV0WOhXAJPG8AIAEfR05EED7OAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":612,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":173,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82060,"flow_last_seen":82060,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82060,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"121.99.222.36","src_port":28681,"dst_port":44988,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":612,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":173,"flow_packet_id":1,"flow_last_seen":82060,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82060,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0TpsAAIARiIcKAAIPeWPeJHAJr7wAIBwTR05EED7PAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":613,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":174,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82060,"flow_last_seen":82060,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82060,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"196.74.159.56","src_port":28681,"dst_port":29271,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":613,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":174,"flow_packet_id":1,"flow_last_seen":82060,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82060,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0\/XsAAIARzasKAAIPxEqfOHAJclcAIE18R05EED7QAQFUC1FLUlAGUk5BXS\/iNQlw"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":614,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":175,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82060,"flow_last_seen":82060,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82060,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"115.69.62.99","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":614,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":1,"flow_last_seen":82060,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82060,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0v80AAIARvTQKAAIPc0U+Y3AJGMoAIFjjR05EED7RAQFUC1FLUlAGUk5BXS\/iNQlw"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":615,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":176,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82061,"flow_last_seen":82061,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82061,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.99.164.4","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":615,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":176,"flow_packet_id":1,"flow_last_seen":82061,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82061,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0nFAAAIARxPIKAAIPKWOkBHAJGMoAID0jR05EED7SAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":616,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":177,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82061,"flow_last_seen":82061,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82061,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.157.183.106","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":616,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":177,"flow_packet_id":1,"flow_last_seen":82061,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82061,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xBEAAIARbZEKAAIPRZ23anAJGMoAIA2CR05EED7TAQFUC1FLUlAGUk5BXS\/iNQlw"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":617,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":178,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82061,"flow_last_seen":82061,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82061,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.46.253.7","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":617,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":178,"flow_packet_id":1,"flow_last_seen":82061,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82061,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0oQgAAIARPWwKAAIPUy79B3AJGMoAILpSR05EED7UAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":618,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":179,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82061,"flow_last_seen":82061,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82061,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"178.51.146.115","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":618,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":179,"flow_packet_id":1,"flow_last_seen":82061,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82061,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0XmMAAIARi6AKAAIPsjOSc3AJGMoAIMXgR05EED7VAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":619,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":180,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82061,"flow_last_seen":82061,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82061,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.131.24.72","src_port":28681,"dst_port":30711,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":619,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":180,"flow_packet_id":1,"flow_last_seen":82061,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82061,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0amcAAIARaXgKAAIPQoMYSHAJd\/cAIFCOR05EED7WAQFUC1FLUlAGUk5BXS\/iNQlw"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":620,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":181,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82061,"flow_last_seen":82061,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82061,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.177.5.135","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":620,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":181,"flow_packet_id":1,"flow_last_seen":82061,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82061,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0DHwAAIAR2fYKAAIPQrEFh3AJGMoAIMJNR05EED7XAQFUC1FLUlAGUk5BXS\/iNQlw"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":621,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":182,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82062,"flow_last_seen":82062,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82062,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.3.103.37","src_port":28681,"dst_port":35589,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":621,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":182,"flow_packet_id":1,"flow_last_seen":82062,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82062,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0BKMAAIARed8KAAIPSQNnJXAJiwUAIOggR05EED7YAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":622,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":183,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82062,"flow_last_seen":82062,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82062,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.172.15.182","src_port":28681,"dst_port":37829,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":622,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":183,"flow_packet_id":1,"flow_last_seen":82062,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82062,"pkt":"UlQAEjUCCAAn5uVZCABFAAA085cAAIARz7AKAAIPW6wPtnAJk8UAICQmR05EED7ZAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":623,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":184,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82062,"flow_last_seen":82062,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82062,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.239.62.213","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":623,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":184,"flow_packet_id":1,"flow_last_seen":82062,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82062,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09AoAAIARpNsKAAIPVu8+1XAJGMoAIHS+R05EED7aAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":624,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":185,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82062,"flow_last_seen":82062,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82062,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.196.58","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":624,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":185,"flow_packet_id":1,"flow_last_seen":82062,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82062,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0tZ8AAIARR0wKAAIPbYTEOnAJGMoAINjCR05EED7bAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":625,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":186,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82062,"flow_last_seen":82062,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82062,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.182.44.202","src_port":28681,"dst_port":30277,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":625,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":186,"flow_packet_id":1,"flow_last_seen":82062,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82062,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gcEAAIARJGkKAAIPW7YsynAJdkUAICSFR05EED7cAQFUC1FLUlAGUk5BXS\/iNQlw"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":626,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":187,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82062,"flow_last_seen":82062,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82062,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.88.92.56","src_port":28681,"dst_port":21009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":626,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":1,"flow_last_seen":82062,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82062,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0uoAAAIARu5kKAAIPXFhcOHAJUhEAIBioR05EED7dAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":188,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82062,"flow_last_seen":82062,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82062,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.134.107.32","src_port":28681,"dst_port":38836,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":188,"flow_packet_id":1,"flow_last_seen":82062,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82062,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05JMAAIARi3AKAAIPU4ZrIHAJl7QAIMztR05EED7eAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":628,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":189,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82063,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"115.195.105.243","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":628,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":189,"flow_packet_id":1,"flow_last_seen":82063,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82063,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Q2AAAIARDZQKAAIPc8Np83AJGMoAICzHR05EED7fAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":629,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":190,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82063,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.195.227","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":629,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":190,"flow_packet_id":1,"flow_last_seen":82063,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82063,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0VbkAAIARb2QKAAIPpanD43AJGMoAIKDvR05EED7gAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":630,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":191,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82063,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.153.143.54","src_port":28681,"dst_port":65535,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":630,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":191,"flow_packet_id":1,"flow_last_seen":82063,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82063,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0RwMAAIARmdcKAAIPvpmPNnAJ\/\/8AINV1R05EED7hAQFUC1FLUlAGUk5BXS\/iNQlw"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":631,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":192,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82063,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.8.59.80","src_port":28681,"dst_port":35192,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":631,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":192,"flow_packet_id":1,"flow_last_seen":82063,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82063,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0aoUAAIARLM0KAAIPXAg7UHAJiXgAIAJ0R05EED7iAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":632,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":193,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82063,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.44.126.74","src_port":28681,"dst_port":54633,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":632,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":193,"flow_packet_id":1,"flow_last_seen":82063,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82063,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0rRwAAIARRxcKAAIPvCx+SnAJ1WkAIBNjR05EED7jAQFUC1FLUlAGUk5BXS\/iNQlw"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":633,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":194,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82063,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.150.126.156","src_port":28681,"dst_port":16471,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":633,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":194,"flow_packet_id":1,"flow_last_seen":82063,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82063,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09TYAAIARCkEKAAIPsJZ+nHAJQFcAILO4R05EED7kAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":634,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":195,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82063,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"177.231.151.16","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":634,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":195,"flow_packet_id":1,"flow_last_seen":82063,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82063,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0D4MAAIAR1i8KAAIPseeXEHAJGMoAIMF\/R05EED7lAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":635,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":196,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82064,"flow_last_seen":82064,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82064,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.127.72.106","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":635,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":196,"flow_packet_id":1,"flow_last_seen":82064,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82064,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0z+UAAIARvdsKAAIPWH9IanAJGMoAIGmNR05EED7mAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":636,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":197,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82064,"flow_last_seen":82064,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82064,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"208.92.106.151","src_port":28681,"dst_port":32476,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":636,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":197,"flow_packet_id":1,"flow_last_seen":82064,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82064,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0dXQAAIARfkIKAAIP0Fxql3AJftwAIGlvR05EED7nAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":637,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":198,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82064,"flow_last_seen":82064,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82064,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.182.171.50","src_port":28681,"dst_port":15180,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":637,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":198,"flow_packet_id":1,"flow_last_seen":82064,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82064,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0h78AAIARwQIKAAIPOrarMnAJO0wAIAIKR05EED7oAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":638,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":199,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82064,"flow_last_seen":82064,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82064,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.73.129.26","src_port":28681,"dst_port":53585,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":638,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":199,"flow_packet_id":1,"flow_last_seen":82064,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82064,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0OpsAAIARAKwKAAIPckmBGnAJ0VEAIF6IR05EED7pAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":639,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":200,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82064,"flow_last_seen":82064,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82064,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"138.199.16.123","src_port":28681,"dst_port":52993,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":639,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":200,"flow_packet_id":1,"flow_last_seen":82064,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82064,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0oO4AAIAR8nkKAAIPiscQe3AJzwEAILj4R05EED7qAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":640,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":201,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82065,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.170.209.214","src_port":28681,"dst_port":46210,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":640,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":201,"flow_packet_id":1,"flow_last_seen":82065,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82065,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0ANIAAIARBlgKAAIPVarR1nAJtIIAIEc4R05EED7rAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":641,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":202,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82065,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.134.139.39","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":641,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":202,"flow_packet_id":1,"flow_last_seen":82065,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82065,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0K1QAAIARx6gKAAIPsIaLJ3AJGMoAIM7CR05EED7sAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":642,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":203,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82065,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"120.156.204.38","src_port":28681,"dst_port":54832,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":642,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":203,"flow_packet_id":1,"flow_last_seen":82065,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82065,"pkt":"UlQAEjUCCAAn5uVZCABFAAA06YYAAIARAGEKAAIPeJzMJnAJ1jAAIAhGR05EED7tAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":643,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":204,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82065,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.126.240.32","src_port":28681,"dst_port":45313,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":643,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":204,"flow_packet_id":1,"flow_last_seen":82065,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82065,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0TesAAIARnCAKAAIPVH7wIHAJsQEAIC2YR05EED7uAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":644,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":205,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82065,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.29.197.138","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":644,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":205,"flow_packet_id":1,"flow_last_seen":82065,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82065,"pkt":"UlQAEjUCCAAn5uVZCABFAAA00QQAAIARN\/4KAAIPYB3FinAJGMoAIOTFR05EED7vAQFUC1FLUlAGUk5BXS\/iNQlw"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":645,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":206,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82066,"flow_last_seen":82066,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82066,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.166.132.204","src_port":28681,"dst_port":11194,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":645,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":206,"flow_packet_id":1,"flow_last_seen":82066,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82066,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0GtoAAIARuV0KAAIP1aaEzHAJK7oAIJ0JR05EED7wAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":646,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":207,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82066,"flow_last_seen":82066,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82066,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.242.191.215","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":646,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":207,"flow_packet_id":1,"flow_last_seen":82066,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82066,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0J\/gAAIAR9OgKAAIPUfK\/13AJGMoAIPihR05EED7xAQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":647,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":208,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82066,"flow_last_seen":82066,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82066,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.249.64.215","src_port":28681,"dst_port":25058,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":647,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":208,"flow_packet_id":1,"flow_last_seen":82066,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82066,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0e5YAAIARIEQKAAIPUflA13AJYeIAIC6CR05EED7yAQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":648,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":209,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82066,"flow_last_seen":82066,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":82066,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.179.98.234","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":648,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":209,"flow_packet_id":1,"flow_last_seen":82066,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82066,"pkt":"UlQAEjUCCAAn5uVZCABFAAA06UQAAIARhsgKAAIPW7Ni6nAJGMoAIEvMR05EED7zAQFUC1FLUlAGUk5BXS\/iNQlw"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":650,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":144,"flow_packet_id":3,"flow_last_seen":82326,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82326,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0+G5AAIAG6ugKAAIP20YwF8RRC+6AEyaiAAAAAIAC+vDlvQAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":651,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":142,"flow_packet_id":3,"flow_last_seen":82326,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82326,"pkt":"UlQAEjUCCAAn5uVZCABFAAA00ENAAIAGLmAKAAIPJOzLJcRPy8UyAvKaAAAAAIAC+vDDTAAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":652,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":145,"flow_packet_id":3,"flow_last_seen":82326,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":82326,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0hYhAAIAGFfYKAAIPemTY0sRSG7mAD45dAAAAAIAC+vAmYQAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":655,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":147,"flow_packet_id":3,"flow_last_seen":83345,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":83345,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xdRAAIAG7j8KAAIPcf\/IocRUyMI6N6PeAAAAAIAC+vDCQgAAAgQFtAEDAwgBAQQC"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":661,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":210,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83517,"flow_last_seen":83517,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":83517,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.100.120.146","src_port":28681,"dst_port":12838,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":661,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":210,"flow_packet_id":1,"flow_last_seen":83517,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":83517,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0bTAAAIARH4QKAAIPKWR4knAJMiYAIE8WR05EED70AQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":662,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":211,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83517,"flow_last_seen":83517,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":83517,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"186.93.139.92","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":662,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":211,"flow_packet_id":1,"flow_last_seen":83517,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":83517,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0DJEAAIAR3F8KAAIPul2LXHAJGMoAIMStR05EED71AQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":663,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":212,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83518,"flow_last_seen":83518,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":83518,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.3.223","src_port":28681,"dst_port":12848,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":663,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":212,"flow_packet_id":1,"flow_last_seen":83518,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":83518,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0D6MAAIAR9j8KAAIPJOkD33AJMjAAIMg4R05EED72AQFUC1FLUlAGUk5BXS\/iNQlw"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":664,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":213,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83518,"flow_last_seen":83518,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":83518,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"5.180.62.37","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":664,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":213,"flow_packet_id":1,"flow_last_seen":83518,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":83518,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0zQUAAIARHcwKAAIPBbQ+JXAJGMoAIMaMR05EED73AQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":665,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":214,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83518,"flow_last_seen":83518,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":83518,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.169.215.227","src_port":28681,"dst_port":26820,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":665,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":214,"flow_packet_id":1,"flow_last_seen":83518,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":83518,"pkt":"UlQAEjUCCAAn5uVZCABFAAA024QAAIARH5kKAAIPW6nX43AJaMQAIIbdR05EED74AQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":667,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":215,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83519,"flow_last_seen":83519,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":83519,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.159.27.22","src_port":28681,"dst_port":17563,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":667,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":215,"flow_packet_id":1,"flow_last_seen":83519,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":83519,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0JvAAAIARngUKAAIPTp8bFnAJRJsAIHTdR05EED75AQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":669,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":216,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83519,"flow_last_seen":83519,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":83519,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"212.68.248.153","src_port":28681,"dst_port":27223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":669,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":216,"flow_packet_id":1,"flow_last_seen":83519,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":83519,"pkt":"UlQAEjUCCAAn5uVZCABFAAA00CEAAIARkaoKAAIP1ET4mXAJalcAIOv2R05EED76AQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":670,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":217,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83519,"flow_last_seen":83519,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":83519,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"126.117.45.151","src_port":28681,"dst_port":19323,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":670,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":217,"flow_packet_id":1,"flow_last_seen":83519,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":83519,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0p4kAAIAR2xQKAAIPfnUtl3AJS3sAICukR05EED77AQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":671,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":218,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83519,"flow_last_seen":83519,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":83519,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.155.52.115","src_port":28681,"dst_port":53956,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":671,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":218,"flow_packet_id":1,"flow_last_seen":83519,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":83519,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0+tkAAIARTsIKAAIPsJs0c3AJ0sQAIGtXR05EED78AQFUC1FLUlAGUk5BXS\/iNQlw"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":672,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":219,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83520,"flow_last_seen":83520,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":83520,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.30.86.144","src_port":28681,"dst_port":53821,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":672,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":1,"flow_last_seen":83520,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":83520,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0H4AAAIARbHwKAAIPTB5WkHAJ0j0AIK49R05EED79AQFUC1FLUlAGUk5BXS\/iNQlw"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":673,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":220,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83564,"flow_last_seen":83564,"flow_idle_time":180000,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":83564,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":9239,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00485{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":673,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":220,"flow_packet_id":1,"flow_last_seen":83564,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"thread_ts_msec":83564,"pkt":"UlQAEjUCCAAn5uVZCABFAABLd8UAAIAR7i8KAAIPcfxWonAJJBcANy3AJNUxAmj8GYH\/vMbgH9u+AwABABgAAADDA1NDUEECAlZDRUdUS0dihkRIVElQUEA="} +00550{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":674,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":220,"flow_packet_id":2,"flow_last_seen":83804,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":133,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":133,"pkt_l4_len":99,"thread_ts_msec":83804,"pkt":"CAAn5uVZUlQAEjUCCABFAAB3AwYAAEARosNx\/FaiCgACDyQXcAkAY+agJNUxAmj8GYH\/vMbgH9u+AwEBAEQAAAAXJHH8VqIWAAAAAAAABMMCVVBDAQsGo0lQUGl4nAEeAOH\/2qTGGyrrJOoSptzxtNqH3sQRchsYX6MsAay4MHcT\/6kOwg=="} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":675,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":221,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83805,"flow_last_seen":83805,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":83805,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":50267,"dst_port":9239,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":675,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":1,"flow_last_seen":83805,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":83805,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0d8ZAAIAGrlAKAAIPcfxWosRbJBfMcOElAAAAAIAC+vAJaQAAAgQFtAEDAwgBAQQC"} +00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":676,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":2,"flow_last_seen":84026,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":84026,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAwcAAEAGoxhx\/FaiCgACDyQXxFsAmFgBzHDhJmAS\/\/\/UxQAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":677,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":3,"flow_last_seen":84026,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":84026,"pkt":"UlQAEjUCCAAn5uVZCABFAAAod8dAAIAGrlsKAAIPcfxWosRbJBfMcOEmAJhYAlAQ+vDxkQAA"} +00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":678,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":221,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":83805,"flow_last_seen":84027,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":84027,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":50267,"dst_port":9239,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":685,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":151,"flow_packet_id":3,"flow_last_seen":84388,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":84388,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0GYlAAIAGqN4KAAIPXwrNQ8RYvPy3IUp\/AAAAAIAC+vC4zAAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":686,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":3,"flow_last_seen":84388,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":84388,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xOhAAIAGV+wKAAIPSbaIKsRXbOGIdOVZAAAAAIAC+vD3KAAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":687,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":152,"flow_packet_id":3,"flow_last_seen":84388,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":84388,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0bsdAAIAGE84KAAIPcf\/6IMRZzacG03PuAAAAAIAC+vDvLQAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":688,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":222,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":84592,"flow_last_seen":84592,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":84592,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"210.209.249.84","src_port":50268,"dst_port":24751,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":688,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":1,"flow_last_seen":84592,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":84592,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0v8BAAIAGYs4KAAIP0tH5VMRcYK9pfUzQAAAAAIAC+vDAkAAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":689,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":223,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":84592,"flow_last_seen":84592,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":84592,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":50269,"dst_port":3186,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":689,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":223,"flow_packet_id":1,"flow_last_seen":84592,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":84592,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0sD9AAIAG2QsKAAIP2meLAsRdDHIwnISEAAAAAIAC+vB8tgAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":690,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":224,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":84593,"flow_last_seen":84593,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":84593,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":50270,"dst_port":11427,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":690,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":224,"flow_packet_id":1,"flow_last_seen":84593,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":84593,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0y5JAAIAGmKgKAAIPchsYX8ReLKPFX+7aAAAAAIAC+vA4WgAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":691,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":225,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":84593,"flow_last_seen":84593,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":84593,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.198.27","src_port":50271,"dst_port":60202,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":691,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":225,"flow_packet_id":1,"flow_last_seen":84593,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":84593,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0KpdAAIAGI14KAAIP2qTGG8Rf6yo8NHW4AAAAAIAC+vBl2QAAAgQFtAEDAwgBAQQC"} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":692,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":2,"flow_last_seen":84824,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":84824,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAwwAAEAGn4vS0flUCgACD2CvxFwAmkwBaX1M0WAS\/\/+X6wAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":693,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":3,"flow_last_seen":84824,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":84824,"pkt":"UlQAEjUCCAAn5uVZCABFAAAov8FAAIAGYtkKAAIP0tH5VMRcYK9pfUzRAJpMAlAQ+vC0twAA"} +00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":694,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":222,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":84592,"flow_last_seen":84825,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":84825,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"210.209.249.84","src_port":50268,"dst_port":24751,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":696,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":223,"flow_packet_id":2,"flow_last_seen":84862,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":84862,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAw4AAEAGBkbaZ4sCCgACDwxyxF0Am0YBMJyEhWAS\/\/9aEAAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":697,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":223,"flow_packet_id":3,"flow_last_seen":84863,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":84863,"pkt":"UlQAEjUCCAAn5uVZCABFAAAosEBAAIAG2RYKAAIP2meLAsRdDHIwnISFAJtGAlAQ+vB23AAA"} +00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":698,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":223,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":84592,"flow_last_seen":84863,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":84863,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":50269,"dst_port":3186,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":710,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":226,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":85607,"flow_last_seen":85607,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":85607,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.172.184.48","src_port":50272,"dst_port":13298,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":710,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":226,"flow_packet_id":1,"flow_last_seen":85607,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":85607,"pkt":"UlQAEjUCCAAn5uVZCABFAAA07jxAAIAGRpwKAAIPAay4MMRgM\/L4VuGpAAAAAIAC+vDb4AAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":711,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":227,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":85607,"flow_last_seen":85607,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":85607,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.179.18.242","src_port":50273,"dst_port":47329,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":711,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":227,"flow_packet_id":1,"flow_last_seen":85607,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":85607,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0AtdAAIAGwDkKAAIPGLMS8sRhuOFovA6\/AAAAAIAC+vBHrQAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":712,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":228,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":85607,"flow_last_seen":85607,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":85607,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.174.18.115","src_port":50274,"dst_port":50679,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":712,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":228,"flow_packet_id":1,"flow_last_seen":85607,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":85607,"pkt":"UlQAEjUCCAAn5uVZCABFAAA03ztAAIAGuFgKAAIPRK4Sc8RixfcTIeyiAAAAAIAC+vCG0QAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":713,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":229,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":85608,"flow_last_seen":85608,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":85608,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.117.100.78","src_port":50275,"dst_port":9010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":713,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":229,"flow_packet_id":1,"flow_last_seen":85608,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":85608,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0UCdAAIAGv8oKAAIPenVkTsRjIzKhF7fWAAAAAIAC+vBIyQAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":714,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":230,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":86639,"flow_last_seen":86639,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":86639,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":50276,"dst_port":56070,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":714,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":230,"flow_packet_id":1,"flow_last_seen":86639,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":86639,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0EcBAAIAG34AKAAIPYPacfsRk2wZPr5++AAAAAIAC+vDbwgAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":715,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":231,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":86639,"flow_last_seen":86639,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":86639,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":50277,"dst_port":36368,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":715,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":231,"flow_packet_id":1,"flow_last_seen":86639,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":86639,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0sxxAAIAG7QgKAAIPUrX72sRljhBQLtKuAAAAAIAC+vCkLQAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":716,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":232,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":86640,"flow_last_seen":86640,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":86640,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.231.59.187","src_port":50278,"dst_port":62234,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":716,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":1,"flow_last_seen":86640,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":86640,"pkt":"UlQAEjUCCAAn5uVZCABFAAA04CNAAIAGre8KAAIPJOc7u8Rm8xqBNdLHAAAAAIAC+vD77wAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":717,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":233,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":86641,"flow_last_seen":86641,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":86641,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.91.201","src_port":50279,"dst_port":4297,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":717,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":233,"flow_packet_id":1,"flow_last_seen":86641,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":86641,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0vEFAAIAGZK4KAAIPcfxbycRnEMmMdJG3AAAAAIAC+vCm7gAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":720,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":224,"flow_packet_id":2,"flow_last_seen":87610,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":87610,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0y5NAAIAGmKcKAAIPchsYX8ReLKPFX+7aAAAAAIAC+vA4WgAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":721,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":225,"flow_packet_id":2,"flow_last_seen":87611,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":87611,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0KphAAIAGI10KAAIP2qTGG8Rf6yo8NHW4AAAAAIAC+vBl2QAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":722,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":234,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":87670,"flow_last_seen":87670,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":87670,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.199.148.6","src_port":50280,"dst_port":4338,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":722,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":234,"flow_packet_id":1,"flow_last_seen":87670,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":87670,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0IMpAAIAG1h0KAAIPY8eUBsRoEPJVbcPeAAAAAIAC+vCBnAAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":723,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":235,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":87670,"flow_last_seen":87670,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":87670,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.134.154.158","src_port":50281,"dst_port":54130,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":723,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":235,"flow_packet_id":1,"flow_last_seen":87670,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":87670,"pkt":"UlQAEjUCCAAn5uVZCABFAAA068NAAIAGCc0KAAIPXoaansRp03KjrVDkAAAAAIAC+vDifQAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":724,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":236,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":87671,"flow_last_seen":87671,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":87671,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.124.66.33","src_port":50282,"dst_port":13060,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":724,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":236,"flow_packet_id":1,"flow_last_seen":87671,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":87671,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0aolAAIAGZI4KAAIP3XxCIcRqMwT80GtdAAAAAIAC+vDo1QAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":725,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":237,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":87671,"flow_last_seen":87671,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":87671,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":50283,"dst_port":35004,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":725,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":237,"flow_packet_id":1,"flow_last_seen":87671,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":87671,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0eNtAAIAGqL8KAAIPM0SZ1sRriLxORLlDAAAAAIAC+vBGRgAAAgQFtAEDAwgBAQQC"} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":726,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":237,"flow_packet_id":2,"flow_last_seen":87706,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":87706,"pkt":"CAAn5uVZUlQAEjUCCABFAAAoAyIAAP8G34QzRJnWCgACD4i8xGsAAAAATkS5RFAUAACB9gAA"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":732,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":237,"flow_packet_id":3,"flow_last_seen":88219,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":88219,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0eNxAAIAGqL4KAAIPM0SZ1sRriLxORLlDAAAAAIAC+vBGRgAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":734,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":227,"flow_packet_id":2,"flow_last_seen":88622,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":88622,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0AthAAIAGwDgKAAIPGLMS8sRhuOFovA6\/AAAAAIAC+vBHrQAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":735,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":229,"flow_packet_id":2,"flow_last_seen":88622,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":88622,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0UChAAIAGv8kKAAIPenVkTsRjIzKhF7fWAAAAAIAC+vBIyQAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":736,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":226,"flow_packet_id":2,"flow_last_seen":88622,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":88622,"pkt":"UlQAEjUCCAAn5uVZCABFAAA07j1AAIAGRpsKAAIPAay4MMRgM\/L4VuGpAAAAAIAC+vDb4AAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":737,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":228,"flow_packet_id":2,"flow_last_seen":88622,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":88622,"pkt":"UlQAEjUCCAAn5uVZCABFAAA03zxAAIAGuFcKAAIPRK4Sc8RixfcTIeyiAAAAAIAC+vCG0QAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":740,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":238,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":88704,"flow_last_seen":88704,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":88704,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":50284,"dst_port":53258,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":740,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":238,"flow_packet_id":1,"flow_last_seen":88704,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":88704,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05t5AAIAGvPEKAAIPaJziSMRs0ArGWKhyAAAAAIAC+vAZ6QAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":741,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":239,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":88704,"flow_last_seen":88704,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":88704,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":50285,"dst_port":52367,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":741,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":239,"flow_packet_id":1,"flow_last_seen":88704,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":88704,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0cchAAIAGzAoKAAIPS4VlXcRtzI\/Cd\/CCAAAAAIAC+vBzNgAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":742,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":240,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":88705,"flow_last_seen":88705,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":88705,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.118.116.198","src_port":50286,"dst_port":44616,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":742,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":240,"flow_packet_id":1,"flow_last_seen":88705,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":88705,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0QNJAAIAG5KYKAAIPVHZ0xsRurkgo6JHMAAAAAIAC+vBxaAAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":743,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":241,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":88706,"flow_last_seen":88706,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":88706,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.215.130.156","src_port":50287,"dst_port":12405,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":743,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":1,"flow_last_seen":88706,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":88706,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0QYJAAIAGx78KAAIPYteCnMRvMHWjnzXtAAAAAIAC+vC0KwAAAgQFtAEDAwgBAQQC"} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":746,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":239,"flow_packet_id":2,"flow_last_seen":88816,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":88816,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAyoAAEAGurFLhWVdCgACD8yPxG0AoxYBwnfwg2AS\/\/+AiAAAAgQFtA=="} +00439{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":747,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":239,"flow_packet_id":3,"flow_last_seen":88816,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":88816,"pkt":"UlQAEjUCCAAn5uVZCABFAAAocclAAIAGzBUKAAIPS4VlXcRtzI\/Cd\/CDAKMWAlAQ+vCdVAAA"} +00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":748,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":239,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":88704,"flow_last_seen":88817,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":88817,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":50285,"dst_port":52367,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":750,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":238,"flow_packet_id":2,"flow_last_seen":88832,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":88832,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsAywAAEAGIK1onOJICgACD9AKxGwApBABxlioc2AS\/\/8tOgAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":751,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":238,"flow_packet_id":3,"flow_last_seen":88832,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":88832,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo5t9AAIAGvPwKAAIPaJziSMRs0ArGWKhzAKQQAlAQ+vBKBgAA"} +00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":752,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":238,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":88704,"flow_last_seen":88833,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":88833,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":50284,"dst_port":53258,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00460{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":754,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":3,"flow_last_seen":88897,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":88897,"pkt":"CAAn5uVZUlQAEjUCCABFwAA4Ay4AAP8Bn8YKAAICCgACDwMBvHoAAAAARQAANFAnQAB\/BsDKCgACD3p1ZE7EYyMyoRe31g=="} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":758,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":242,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":88941,"flow_last_seen":88941,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":88941,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":28681,"dst_port":52367,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00462{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":758,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":242,"flow_packet_id":1,"flow_last_seen":88941,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":88941,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ccwAAIARC\/gKAAIPS4VlXXAJzI8AJKBHjeQxAkkpJRz\/KX356SYEAwABAAUAAADDglFLQA=="} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":762,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":243,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89016,"flow_last_seen":89016,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":89016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00462{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":762,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":1,"flow_last_seen":89016,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":89016,"pkt":"UlQAEjUCCAAn5uVZCABFAAA45uIAAIAR\/N4KAAIPaJziSHAJ0AoAJM5tyxsxAjwcdNX\/v8csO9YcAwABAAUAAADDglFLQA=="} +00560{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":763,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":2,"flow_last_seen":89115,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":144,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":144,"pkt_l4_len":110,"thread_ts_msec":89115,"pkt":"CAAn5uVZUlQAEjUCCABFAACCAzMAAEARIEVonOJICgACD9AKcAkAbgyTyxsxAjwcdNX\/v8csO9YcAwEBAE8AAAAK0Gic4kgAAAAACAAAAMMCVkNFR1RLR2IDR1VFQQICVVBDAgEJAkRVQ4BRAQE2UCABGfADACGFAAAAAAABAAEDREhUQwAAAYJRS0RA6WtH"} +00508{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":771,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":242,"flow_packet_id":2,"flow_last_seen":89584,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"thread_ts_msec":89584,"pkt":"UlQAEjUCCAAn5uVZCABFAABZcc8AAIARC9QKAAIPS4VlXXAJzI8ARbt690gxArBfVnIskre5+iSoOkQAACYAAAABR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAA=="} +00508{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":772,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":242,"flow_packet_id":3,"flow_last_seen":89584,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"thread_ts_msec":89584,"pkt":"UlQAEjUCCAAn5uVZCABFAABZcdAAAIARC9MKAAIPS4VlXXAJzI8ARU1UTtkxAvX0Cql3HOwyFoQpokQAACYAAAABR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAA=="} +00509{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":774,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":3,"flow_last_seen":89612,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"thread_ts_msec":89612,"pkt":"UlQAEjUCCAAn5uVZCABFAABZ5uQAAIAR\/LsKAAIPaJziSHAJ0AoARRIl9XkxAr8paNvEgdBJGPDFY0QAACYAAAABR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAA=="} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":776,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":233,"flow_packet_id":2,"flow_last_seen":89653,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":89653,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0vEJAAIAGZK0KAAIPcfxbycRnEMmMdJG3AAAAAIAC+vCm7gAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":777,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":2,"flow_last_seen":89653,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":89653,"pkt":"UlQAEjUCCAAn5uVZCABFAAA04CRAAIAGre4KAAIPJOc7u8Rm8xqBNdLHAAAAAIAC+vD77wAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":778,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":231,"flow_packet_id":2,"flow_last_seen":89653,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":89653,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0sx1AAIAG7QcKAAIPUrX72sRljhBQLtKuAAAAAIAC+vCkLQAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":780,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":230,"flow_packet_id":2,"flow_last_seen":89653,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":89653,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0EcFAAIAG338KAAIPYPacfsRk2wZPr5++AAAAAIAC+vDbwgAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":783,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":244,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89732,"flow_last_seen":89732,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":89732,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.119.55.28","src_port":50288,"dst_port":20347,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":783,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":244,"flow_packet_id":1,"flow_last_seen":89732,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":89732,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0AqRAAIAGaH4KAAIPTHc3HMRwT3sv+xA+AAAAAIAC+vCQWAAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":784,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":245,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89733,"flow_last_seen":89733,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":89733,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.195.236.249","src_port":50289,"dst_port":18557,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":784,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":245,"flow_packet_id":1,"flow_last_seen":89733,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":89733,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0nYFAAIAGGXcKAAIPSsPs+cRxSH3g2g3bAAAAAIAC+vA0rwAAAgQFtAEDAwgBAQQC"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":786,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89829,"flow_last_seen":89829,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89829,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":28681,"dst_port":35481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":786,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":1,"flow_last_seen":89829,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":89829,"pkt":"UlQAEjUCCAAn5uVZCABFAABtBGAAAIARhQ4KAAIPYEFEwnAJipkAWRiep7MxAim3LsYw33fFcko2zkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":787,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89829,"flow_last_seen":89829,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89829,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.84.178.16","src_port":28681,"dst_port":60262,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":787,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":1,"flow_last_seen":89829,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":89829,"pkt":"UlQAEjUCCAAn5uVZCABFAABtYHgAAIARZpQKAAIPtVSyEHAJ62YAWWkRdMAxAjueygYrMQV+6lVI4UQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":788,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89829,"flow_last_seen":89829,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89829,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":12012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":788,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":1,"flow_last_seen":89829,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":89829,"pkt":"UlQAEjUCCAAn5uVZCABFAABtDeAAAIARAL4KAAIPQh7dtXAJLuwAWQScCKYxAn7wSVwJearIKZuX\/UQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +01407{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":789,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":2,"flow_last_seen":89964,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":89964,"pkt":"CAAn5uVZUlQAEjUCCABFAALzAzsAAEARw61gQUTCCgACD4qZcAkC3\/jzp7MxAim3LsYw33fFcko2zkQAAMACAAAGR1RLRwAAKfRYs\/Fa1CmeYJshGT65b9iJmmUEYEFEwoqZAQAAAARL51cQFEdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqg=="} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":790,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89966,"flow_last_seen":89966,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89966,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.218","src_port":28681,"dst_port":6909,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":790,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_packet_id":1,"flow_last_seen":89966,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":89966,"pkt":"UlQAEjUCCAAn5uVZCABFAABthPwAAIARBkMKAAIPLVh12nAJGv0AWWOTCPExAoCeF40w0KwTJyzTOUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":791,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89966,"flow_last_seen":89966,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89966,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":26253,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":791,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":1,"flow_last_seen":89966,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":89966,"pkt":"UlQAEjUCCAAn5uVZCABFAABteN4AAIAR6HgKAAIPM0SZ1nAJZo0AWRfF0U0xAgQATbK3Z+3BHrxn1kQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":89967,"flow_last_seen":89967,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":89967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.203.218.92","src_port":28681,"dst_port":56962,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":1,"flow_last_seen":89967,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":89967,"pkt":"UlQAEjUCCAAn5uVZCABFAABtv\/sAAIAR2k0KAAIPucvaXHAJ3oIAWehILgsxAjPZohvFNPL\/fzMDzUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +01405{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":793,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":2,"flow_last_seen":90003,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90003,"pkt":"CAAn5uVZUlQAEjUCCABFAALzAzwAAEARm5UzRJnWCgACD2aNcAkC356C0U0xAgQATbK3Z+3BHrxn1kQAAMACAAAGR1RLRwAAP8uu0MEeyu8HazDjgCpjZAKtBhAEM0SZ1maNAQAAAAT9K4fbFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqg=="} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":794,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90004,"flow_last_seen":90004,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90004,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.140.120.41","src_port":28681,"dst_port":47739,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":794,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_packet_id":1,"flow_last_seen":90004,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90004,"pkt":"UlQAEjUCCAAn5uVZCABFAABtaUEAAIARBHsKAAIPSIx4KXAJunsAWfVM+10xAo9f69NRsDNb4\/pKE0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":795,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90005,"flow_last_seen":90005,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90005,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":28681,"dst_port":61616,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":795,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":1,"flow_last_seen":90005,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90005,"pkt":"UlQAEjUCCAAn5uVZCABFAABtgogAAIAR60AKAAIPwSX\/gnAJ8LAAWXkqrf0xAupVi8ylWZxhuwdOwkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":796,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90005,"flow_last_seen":90005,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90005,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":28681,"dst_port":24562,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":796,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":1,"flow_last_seen":90005,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90005,"pkt":"UlQAEjUCCAAn5uVZCABFAABt+\/sAAIARkCYKAAIPWHhJ13AJX\/IAWfWM7VYxAm\/Ch\/PFy9OUV6XMR0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +01410{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":797,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":2,"flow_last_seen":90038,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90038,"pkt":"CAAn5uVZUlQAEjUCCABFAALzAz0AAEARxl9YeEnXCgACD1\/ycAkC3xJi7VYxAm\/Ch\/PFy9OUV6XMR0QAAMACAAAGR1RLRwAADJe19wd9tDyoR\/wXh6nJoKWkNEIEWHhJ11\/yAQAAAATxtX5bFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqkdUS0cAABK1XVsEZ16ugW6JpsS4xfhpSq81BEjJ0DmW2Q=="} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":798,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90039,"flow_last_seen":90039,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90039,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":30577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":798,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_packet_id":1,"flow_last_seen":90039,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90039,"pkt":"UlQAEjUCCAAn5uVZCABFAABt7XgAAIAREsUKAAIPUD3d9nAJd3EAWbzbp0UxAokhPuR+ZJu6wwLrOkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":799,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90039,"flow_last_seen":90039,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90039,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":50297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":799,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_packet_id":1,"flow_last_seen":90039,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90039,"pkt":"UlQAEjUCCAAn5uVZCABFAABtEcIAAIARHzsKAAIPYPacfnAJxHkAWRCy7dwxAiOKI2B1HBL1\/IoOJUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":800,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90039,"flow_last_seen":90039,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90039,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":28681,"dst_port":36368,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":800,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_packet_id":1,"flow_last_seen":90039,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90039,"pkt":"UlQAEjUCCAAn5uVZCABFAABtsx4AAIARLMMKAAIPUrX72nAJjhAAWVPSkYYxArzIs2GmVy70sFjiYEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +01407{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":801,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_packet_id":2,"flow_last_seen":90071,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90071,"pkt":"CAAn5uVZUlQAEjUCCABFAALzAz4AAEAROnpQPd32CgACD3dxcAkC3wb\/p0UxAokhPuR+ZJu6wwLrOkQAAMACAAAGR1RLRwAADWk0EbJTji7xq2N2EERly+h8FzIEUD3d9ndxAQAAAATOg6hoFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqg=="} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":802,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90072,"flow_last_seen":90072,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90072,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.26.216.95","src_port":28681,"dst_port":13889,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":802,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_packet_id":1,"flow_last_seen":90072,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90072,"pkt":"UlQAEjUCCAAn5uVZCABFAABthFwAAIARuZsKAAIPGBrYX3AJNkEAWZh4MEMxAu0STIEN6nLhhZZqvEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":803,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90072,"flow_last_seen":90072,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90072,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":28681,"dst_port":43508,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":803,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_packet_id":1,"flow_last_seen":90072,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90072,"pkt":"UlQAEjUCCAAn5uVZCABFAABt0UkAAIARidsKAAIPZ+hrZHAJqfQAWVSlBkIxAi75axRUS7XsWs\/C60QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":804,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90073,"flow_last_seen":90073,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90073,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":804,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_packet_id":1,"flow_last_seen":90073,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90073,"pkt":"UlQAEjUCCAAn5uVZCABFAABtDzkAAIARfk0KAAIPLoBya3AJGbIAWQrBwagxArEYlVcnjAyV6XOvHEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +01407{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":809,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":2,"flow_last_seen":90132,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90132,"pkt":"CAAn5uVZUlQAEjUCCABFAALzA0EAAEARqALBJf+CCgACD\/CwcAkC35hMrf0xAupVi8ylWZxhuwdOwkQAAMACAAAGR1RLRwAAC5wNVaWmIUX476YAPO2IwX6VsyAEwSX\/gvCwAQAAAASWmcaYFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqg=="} +01406{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":810,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_packet_id":2,"flow_last_seen":90137,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90137,"pkt":"CAAn5uVZUlQAEjUCCABFAALzA0IAAEARx74ugHJrCgACDxmycAkC32FSwagxArEYlVcnjAyV6XOvHEQAAMACAAAGR1RLRwAAGIXhRHN5ftV2L3caNPMmmEQDSzUELoByaxmyAQAAAARlWXO2FEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqg=="} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":811,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90138,"flow_last_seen":90138,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90138,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":28681,"dst_port":21301,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":811,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_packet_id":1,"flow_last_seen":90138,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90138,"pkt":"UlQAEjUCCAAn5uVZCABFAABtxUwAAIAR+3EKAAIPPPEwwnAJUzUAWWdCqc0xAhWpgpzJQk2EqzRt70QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":812,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90138,"flow_last_seen":90138,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90138,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":28681,"dst_port":46010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":812,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_packet_id":1,"flow_last_seen":90138,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90138,"pkt":"UlQAEjUCCAAn5uVZCABFAABtRC0AAIARXOYKAAIPWUs0E3AJs7oAWZEdEsYxApinpNiOVYwKMx8qLUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":813,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90138,"flow_last_seen":90138,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90138,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.217.176.52","src_port":28681,"dst_port":7446,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":813,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_packet_id":1,"flow_last_seen":90138,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90138,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTM8AAIAR3pQKAAIPUtmwNHAJHRYAWfrhGukxApDm6ECPcKUTk+0ioUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +01406{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":814,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_packet_id":2,"flow_last_seen":90182,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90182,"pkt":"CAAn5uVZUlQAEjUCCABFAALzA0MAAEAR20pZSzQTCgACD7O6cAkC35hjEsYxApinpNiOVYwKMx8qLUQAAMACAAAGR1RLRwAAGcOxs9Yotu5YI3ngDJa2NEz7hxIEWUs0E7O6AQAAAAQphpmTFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjVdTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNVdTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqkdUS0cAABZMZh8YJqCRZ8rsFWpJujOrF1VMBFHNWy2cyQ=="} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":816,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90183,"flow_last_seen":90183,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90183,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":28681,"dst_port":11603,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":816,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_packet_id":1,"flow_last_seen":90183,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90183,"pkt":"UlQAEjUCCAAn5uVZCABFAABtGYoAAIAR6JkKAAIPXwrNQ3AJLVMAWdsMrwExAn9FQ02TKgtsdnbe2UQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":817,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90184,"flow_last_seen":90184,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":90184,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":1194,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":817,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_packet_id":1,"flow_last_seen":90184,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":90184,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTH0AAIARTyMKAAIPy9zG9HAJBKoAWeojZPExAoo7ciOaCRHkTxe8NEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +01408{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":818,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":2,"flow_last_seen":90267,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90267,"pkt":"CAAn5uVZUlQAEjUCCABFAALzA0QAAEARAUO1VLIQCgACD+tmcAkC3zlLdMAxAjueygYrMQV+6lVI4UQAAMACAAAGR1RLRwAAKnLYr\/aGTLaMbt4HEbnkS5LKRh0EtVSyEOtmAQAAAAQDkoiwFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjVdTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqkdUS0cAAGqU5DC0wpx7Tt\/+AtuQJkODlGIrBC\/cuoxr+UdUS0cAAGSQPhJYYczqO9fA1uqwCWebPjcpBMEgftbozEdUS0cAAGfwY9tAxh1AXF0ZU2EOIfqDQ08tBHbwRccYzA=="} +01408{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":819,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_packet_id":2,"flow_last_seen":90386,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90386,"pkt":"CAAn5uVZUlQAEjUCCABFAALzA0UAAEARlVpn6GtkCgACD6n0cAkC312iBkIxAi75axRUS7XsWs\/C60QAAMACAAAGR1RLRwAABkx5M4bYu4J4fOkW\/7Sl8nWo53gEZ+hrZKn0AQAAAASAlqYNFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqg=="} +01406{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":820,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_packet_id":2,"flow_last_seen":90452,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90452,"pkt":"CAAn5uVZUlQAEjUCCABFAALzA0YAAEAR+vI88TDCCgACD1M1cAkC31EXqc0xAhWpgpzJQk2EqzRt70QAAMACAAAGR1RLRwAAGN\/m\/5SuT3RX9Y8zGKdBIhyITj8EPPEwwlM1AQAAAASjKCcfFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqg=="} +01406{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_packet_id":2,"flow_last_seen":90501,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":90501,"pkt":"CAAn5uVZUlQAEjUCCABFAALzA0cAAEAR1dPL3Mb0CgACDwSqcAkC3641ZPExAoo7ciOaCRHkTxe8NEQAAMACAAAGR1RLRwAAEQ4bgk0QPBUYN04RWX3wJMmwXm4Ey9zG9ASqAQAAAASVBH3jFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtUw=="} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":822,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":234,"flow_packet_id":2,"flow_last_seen":90684,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90684,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0IMtAAIAG1hwKAAIPY8eUBsRoEPJVbcPeAAAAAIAC+vCBnAAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":823,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":235,"flow_packet_id":2,"flow_last_seen":90684,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90684,"pkt":"UlQAEjUCCAAn5uVZCABFAAA068RAAIAGCcwKAAIPXoaansRp03KjrVDkAAAAAIAC+vDifQAAAgQFtAEDAwgBAQQC"} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":824,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":236,"flow_packet_id":2,"flow_last_seen":90684,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90684,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0aopAAIAGZI0KAAIP3XxCIcRqMwT80GtdAAAAAIAC+vDo1QAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":826,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":266,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90737,"flow_last_seen":90737,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90737,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.89.249.8","src_port":50290,"dst_port":50649,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":826,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":1,"flow_last_seen":90737,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90737,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gg1AAIAGKkYKAAIPSVn5CMRyxdmnmnGXAAAAAIAC+vCCMAAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":827,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":267,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90738,"flow_last_seen":90738,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90738,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.7.155.210","src_port":50291,"dst_port":28365,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":827,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":267,"flow_packet_id":1,"flow_last_seen":90738,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90738,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0RsxAAIAGRA8KAAIPyAeb0sRzbs28TEPZAAAAAIAC+vDQzwAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":828,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":268,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90738,"flow_last_seen":90738,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90738,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":50292,"dst_port":11603,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":828,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":268,"flow_packet_id":1,"flow_last_seen":90738,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90738,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0GYtAAIAGqNwKAAIPXwrNQ8R0LVPIsf8hAAAAAIAC+vCCJwAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":829,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":269,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90739,"flow_last_seen":90739,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90739,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":50293,"dst_port":8890,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":829,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":269,"flow_packet_id":1,"flow_last_seen":90739,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90739,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0s+5AAIAGId8KAAIPYVO3lMR1IrqGMBLYAAAAAIAC+vDO8AAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":830,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":270,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90740,"flow_last_seen":90740,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90740,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":50294,"dst_port":37058,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":830,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":270,"flow_packet_id":1,"flow_last_seen":90740,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90740,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0th9AAIAGKegKAAIPDsj\/5cR2kMKte\/8bAAAAAIAC+vBXkgAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":831,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":271,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90740,"flow_last_seen":90740,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90740,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":50295,"dst_port":49732,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":831,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":271,"flow_packet_id":1,"flow_last_seen":90740,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90740,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0pBlAAIAGrCMKAAIPJo536sR3wkQjIZHBAAAAAIAC+vCN+QAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":832,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":272,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90741,"flow_last_seen":90741,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90741,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.58.211.52","src_port":50296,"dst_port":3806,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":832,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":1,"flow_last_seen":90741,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90741,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0HOdAAIAGsV8KAAIPTTrTNMR4Dt40RJ3MAAAAAIAC+vCiOgAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":833,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":273,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90741,"flow_last_seen":90741,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90741,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":50297,"dst_port":45710,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":833,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":273,"flow_packet_id":1,"flow_last_seen":90741,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90741,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0tiBAAIAGKecKAAIPDsj\/5cR5so6\/ZuJwAAAAAIAC+vBAgwAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":834,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":274,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90741,"flow_last_seen":90741,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90741,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":50298,"dst_port":6578,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":834,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":274,"flow_packet_id":1,"flow_last_seen":90741,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90741,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0DzpAAIAGPpAKAAIPLoBya8R6GbLOIdYWAAAAAIAC+vBEwAAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":835,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":275,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90742,"flow_last_seen":90742,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90742,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":50299,"dst_port":1194,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":835,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":275,"flow_packet_id":1,"flow_last_seen":90742,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90742,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0TH5AAIAGD2YKAAIPy9zG9MR7BKqh2JWmAAAAAIAC+vDUmgAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":836,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":276,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90742,"flow_last_seen":90742,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90742,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":50300,"dst_port":11852,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":836,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":276,"flow_packet_id":1,"flow_last_seen":90742,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90742,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0c0VAAIAGinsKAAIPvD00t8R8LkyIWpaCAAAAAIAC+vBldgAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":837,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":277,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90743,"flow_last_seen":90743,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90743,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":50301,"dst_port":54130,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":837,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":277,"flow_packet_id":1,"flow_last_seen":90743,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90743,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0oEFAAIAGwA4KAAIPV3s26sR903KojXlgAAAAAIAC+vAfzQAAAgQFtAEDAwgBAQQC"} +00552{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":838,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":278,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90743,"flow_last_seen":90743,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90743,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.64.6.175","src_port":50302,"dst_port":4743,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":838,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":278,"flow_packet_id":1,"flow_last_seen":90743,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90743,"pkt":"UlQAEjUCCAAn5uVZCABFAAA03P1AAIAGv8gKAAIPS0AGr8R+EocndMkvAAAAAIAC+vBOeAAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":839,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":279,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90744,"flow_last_seen":90744,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90744,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":50303,"dst_port":24562,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":839,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":279,"flow_packet_id":1,"flow_last_seen":90744,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90744,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0+\/xAAIAGUGkKAAIPWHhJ18R\/X\/Jjsy0QAAAAAIAC+vAQjAAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":840,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":280,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90744,"flow_last_seen":90744,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90744,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.168.34.105","src_port":50304,"dst_port":39908,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":840,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":280,"flow_packet_id":1,"flow_last_seen":90744,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90744,"pkt":"UlQAEjUCCAAn5uVZCABFAAA03DVAAIAGmm4KAAIPVagiacSAm+Tx8HlYAAAAAIAC+vAkUQAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":841,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":281,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90744,"flow_last_seen":90744,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90744,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":50305,"dst_port":63637,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":841,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":281,"flow_packet_id":1,"flow_last_seen":90744,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90744,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0MiRAAIAGHAkKAAIPXjZCUsSB+JU5M3UyAAAAAIAC+vBcCwAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":282,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90744,"flow_last_seen":90744,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90744,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.238.145.82","src_port":50306,"dst_port":33527,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":282,"flow_packet_id":1,"flow_last_seen":90744,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90744,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0uGpAAIAGyAkKAAIP3O6RUsSCgvcQKi\/TAAAAAIAC+vByWAAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":843,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":283,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90745,"flow_last_seen":90745,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90745,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":50307,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":843,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":283,"flow_packet_id":1,"flow_last_seen":90745,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90745,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0GLNAAIAGdYoKAAIPsGOwFMSDGMp5VHLfAAAAAIAC+vA+FwAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":844,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":284,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90745,"flow_last_seen":90745,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90745,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":50308,"dst_port":61616,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":844,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":284,"flow_packet_id":1,"flow_last_seen":90745,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90745,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0golAAIAGq4MKAAIPwSX\/gsSE8LC\/3xvGAAAAAIAC+vAWjQAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":845,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":285,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90745,"flow_last_seen":90745,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90745,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":50309,"dst_port":21301,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":845,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":285,"flow_packet_id":1,"flow_last_seen":90745,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90745,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xU1AAIAGu7QKAAIPPPEwwsSFUzVU0GEOAAAAAIAC+vAsxAAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":846,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":286,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90745,"flow_last_seen":90745,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90745,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.110.153.177","src_port":50310,"dst_port":40022,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":846,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":286,"flow_packet_id":1,"flow_last_seen":90745,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90745,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0O4FAAIAGzRQKAAIPTG6ZscSGnFbyaQhuAAAAAIAC+vAmPAAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":847,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":287,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90745,"flow_last_seen":90745,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90745,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":50311,"dst_port":49956,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":847,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":287,"flow_packet_id":1,"flow_last_seen":90745,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90745,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0zKVAAIAG6UMKAAIPlRyjr8SHwyS+2ZeIAAAAAIAC+vBRNgAAAgQFtAEDAwgBAQQC"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":848,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":288,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90745,"flow_last_seen":90745,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90745,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":50312,"dst_port":23548,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":848,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":288,"flow_packet_id":1,"flow_last_seen":90745,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90745,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Bk5AAIAG0n4KAAIPaO6s+sSIW\/wAgZpOAAAAAIAC+vCW0wAAAgQFtAEDAwgBAQQC"} +00554{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":849,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":289,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90746,"flow_last_seen":90746,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90746,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":50313,"dst_port":35481,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":849,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":289,"flow_packet_id":1,"flow_last_seen":90746,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90746,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0BGFAAIAGRVEKAAIPYEFEwsSJipmyoW1hAAAAAIAC+vBT5wAAAgQFtAEDAwgBAQQC"} +00553{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":850,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90746,"flow_last_seen":90746,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90746,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":50314,"dst_port":6888,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":850,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_packet_id":1,"flow_last_seen":90746,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90746,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Iw5AAIAGft8KAAIPUAf8wMSKGugAPu54AAAAAIAC+vBNHwAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":851,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":291,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90746,"flow_last_seen":90746,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90746,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":50315,"dst_port":26851,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":851,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":291,"flow_packet_id":1,"flow_last_seen":90746,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90746,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0e4RAAIAGraEKAAIPLR+YcMSLaOPXzV5xAAAAAIAC+vA+0wAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":852,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":292,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90746,"flow_last_seen":90746,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90746,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":50316,"dst_port":30566,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":852,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":292,"flow_packet_id":1,"flow_last_seen":90746,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90746,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xktAAIAG9NcKAAIPjoSlDcSMd2bhikpDAAAAAIAC+vDMvQAAAgQFtAEDAwgBAQQC"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":853,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":293,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90746,"flow_last_seen":90746,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90746,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":50317,"dst_port":21995,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":853,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":293,"flow_packet_id":1,"flow_last_seen":90746,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90746,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xP1AAIAGoVMKAAIPvKXLvsSNVetyIY5LAAAAAIAC+vDExgAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":854,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":294,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90746,"flow_last_seen":90746,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90746,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.32.126.214","src_port":50318,"dst_port":59596,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":854,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":294,"flow_packet_id":1,"flow_last_seen":90746,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90746,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Yo9AAIAGTC8KAAIPwSB+1sSO6MzJTpedAAAAAIAC+vAZ0gAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":855,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":295,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90747,"flow_last_seen":90747,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":50319,"dst_port":53489,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":855,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":295,"flow_packet_id":1,"flow_last_seen":90747,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90747,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0OINAAIAGsckKAAIPubtKrcSP0PGcxJ9SAAAAAIAC+vCSDwAAAgQFtAEDAwgBAQQC"} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":856,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":296,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90747,"flow_last_seen":90747,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":50320,"dst_port":10825,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":856,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":296,"flow_packet_id":1,"flow_last_seen":90747,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90747,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0SsxAAIAGLMcKAAIPwqO0fsSQKkliYWFkAAAAAIAC+vA+TwAAAgQFtAEDAwgBAQQC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":857,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":297,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90747,"flow_last_seen":90747,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":50321,"dst_port":4876,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":857,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":297,"flow_packet_id":1,"flow_last_seen":90747,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90747,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Ar9AAIAGpjAKAAIP1eVv4MSREwzLMAmEAAAAAIAC+vB1+AAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":858,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":298,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90747,"flow_last_seen":90747,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":50322,"dst_port":55302,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":858,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":298,"flow_packet_id":1,"flow_last_seen":90747,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90747,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0ptBAAIAGmUcKAAIPpIQKGcSS2AZOgZ\/9AAAAAIAC+vAuWwAAAgQFtAEDAwgBAQQC"} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":859,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":299,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90747,"flow_last_seen":90747,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":90747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":50323,"dst_port":26253,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":859,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":299,"flow_packet_id":1,"flow_last_seen":90747,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":90747,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0eN9AAIAGqLsKAAIPM0SZ1sSTZo3Cj79BAAAAAIAC+vDuAwAAAgQFtAEDAwgBAQQC"} +00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":860,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":276,"flow_packet_id":2,"flow_last_seen":90760,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90760,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA0kAAEAGeoC8PTS3CgACDy5MxHwAp\/gBiFqWg2AS\/\/+QwwAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":861,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":276,"flow_packet_id":3,"flow_last_seen":90760,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90760,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoc0ZAAIAGioYKAAIPvD00t8R8LkyIWpaDAKf4AlAQ+vCtjwAA"} +00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":862,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":276,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90742,"flow_last_seen":90763,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90763,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":50300,"dst_port":11852,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":864,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":292,"flow_packet_id":2,"flow_last_seen":90767,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90767,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA0sAAEAGN+GOhKUNCgACD3dmxIwAqPIB4YpKRGAS\/\/\/+CQAAAgQFtA=="} +00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":865,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":2,"flow_last_seen":90767,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90767,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA0wAAEAGSwNNOtM0CgACDw7exHgAqewBNESdzWAS\/\/\/ZhQAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":866,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":292,"flow_packet_id":3,"flow_last_seen":90767,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90767,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoxkxAAIAG9OIKAAIPjoSlDcSMd2bhikpEAKjyAlAQ+vAa1gAA"} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":867,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":3,"flow_last_seen":90768,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90768,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoHOhAAIAGsWoKAAIPTTrTNMR4Dt40RJ3NAKnsAlAQ+vD2UQAA"} +00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":868,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":292,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90768,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90768,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":50316,"dst_port":30566,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":870,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":296,"flow_packet_id":2,"flow_last_seen":90768,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90768,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA04AAEAG9E3Co7R+CgACDypJxJAAquYBYmFhZWAS\/\/97mQAAAgQFtA=="} +00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":871,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":272,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90741,"flow_last_seen":90771,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90771,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.58.211.52","src_port":50296,"dst_port":3806,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":873,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":296,"flow_packet_id":3,"flow_last_seen":90772,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90772,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoSs1AAIAGLNIKAAIPwqO0fsSQKkliYWFlAKrmAlAQ+vCYZQAA"} +00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":874,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":295,"flow_packet_id":2,"flow_last_seen":90772,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90772,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA1AAAEAGZwW5u0qtCgACD9DxxI8Aq+ABnMSfU2AS\/\/\/VWAAAAgQFtA=="} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":875,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":293,"flow_packet_id":2,"flow_last_seen":90772,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90772,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA1EAAEAG4wi8pcu+CgACD1XrxI0ArNoBciGOTGAS\/\/8ODwAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":876,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":295,"flow_packet_id":3,"flow_last_seen":90772,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90772,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoOIRAAIAGsdQKAAIPubtKrcSP0PGcxJ9TAKvgAlAQ+vDyJAAA"} +00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":877,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":296,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90747,"flow_last_seen":90772,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90772,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":50320,"dst_port":10825,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":879,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":293,"flow_packet_id":3,"flow_last_seen":90772,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90772,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoxP5AAIAGoV4KAAIPvKXLvsSNVetyIY5MAKzaAlAQ+vAq2wAA"} +00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":880,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":295,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90747,"flow_last_seen":90772,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90772,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":50319,"dst_port":53489,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":882,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":293,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90772,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90772,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":50317,"dst_port":21995,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":884,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":279,"flow_packet_id":2,"flow_last_seen":90776,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90776,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA1UAAEAGyRlYeEnXCgACD1\/yxH8ArdQBY7MtEWAS\/\/9f0wAAAgQFtA=="} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":885,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":294,"flow_packet_id":2,"flow_last_seen":90776,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90776,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA1YAAEAGK3HBIH7WCgACD+jMxI4Ars4ByU6XnmAS\/\/9vGAAAAgQFtA=="} +00440{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":886,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":279,"flow_packet_id":3,"flow_last_seen":90776,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90776,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo+\/1AAIAGUHQKAAIPWHhJ18R\/X\/Jjsy0RAK3UAlAQ+vB8nwAA"} +00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":887,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":288,"flow_packet_id":2,"flow_last_seen":90776,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90776,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA1cAAEAGVX5o7qz6CgACD1v8xIgAr8gBAIGaT2AS\/\/\/yGAAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":888,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":294,"flow_packet_id":3,"flow_last_seen":90776,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90776,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoYpBAAIAGTDoKAAIPwSB+1sSO6MzJTpeeAK7OAlAQ+vCL5AAA"} +00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":889,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":279,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90744,"flow_last_seen":90776,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90776,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":50303,"dst_port":24562,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00439{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":891,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":288,"flow_packet_id":3,"flow_last_seen":90777,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90777,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoBk9AAIAG0okKAAIPaO6s+sSIW\/wAgZpPAK\/IAlAQ+vAO5QAA"} +00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":892,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":294,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90777,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90777,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.32.126.214","src_port":50318,"dst_port":59596,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":894,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":288,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":90777,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90777,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":50312,"dst_port":23548,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":901,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":280,"flow_packet_id":2,"flow_last_seen":90784,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90784,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA14AAEAG805VqCJpCgACD5vkxIAAsMIB8fB5WWAS\/\/+FlQAAAgQFtA=="} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":902,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":277,"flow_packet_id":2,"flow_last_seen":90784,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90784,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA18AAEAG3PlXezbqCgACD9NyxH0AsbwBqI15YWAS\/\/+HEAAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":903,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":280,"flow_packet_id":3,"flow_last_seen":90785,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90785,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo3DZAAIAGmnkKAAIPVagiacSAm+Tx8HlZALDCAlAQ+vCiYQAA"} +00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":904,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":299,"flow_packet_id":2,"flow_last_seen":90785,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90785,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA2AAAEAGnkMzRJnWCgACD2aNxJMAsrYBwo+\/QmAS\/\/9bRgAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":905,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":277,"flow_packet_id":3,"flow_last_seen":90785,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90785,"pkt":"UlQAEjUCCAAn5uVZCABFAAAooEJAAIAGwBkKAAIPV3s26sR903KojXlhALG8AlAQ+vCj3AAA"} +00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":906,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":280,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90744,"flow_last_seen":90785,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90785,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.168.34.105","src_port":50304,"dst_port":39908,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":908,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":299,"flow_packet_id":3,"flow_last_seen":90785,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90785,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoeOBAAIAGqMYKAAIPM0SZ1sSTZo3Cj79CALK2AlAQ+vB4EgAA"} +00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":909,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":299,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90747,"flow_last_seen":90785,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90785,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":50323,"dst_port":26253,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":911,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":277,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90743,"flow_last_seen":90785,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90785,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":50301,"dst_port":54130,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":918,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_packet_id":2,"flow_last_seen":90787,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90787,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA2cAAEAGHo9QB\/zACgACDxroxIoAs7ABAD7ueWAS\/\/\/AYAAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":919,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_packet_id":3,"flow_last_seen":90787,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90787,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoIw9AAIAGfuoKAAIPUAf8wMSKGugAPu55ALOwAlAQ+vDdLAAA"} +01151{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":920,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90787,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":264,"flow_tot_l4_payload_len":264,"flow_avg_l4_payload_len":66,"midstream":0,"thread_ts_msec":90787,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":50314,"dst_port":6888,"l4_proto":"tcp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"15": {"risk":"TLS (probably) Not Carrying HTTPS","severity":"Low","risk_score": {"total":760,"client":680,"server":80}},"24": {"risk":"Missing SNI TLS Extension","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"4":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"","ja3":"6992dc627532d4fbccd43fb03d3bdeb4","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":930,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":274,"flow_packet_id":2,"flow_last_seen":90795,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90795,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA24AAEAGymQugHJrCgACDxmyxHoAtKoBziHWF2AS\/\/++AAAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":932,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":274,"flow_packet_id":3,"flow_last_seen":90796,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90796,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoDztAAIAGPpsKAAIPLoBya8R6GbLOIdYXALSqAlAQ+vDazAAA"} +00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":938,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":298,"flow_packet_id":2,"flow_last_seen":90799,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90799,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA3IAAEAGvK6khAoZCgACD9gGxJIAtaQBToGf\/mAS\/\/+tmgAAAgQFtA=="} +00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":939,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":298,"flow_packet_id":3,"flow_last_seen":90799,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90799,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoptFAAIAGmVIKAAIPpIQKGcSS2AZOgZ\/+ALWkAlAQ+vDKZgAA"} +00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":942,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":274,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90741,"flow_last_seen":90799,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90799,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":50298,"dst_port":6578,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":944,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":298,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90747,"flow_last_seen":90800,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90800,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":50322,"dst_port":55302,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":946,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":283,"flow_packet_id":2,"flow_last_seen":90800,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90800,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA3YAAEAGCtCwY7AUCgACDxjKxIMAtp4BeVRy4GAS\/\/\/DVQAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":947,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":283,"flow_packet_id":3,"flow_last_seen":90801,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90801,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoGLRAAIAGdZUKAAIPsGOwFMSDGMp5VHLgALaeAlAQ+vDgIQAA"} +00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":948,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":283,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":90801,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90801,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":50307,"dst_port":6346,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":300,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90809,"flow_last_seen":90809,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":90809,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":300,"flow_packet_id":1,"flow_last_seen":90809,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":90809,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4BlIAAIAREmwKAAIPaO6s+nAJW\/wAJA6KHB0xAtgN+vD\/0M\/t\/ONIAwABAAUAAADDglFLQA=="} +00562{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":986,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":300,"flow_packet_id":2,"flow_last_seen":90840,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":143,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":143,"pkt_l4_len":109,"thread_ts_msec":90840,"pkt":"CAAn5uVZUlQAEjUCCABFAACBA44AAEARVOdo7qz6CgACD1v8cAkAbdSrHB0xAtgN+vD\/0M\/t\/ONIAwEBAE4AAAD8W2jurPoAAAAACAAAAMMCVkNFR1RLR2IDR1VFQQICVVBDAgEGAkRVQl9jATZQIAEZ8HQAiAgAAAAAAAEAAQNESFRDAAABglFLRIDlHEU="} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":994,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":271,"flow_packet_id":2,"flow_last_seen":90843,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90843,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA5MAAEAGzLImjnfqCgACD8JExHcAt5gBIyGRwmAS\/\/8ZNwAAAgQFtA=="} +00437{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":997,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":271,"flow_packet_id":3,"flow_last_seen":90843,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90843,"pkt":"UlQAEjUCCAAn5uVZCABFAAAopBpAAIAGrC4KAAIPJo536sR3wkQjIZHCALeYAlAQ+vA2AwAA"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":999,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":301,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90845,"flow_last_seen":90845,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":90845,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":28681,"dst_port":11852,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":999,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":301,"flow_packet_id":1,"flow_last_seen":90845,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":90845,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4c0wAAIARymUKAAIPvD00t3AJLkwAJK1JGu4xAkJx0f\/\/24\/JSJ6wAwABAAUAAADDglFLQA=="} +00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1005,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":271,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90740,"flow_last_seen":90850,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90850,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":50295,"dst_port":49732,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +01580{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":1011,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90746,"flow_last_seen":90857,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":1724,"flow_avg_l4_payload_len":287,"midstream":0,"thread_ts_msec":90857,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":50314,"dst_port":6888,"l4_proto":"tcp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"6": {"risk":"Self-signed Certificate","severity":"High","risk_score": {"total":500,"client":450,"server":50}},"9": {"risk":"TLS Expired Certificate","severity":"High","risk_score": {"total":260,"client":230,"server":30}},"15": {"risk":"TLS (probably) Not Carrying HTTPS","severity":"Low","risk_score": {"total":760,"client":680,"server":80}},"24": {"risk":"Missing SNI TLS Extension","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"4":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"","ja3":"6992dc627532d4fbccd43fb03d3bdeb4","ja3s":"1249fb68f48c0444718e4d3b48b27188","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"CN=gtk-gnutella\/1.2.1","subjectDN":"CN=gtk-gnutella\/1.2.1","fingerprint":"E8:DD:F0:B2:FF:8C:27:5A:12:75:D4:AE:60:1B:D9:87:E8:FF:45:93"}} +00546{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1016,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":301,"flow_packet_id":2,"flow_last_seen":90857,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"thread_ts_msec":90857,"pkt":"CAAn5uVZUlQAEjUCCABFAAB0A6AAAEAReda8PTS3CgACDy5McAkAYD84Gu4xAkJx0f\/\/24\/JSJ6wAwEBAEEAAABMLrw9NLcAAAAACAAAAMMCVkNFR1RLR1cDR1VFQQICVVBDAgEHAkRVQ4BRAQNUTFNAA0RIVEMAAAGCUUtE7kD0pA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1026,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90864,"flow_last_seen":90864,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":90864,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":53489,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1026,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_packet_id":1,"flow_last_seen":90864,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":90864,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4OIoAAIAR8bMKAAIPubtKrXAJ0PEAJMQW\/3wxAm1gREr\/fw\/7dxmzAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1030,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":303,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90871,"flow_last_seen":90871,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":90871,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":28681,"dst_port":30566,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1030,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":303,"flow_packet_id":1,"flow_last_seen":90871,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":90871,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4xlIAAIARNMIKAAIPjoSlDXAJd2YAJJzV5\/IxAvsVo43\/HfOSkBgzAwABAAUAAADDglFLQA=="} +00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1031,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":284,"flow_packet_id":2,"flow_last_seen":90872,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90872,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA6gAAEAGqm3BJf+CCgACD\/CwxIQAuJIBv98bx2AS\/\/+nyQAAAgQFtA=="} +00440{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1032,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":284,"flow_packet_id":3,"flow_last_seen":90872,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90872,"pkt":"UlQAEjUCCAAn5uVZCABFAAAogopAAIAGq44KAAIPwSX\/gsSE8LC\/3xvHALiSAlAQ+vDElQAA"} +00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1033,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":284,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":90873,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":90873,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":50308,"dst_port":61616,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1036,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":304,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":90880,"flow_last_seen":90880,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":90880,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.32.126.214","src_port":28681,"dst_port":59596,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1036,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":304,"flow_packet_id":1,"flow_last_seen":90880,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":90880,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4YpYAAIARjBkKAAIPwSB+1nAJ6MwAJJ5bn1UxAqnqa\/T\/ZYYW3VylAwABAAUAAADDglFLQA=="} +00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1037,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":289,"flow_packet_id":2,"flow_last_seen":90882,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90882,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA6sAAEAGxg9gQUTCCgACD4qZxIkAuYwBsqFtYmAS\/\/\/rIgAAAgQFtA=="} +00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1038,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":289,"flow_packet_id":3,"flow_last_seen":90882,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90882,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoBGJAAIAGRVwKAAIPYEFEwsSJipmyoW1iALmMAlAQ+vAH7wAA"} +00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1039,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":289,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90883,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90883,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":50313,"dst_port":35481,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1041,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":291,"flow_packet_id":2,"flow_last_seen":90885,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90885,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA60AAEAGpYEtH5hwCgACD2jjxIsAuoYB181ecmAS\/\/\/cDQAAAgQFtA=="} +00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1042,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":291,"flow_packet_id":3,"flow_last_seen":90885,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90885,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoe4VAAIAGrawKAAIPLR+YcMSLaOPXzV5yALqGAlAQ+vD42QAA"} +00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1043,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":291,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90746,"flow_last_seen":90885,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90885,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":50315,"dst_port":26851,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00573{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1046,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_packet_id":2,"flow_last_seen":90892,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":149,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":149,"pkt_l4_len":115,"thread_ts_msec":90892,"pkt":"CAAn5uVZUlQAEjUCCABFAACHA68AAEARZkC5u0qtCgACD9DxcAkAc8xj\/3wxAm1gREr\/fw\/7dxmzAwEBAFQAAADx0Lm7Sq0AAAAACAAAAMMCVkNFR1RLR1cDR1VFQQICVVBDAgEJAkRVQ4BRAQE2UCoBbuAAAQAAAAAAAP\/\/C64DVExTQANESFRDAAABglFLRB3BTv4="} +00570{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1047,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":303,"flow_packet_id":2,"flow_last_seen":90892,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":149,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":149,"pkt_l4_len":115,"thread_ts_msec":90892,"pkt":"CAAn5uVZUlQAEjUCCABFAACHA7AAAEARNxaOhKUNCgACD3dmcAkAc2nw5\/IxAvsVo43\/HfOSkBgzAwEBAFQAAABmd46EpQ0AAAAACAAAAMMCVkNFR1RLR2IDR1VFQQICVVBDAv8HAkRVQ4BRAQE2UCoBBPgcHBMlAAAAAAAAAAEDVExTQANESFRDAAABglFLRFrK9p0="} +00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1048,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":278,"flow_packet_id":2,"flow_last_seen":90896,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90896,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA7EAAEAGGR5LQAavCgACDxKHxH4Au4ABJ3TJMGAS\/\/\/xsQAAAgQFtA=="} +00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1049,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":278,"flow_packet_id":3,"flow_last_seen":90896,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90896,"pkt":"UlQAEjUCCAAn5uVZCABFAAAo3P5AAIAGv9MKAAIPS0AGr8R+EocndMkwALuAAlAQ+vAOfgAA"} +00753{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1050,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":278,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90743,"flow_last_seen":90897,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":597,"flow_tot_l4_payload_len":597,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90897,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.64.6.175","src_port":50302,"dst_port":4743,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1052,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":269,"flow_packet_id":2,"flow_last_seen":90899,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":90899,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA7MAAEAGUiNhU7eUCgACDyK6xHUAvHoBhjAS2WAS\/\/94KQAAAgQFtA=="} +00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1053,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":269,"flow_packet_id":3,"flow_last_seen":90899,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":90899,"pkt":"UlQAEjUCCAAn5uVZCABFAAAos+9AAIAGIeoKAAIPYVO3lMR1IrqGMBLZALx6AlAQ+vCU9QAA"} +00755{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1058,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":269,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90739,"flow_last_seen":90905,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":90905,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":50293,"dst_port":8890,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00545{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1062,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":304,"flow_packet_id":2,"flow_last_seen":90907,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"thread_ts_msec":90907,"pkt":"CAAn5uVZUlQAEjUCCABFAAB0A7gAAEARKrzBIH7WCgACD+jMcAkAYGMhn1UxAqnqa\/T\/ZYYW3VylAwEBAEEAAADM6MEgftYIAAAAAAACAMMCVkNFR1RLR2IDR1VFQQICVVBDAgEFAkRVQ4BRAQNUTFNAA0RIVEMAAAGCUUtEmpBNrg=="} +00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1088,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":287,"flow_packet_id":2,"flow_last_seen":91051,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":91051,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA8YAAEAGMiyVHKOvCgACD8MkxIcAvm4BvtmXiWAS\/\/8GbQAAAgQFtA=="} +00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1089,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":287,"flow_packet_id":3,"flow_last_seen":91052,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":91052,"pkt":"UlQAEjUCCAAn5uVZCABFAAAozKZAAIAG6U4KAAIPlRyjr8SHwyS+2ZeJAL5uAlAQ+vAjOQAA"} +00448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1090,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":275,"flow_packet_id":2,"flow_last_seen":91057,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":91057,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA8cAAEAG2CXL3Mb0CgACDwSqxHsAv2gBodiVp2AS\/\/+P0AAAAgQFtA=="} +00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":275,"flow_packet_id":3,"flow_last_seen":91057,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":91057,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoTH9AAIAGD3EKAAIPy9zG9MR7BKqh2JWnAL9oAlAQ+vCsnAAA"} +00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1092,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":282,"flow_packet_id":2,"flow_last_seen":91058,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":91058,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA8gAAEAG\/LTc7pFSCgACD4L3xIIAwGIBECov1GAS\/\/8zjQAAAgQFtA=="} +00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1093,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":287,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":91058,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91058,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":50311,"dst_port":49956,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00439{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1094,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":282,"flow_packet_id":3,"flow_last_seen":91058,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":91058,"pkt":"UlQAEjUCCAAn5uVZCABFAAAouGtAAIAGyBQKAAIP3O6RUsSCgvcQKi\/UAMBiAlAQ+vBQWQAA"} +00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1096,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":282,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90744,"flow_last_seen":91058,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91058,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.238.145.82","src_port":50306,"dst_port":33527,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00882{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1098,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":275,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90742,"flow_last_seen":91059,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":601,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91059,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":50299,"dst_port":1194,"l4_proto":"tcp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00450{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1100,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":285,"flow_packet_id":2,"flow_last_seen":91062,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":91062,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA8wAAEAG\/T488TDCCgACD1M1xIUAwVwBVNBhD2AS\/\/\/z9wAAAgQFtA=="} +00438{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1101,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":285,"flow_packet_id":3,"flow_last_seen":91062,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":91062,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoxU5AAIAGu78KAAIPPPEwwsSFUzVU0GEPAMFcAlAQ+vAQxAAA"} +00756{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1102,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":285,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90745,"flow_last_seen":91062,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":91062,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":50309,"dst_port":21301,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00450{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1104,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":270,"flow_packet_id":2,"flow_last_seen":91074,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":91074,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA84AAEAGXEIOyP\/lCgACD5DCxHYAwlYBrXv\/HGAS\/\/8kxQAAAgQFtA=="} +00440{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1105,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":270,"flow_packet_id":3,"flow_last_seen":91074,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":91074,"pkt":"UlQAEjUCCAAn5uVZCABFAAAotiFAAIAGKfIKAAIPDsj\/5cR2kMKte\/8cAMJWAlAQ+vBBkQAA"} +00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1106,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":270,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90740,"flow_last_seen":91075,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91075,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":50294,"dst_port":37058,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1108,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":273,"flow_packet_id":2,"flow_last_seen":91076,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":91076,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsA9AAAEAGXEAOyP\/lCgACD7KOxHkAw1ABv2bicWAS\/\/8TtQAAAgQFtA=="} +00440{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1110,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":273,"flow_packet_id":3,"flow_last_seen":91076,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":91076,"pkt":"UlQAEjUCCAAn5uVZCABFAAAotiNAAIAGKfAKAAIPDsj\/5cR5so6\/ZuJxAMNQAlAQ+vAwgQAA"} +00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1111,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":273,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90741,"flow_last_seen":91076,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":91076,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":50297,"dst_port":45710,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1185,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":2,"flow_last_seen":91716,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":91716,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0QYNAAIAGx74KAAIPYteCnMRvMHWjnzXtAAAAAIAC+vC0KwAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1186,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":240,"flow_packet_id":2,"flow_last_seen":91717,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":91717,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0QNNAAIAG5KUKAAIPVHZ0xsRurkgo6JHMAAAAAIAC+vBxaAAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1197,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":245,"flow_packet_id":2,"flow_last_seen":92750,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":92750,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0nYJAAIAGGXYKAAIPSsPs+cRxSH3g2g3bAAAAAIAC+vA0rwAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1199,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":244,"flow_packet_id":2,"flow_last_seen":92750,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":92750,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0AqVAAIAGaH0KAAIPTHc3HMRwT3sv+xA+AAAAAIAC+vCQWAAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1203,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":225,"flow_packet_id":3,"flow_last_seen":93622,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":93622,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0KplAAIAGI1wKAAIP2qTGG8Rf6yo8NHW4AAAAAIAC+vBl2QAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":224,"flow_packet_id":3,"flow_last_seen":93622,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":93622,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0y5RAAIAGmKYKAAIPchsYX8ReLKPFX+7aAAAAAIAC+vA4WgAAAgQFtAEDAwgBAQQC"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1206,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":305,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":93713,"flow_last_seen":93713,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":93713,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.168.175.31","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1206,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":305,"flow_packet_id":1,"flow_last_seen":93713,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":93713,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Ab0AAIARJSYKAAIPWKivH3AJGMoAIAKXR05EED7+AQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1207,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":306,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":93714,"flow_last_seen":93714,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":93714,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.249.63.200","src_port":28681,"dst_port":22582,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1207,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":306,"flow_packet_id":1,"flow_last_seen":93714,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":93714,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0J3cAAIARnXIKAAIPKfk\/yHAJWDYAIGEwR05EED7\/AQFUC1FLUlAGUk5BXS\/iNQlw"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1208,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":268,"flow_packet_id":2,"flow_last_seen":93763,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":93763,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0GYxAAIAGqNsKAAIPXwrNQ8R0LVPIsf8hAAAAAIAC+vCCJwAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1209,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":297,"flow_packet_id":2,"flow_last_seen":93763,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":93763,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0AsBAAIAGpi8KAAIP1eVv4MSREwzLMAmEAAAAAIAC+vB1+AAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1210,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":267,"flow_packet_id":2,"flow_last_seen":93763,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":93763,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Rs1AAIAGRA4KAAIPyAeb0sRzbs28TEPZAAAAAIAC+vDQzwAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1212,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":281,"flow_packet_id":2,"flow_last_seen":93763,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":93763,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0MiVAAIAGHAgKAAIPXjZCUsSB+JU5M3UyAAAAAIAC+vBcCwAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1213,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":2,"flow_last_seen":93763,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":93763,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gg5AAIAGKkUKAAIPSVn5CMRyxdmnmnGXAAAAAIAC+vCCMAAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1214,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":286,"flow_packet_id":2,"flow_last_seen":93763,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":93763,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0O4JAAIAGzRMKAAIPTG6ZscSGnFbyaQhuAAAAAIAC+vAmPAAAAgQFtAEDAwgBAQQC"} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1215,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":227,"flow_packet_id":3,"flow_last_seen":94638,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":94638,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0AtlAAIAGwDcKAAIPGLMS8sRhuOFovA6\/AAAAAIAC+vBHrQAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1216,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":229,"flow_packet_id":3,"flow_last_seen":94638,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":94638,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0UClAAIAGv8gKAAIPenVkTsRjIzKhF7fWAAAAAIAC+vBIyQAAAgQFtAEDAwgBAQQC"} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1217,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":226,"flow_packet_id":3,"flow_last_seen":94638,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":94638,"pkt":"UlQAEjUCCAAn5uVZCABFAAA07j5AAIAGRpoKAAIPAay4MMRgM\/L4VuGpAAAAAIAC+vDb4AAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1218,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":228,"flow_packet_id":3,"flow_last_seen":94638,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":94638,"pkt":"UlQAEjUCCAAn5uVZCABFAAA03z1AAIAGuFYKAAIPRK4Sc8RixfcTIeyiAAAAAIAC+vCG0QAAAgQFtAEDAwgBAQQC"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1222,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95216,"flow_last_seen":95216,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95216,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.201.208.57","src_port":28681,"dst_port":38617,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1222,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_packet_id":1,"flow_last_seen":95216,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95216,"pkt":"UlQAEjUCCAAn5uVZCABFAABtOX8AAIAR2+8KAAIPSMnQOXAJltkAWSBpTGIxAqnQz8i8hdkTM6c6p0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1223,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95264,"flow_last_seen":95264,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95264,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":40137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1223,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_packet_id":1,"flow_last_seen":95264,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95264,"pkt":"UlQAEjUCCAAn5uVZCABFAABteh0AAIARB1oKAAIPUc1bLXAJnMkAWTuNUisxAvjRH\/hajsQp0x+4CkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1224,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95264,"flow_last_seen":95264,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95264,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.220.186.140","src_port":28681,"dst_port":27641,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1224,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_packet_id":1,"flow_last_seen":95264,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95264,"pkt":"UlQAEjUCCAAn5uVZCABFAABtBMUAAIARP0QKAAIPL9y6jHAJa\/kAWcmWUFgxAsm+7Dhb\/+NPw\/hwmEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +01410{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1225,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_packet_id":2,"flow_last_seen":95411,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95411,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBAUAAEARfX4v3LqMCgACD2v5cAkC33tEUFgxAsm+7Dhb\/+NPw\/hwmEQAAMACAAAGR1RLRwAAapTkMLTCnHtO3\/4C25AmQ4OUYisEL9y6jGv5AQAAAAR8wXsRFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtUw=="} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1226,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":304,"flow_packet_id":3,"flow_last_seen":95412,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95412,"pkt":"UlQAEjUCCAAn5uVZCABFAABtYpsAAIARi98KAAIPwSB+1nAJ6MwAWeiNeJExAmLu0Xk4X2RsSVj1uUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1228,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95443,"flow_last_seen":95443,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95443,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.240.69.199","src_port":28681,"dst_port":6348,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1228,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_packet_id":1,"flow_last_seen":95443,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95443,"pkt":"UlQAEjUCCAAn5uVZCABFAABtP0UAAIARMnUKAAIPdvBFx3AJGMwAWTV1zcQxAjBRcglTz+ngOj6nIkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1230,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":231,"flow_packet_id":3,"flow_last_seen":95653,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":95653,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0sx9AAIAG7QUKAAIPUrX72sRljhBQLtKuAAAAAIAC+vCkLQAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1231,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":233,"flow_packet_id":3,"flow_last_seen":95653,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":95653,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0vENAAIAGZKwKAAIPcfxbycRnEMmMdJG3AAAAAIAC+vCm7gAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1232,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":3,"flow_last_seen":95653,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":95653,"pkt":"UlQAEjUCCAAn5uVZCABFAAA04CVAAIAGre0KAAIPJOc7u8Rm8xqBNdLHAAAAAIAC+vD77wAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1233,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":230,"flow_packet_id":3,"flow_last_seen":95653,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":95653,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0EcNAAIAG330KAAIPYPacfsRk2wZPr5++AAAAAIAC+vDbwgAAAgQFtAEDAwgBAQQC"} +01408{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1234,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_packet_id":2,"flow_last_seen":95672,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95672,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBAgAAEARqyx28EXHCgACDxjMcAkC320uzcQxAjBRcglTz+ngOj6nIkQAAMACAAAGR1RLRwAAZ\/Bj20DGHUBcXRlTYQ4h+oNDTy0EdvBFxxjMAQAAAARQf99GFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtUw=="} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_packet_id":3,"flow_last_seen":95685,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95685,"pkt":"UlQAEjUCCAAn5uVZCABFAABtP0YAAIARMnQKAAIPdvBFx3AJGMwAWcAoRrQxAjeibVUOEjw\/2AtAPUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1237,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_packet_id":3,"flow_last_seen":95685,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95685,"pkt":"UlQAEjUCCAAn5uVZCABFAABtBMYAAIARP0MKAAIPL9y6jHAJa\/kAWT8LpTgxAh8vpCECmjOT1kHZjEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1239,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95715,"flow_last_seen":95715,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95715,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.188.98","src_port":28681,"dst_port":62851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1239,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_packet_id":1,"flow_last_seen":95715,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95715,"pkt":"UlQAEjUCCAAn5uVZCABFAABtSkUAAIARukUKAAIPbYS8YnAJ9YMAWQnlOt4xAkt+phdWa3WZX\/1iLEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1240,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95716,"flow_last_seen":95716,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95716,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.167.201.53","src_port":28681,"dst_port":47282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1240,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_packet_id":1,"flow_last_seen":95716,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95716,"pkt":"UlQAEjUCCAAn5uVZCABFAABtyVMAAIARg0EKAAIPGKfJNXAJuLIAWdvQozIxAmeG11K2Zk+mg8cBskQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1241,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95716,"flow_last_seen":95716,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95716,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1241,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_packet_id":1,"flow_last_seen":95716,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95716,"pkt":"UlQAEjUCCAAn5uVZCABFAABtGLgAAIARtUEKAAIPsGOwFHAJGMoAWdWFw\/gxApkT0lWtd136yOWRcEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +01405{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1242,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_packet_id":2,"flow_last_seen":95753,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95753,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBAoAAEARPftthLxiCgACD\/WDcAkC3zUCOt4xAkt+phdWa3WZX\/1iLEQAAMACAAAGR1RLRwAA4JsjIdkeuStic2CcxenuP1eRs7wEbYS8YvWDAQAAAATOKYIxFFdTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1243,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":300,"flow_packet_id":3,"flow_last_seen":95754,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95754,"pkt":"UlQAEjUCCAAn5uVZCABFAABtBlcAAIAREjIKAAIPaO6s+nAJW\/wAWVUmk6UxAqo+0NIYX4FTPMU3uEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1244,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":314,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95754,"flow_last_seen":95754,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95754,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.237.202.91","src_port":28681,"dst_port":16117,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1244,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":314,"flow_packet_id":1,"flow_last_seen":95754,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95754,"pkt":"UlQAEjUCCAAn5uVZCABFAABt5WoAAIARNr4KAAIPR+3KW3AJPvUAWTG5sdMxAjDioXa7maFRwy28tUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1245,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95754,"flow_last_seen":95754,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95754,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.217.84.16","src_port":28681,"dst_port":20223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1245,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_packet_id":1,"flow_last_seen":95754,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95754,"pkt":"UlQAEjUCCAAn5uVZCABFAABtX54AAIARHeoKAAIPXNlUEHAJTv8AWaUwJBUxAlN7nQQgyNq1K1wDakQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +01403{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1246,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_packet_id":2,"flow_last_seen":95773,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95773,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBAsAAEARB2mwY7AUCgACDxjKcAkC343Vw\/gxApkT0lWtd136yOWRcEQAAMACAAAGR1RLRwAA8snLCFuSuhsM38lDoCe4Q7IZIaMEsGOwFBjKAQAAAARm60BZFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="} +00557{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1248,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95784,"flow_last_seen":95784,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95784,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":63637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1248,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_packet_id":1,"flow_last_seen":95784,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95784,"pkt":"UlQAEjUCCAAn5uVZCABFAABtMiYAAIARW8MKAAIPXjZCUnAJ+JUAWU8lLkYxAuq77b+oti7DkMaMrEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1249,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95784,"flow_last_seen":95784,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95784,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.236.205.7","src_port":28681,"dst_port":34794,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1249,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_packet_id":1,"flow_last_seen":95784,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95784,"pkt":"UlQAEjUCCAAn5uVZCABFAABtkeMAAIARbpoKAAIPYOzNB3AJh+oAWd3xqy0xAvOz2v7bFV7JjaoOuEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1250,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95784,"flow_last_seen":95784,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95784,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.183.183.110","src_port":28681,"dst_port":59920,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1250,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_packet_id":1,"flow_last_seen":95784,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95784,"pkt":"UlQAEjUCCAAn5uVZCABFAABtcekAAIARV2IKAAIPrbe3bnAJ6hAAWRURh5oxAjZAPvXTOccHXf+KmUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +01406{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1251,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_packet_id":2,"flow_last_seen":95818,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95818,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBA0AAEARtvVc2VQQCgACD07\/cAkC3\/0wJBUxAlN7nQQgyNq1K1wDakQAAMACAAAGR1RLRwAA9cCVEE\/2P06nFdVsmWWAWjUBRZwEXNlUEE7\/AQAAAATtCo4VFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="} +01403{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1253,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_packet_id":2,"flow_last_seen":95892,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95892,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBA8AAEAROelg7M0HCgACD4fqcAkC3\/BRqy0xAvOz2v7bFV7JjaoOuEQAAMACAAAGR1RLRwAA+Ts9p8WeGiSZuDZKSPQI3121aXEEYOzNB4fqAQAAAASVRD4TFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSEdUS0cAALFbZ+HgSIrho0RaGRNTd1qTgMZFBC0fmHBo4w=="} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1254,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95893,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":55302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1254,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_packet_id":1,"flow_last_seen":95893,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95893,"pkt":"UlQAEjUCCAAn5uVZCABFAABtptYAAIAR2P0KAAIPpIQKGXAJ2AYAWVxSIsUxAlnYy6KYCQUz3Ng+pkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1255,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":320,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95893,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.236.200.137","src_port":28681,"dst_port":48142,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1255,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":320,"flow_packet_id":1,"flow_last_seen":95893,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95893,"pkt":"UlQAEjUCCAAn5uVZCABFAABtLrQAAIARfUcKAAIPuezIiXAJvA4AWfki1SYxAiU091nTuxkeneMv2EQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1256,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95893,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":21995,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1256,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_packet_id":1,"flow_last_seen":95893,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95893,"pkt":"UlQAEjUCCAAn5uVZCABFAABtxQIAAIAR4QoKAAIPvKXLvnAJVesAWQc1IDExAvwLw9eirMeJjOQnPkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +01403{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1258,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_packet_id":2,"flow_last_seen":95918,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95918,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBBEAAEAR33a8pcu+CgACD1XrcAkC37R2IDExAvwLw9eirMeJjOQnPkQAAMACAAAGR1RLRwAA0WC9XX1Cv4OMIP5Uj2dxFVfelx8EvKXLvlXrAQAAAAT+NOnnFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DldTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1259,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":322,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95923,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.219","src_port":28681,"dst_port":6909,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1259,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":322,"flow_packet_id":1,"flow_last_seen":95923,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95923,"pkt":"UlQAEjUCCAAn5uVZCABFAABtLi4AAIARXRAKAAIPLVh123AJGv0AWeqxHFUxAta++c2ylLcKBb\/ez0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1260,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":323,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95923,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":56070,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1260,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":323,"flow_packet_id":1,"flow_last_seen":95923,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95923,"pkt":"UlQAEjUCCAAn5uVZCABFAABtEcQAAIARHzkKAAIPYPacfnAJ2wYAWfibSFoxAjjwuKgFGYZC9XxYD0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1261,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":95923,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.250.179.237","src_port":28681,"dst_port":20848,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1261,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_packet_id":1,"flow_last_seen":95923,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":95923,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTeMAAIAR4qYKAAIPSfqz7XAJUXAAWYypWMIxAuib5nRI0KcHRTGrFEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +01403{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1262,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_packet_id":2,"flow_last_seen":95941,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95941,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBBIAAEARuTykhAoZCgACD9gGcAkC39H3IsUxAlnYy6KYCQUz3Ng+pkQAAMACAAAGR1RLRwAAwkI+xsLIWLYQq6EiNHwU7EsyAwwEpIQKGdgGAQAAAAQMPEZKFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="} +01404{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1263,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_packet_id":2,"flow_last_seen":95956,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":95956,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBBMAAEARArOtt7duCgACD+oQcAkC3zGfh5oxAjZAPvXTOccHXf+KmUQAAMACAAAGR1RLRwAA\/YvF6OaM0g0Esl9zeFHFBmeEb50Erbe3buoQAQAAAASYSwA1FEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSEdUS0cAALFbZ+HgSIrho0RaGRNTd1qTgMZFBC0fmHBo4w=="} +01404{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1264,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_packet_id":2,"flow_last_seen":96048,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":96048,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBBQAAEARafBJ+rPtCgACD1FwcAkC30eYWMIxAuib5nRI0KcHRTGrFEQAAMACAAAGR1RLRwAA1jyfIL1wKx4dMkSe+\/yFksXUYD4ESfqz7VFwAQAAAASK6DCmFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1265,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":325,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":96049,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.160.143.48","src_port":28681,"dst_port":37036,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1265,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":325,"flow_packet_id":1,"flow_last_seen":96049,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":96049,"pkt":"UlQAEjUCCAAn5uVZCABFAABtwDYAAIARi2oKAAIPU6CPMHAJkKwAWa9gWsoxAsGbN6aupxEpyf\/jN0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1266,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":96049,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.1.231.138","src_port":28681,"dst_port":56558,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1266,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_packet_id":1,"flow_last_seen":96049,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":96049,"pkt":"UlQAEjUCCAAn5uVZCABFAABtFDIAAIARzrMKAAIPZAHninAJ3O4AWZFZFoUxAuK7tbNnNS+8oB5EGUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1267,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":96049,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.28.53.225","src_port":28681,"dst_port":44859,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00533{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1267,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_packet_id":1,"flow_last_seen":96049,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":96049,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTdQAAIARVqAKAAIPVBw14XAJrzsAWZ3TvxoxApctlOGi4VjuIFMFmUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1273,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":301,"flow_packet_id":3,"flow_last_seen":96404,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":96404,"pkt":"UlQAEjUCCAAn5uVZCABFAAA8c1IAAIARylsKAAIPvD00t3AJLkwAKChuYiUKBgACAwMAAAAAAAAAADEBAAkAAABHVEtHCQABAAA="} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1277,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":235,"flow_packet_id":3,"flow_last_seen":96685,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":96685,"pkt":"UlQAEjUCCAAn5uVZCABFAAA068VAAIAGCcsKAAIPXoaansRp03KjrVDkAAAAAIAC+vDifQAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1278,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":234,"flow_packet_id":3,"flow_last_seen":96685,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":96685,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0IMxAAIAG1hsKAAIPY8eUBsRoEPJVbcPeAAAAAIAC+vCBnAAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1279,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":236,"flow_packet_id":3,"flow_last_seen":96685,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":96685,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0aotAAIAGZIwKAAIP3XxCIcRqMwT80GtdAAAAAIAC+vDo1QAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1284,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":3,"flow_last_seen":97732,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":97732,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0QYRAAIAGx70KAAIPYteCnMRvMHWjnzXtAAAAAIAC+vC0KwAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1285,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":240,"flow_packet_id":3,"flow_last_seen":97732,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":97732,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0QNRAAIAG5KQKAAIPVHZ0xsRurkgo6JHMAAAAAIAC+vBxaAAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1287,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":245,"flow_packet_id":3,"flow_last_seen":98763,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":98763,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0nYNAAIAGGXUKAAIPSsPs+cRxSH3g2g3bAAAAAIAC+vA0rwAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":244,"flow_packet_id":3,"flow_last_seen":98763,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":98763,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0AqZAAIAGaHwKAAIPTHc3HMRwT3sv+xA+AAAAAIAC+vCQWAAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1293,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":268,"flow_packet_id":3,"flow_last_seen":99778,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":99778,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0GY1AAIAGqNoKAAIPXwrNQ8R0LVPIsf8hAAAAAIAC+vCCJwAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1294,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":297,"flow_packet_id":3,"flow_last_seen":99778,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":99778,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0AsFAAIAGpi4KAAIP1eVv4MSREwzLMAmEAAAAAIAC+vB1+AAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1295,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":281,"flow_packet_id":3,"flow_last_seen":99778,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":99778,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0MidAAIAGHAYKAAIPXjZCUsSB+JU5M3UyAAAAAIAC+vBcCwAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1296,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":267,"flow_packet_id":3,"flow_last_seen":99778,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":99778,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Rs5AAIAGRA0KAAIPyAeb0sRzbs28TEPZAAAAAIAC+vDQzwAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1297,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":286,"flow_packet_id":3,"flow_last_seen":99778,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":99778,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0O4NAAIAGzRIKAAIPTG6ZscSGnFbyaQhuAAAAAIAC+vAmPAAAAgQFtAEDAwgBAQQC"} +00454{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1298,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":3,"flow_last_seen":99778,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":99778,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gg9AAIAGKkQKAAIPSVn5CMRyxdmnmnGXAAAAAIAC+vCCMAAAAgQFtAEDAwgBAQQC"} +01405{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1320,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_packet_id":2,"flow_last_seen":100920,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":100920,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBEAAAEARxyNeNkJSCgACD\/iVcAkC34d4LkYxAuq77b+oti7DkMaMrEQAAMACAAAGR1RLRwAA+wNHJRwgXbAuWugSpAUSxJsCHL8EXjZCUviVAQAAAAR+IhyrFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1450,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":328,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101122,"flow_last_seen":101122,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101122,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.105.27","src_port":28681,"dst_port":19260,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1450,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":328,"flow_packet_id":1,"flow_last_seen":101122,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101122,"pkt":"UlQAEjUCCAAn5uVZCABFAABt2AwAAIARIW0KAAIPy9xpG3AJSzwAWVR20YMxAsOjfW6uj7unlpr730QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":329,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101122,"flow_last_seen":101122,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101122,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.117.249.98","src_port":28681,"dst_port":6815,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":329,"flow_packet_id":1,"flow_last_seen":101122,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101122,"pkt":"UlQAEjUCCAAn5uVZCABFAABt42oAAIAR9S4KAAIPXHX5YnAJGp8AWRo4clsxAgMe5rjiFfxxH3X\/E0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1452,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101122,"flow_last_seen":101122,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101122,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.64.44.11","src_port":28681,"dst_port":1352,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1452,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_packet_id":1,"flow_last_seen":101122,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101122,"pkt":"UlQAEjUCCAAn5uVZCABFAABt9MQAAIARu2EKAAIPUkAsC3AJBUgAWavKICYxAiIojdyDEATTYjr6S0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +01405{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1453,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_packet_id":2,"flow_last_seen":101161,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":101161,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBIEAAEAR6R9SQCwLCgACDwVIcAkC356IICYxAiIojdyDEATTYjr6S0QAAMACAAAGR1RLRwAAs3LU9XX2K5mbs3OMTMwDrBQ47bYEUkAsCwVIAQAAAASFeL+FFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIanw=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1454,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101162,"flow_last_seen":101162,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101162,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":26851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1454,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_packet_id":1,"flow_last_seen":101162,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101162,"pkt":"UlQAEjUCCAAn5uVZCABFAABte4oAAIAR7VcKAAIPLR+YcHAJaOMAWVACTGsxArv8OnSqKZfgjqpR7EQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1456,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":3,"flow_last_seen":101163,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101163,"pkt":"UlQAEjUCCAAn5uVZCABFAABtYHkAAIARZpMKAAIPtVSyEHAJ62YAWXddengxAvwV4+vWhWE2kdf1ukQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1458,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":3,"flow_last_seen":101259,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101259,"pkt":"UlQAEjUCCAAn5uVZCABFAABtBGcAAIARhQcKAAIPYEFEwnAJipkAWaF8mwwxArcB6GYWxEVcLYtOuEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1459,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":3,"flow_last_seen":101259,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101259,"pkt":"UlQAEjUCCAAn5uVZCABFAABteOQAAIAR6HIKAAIPM0SZ1nAJZo0AWYTH3zwxAjTRxsrRaTsZKs8ZWEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1460,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_packet_id":3,"flow_last_seen":101259,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101259,"pkt":"UlQAEjUCCAAn5uVZCABFAABt0UoAAIARidoKAAIPZ+hrZHAJqfQAWbmktYQxAlY3F4usipPFNw4SZ0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +01404{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1463,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_packet_id":2,"flow_last_seen":101305,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":101305,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBIUAAEARodctH5hwCgACD2jjcAkC3267TGsxArv8OnSqKZfgjqpR7EQAAMACAAAGR1RLRwAAsVtn4eBIiuGjRFoZE1N3WpOAxkUELR+YcGjjAQAAAAQ+cByLFEdUS0cAAOCbIyHZHrkrYnNgnMXp7j9XkbO8BG2EvGL1g1dTSFIAAPJ8p2NaB+IvDcmOjYwpnv4Dgo0cBBinyTW4skdUS0cAAPLJywhbkrobDN\/JQ6AnuEOyGSGjBLBjsBQYykdUS0cAAPdrnSa2ww\/WjIRLC1ipyWI+KDekBGjurPpb\/FdTSFIAAPUb1vVQWKsuipKs18obx69UnmxtBEftyls+9UdUS0cAAPXAlRBP9j9OpxXVbJllgFo1AUWcBFzZVBBO\/0dUS0cAAPsDRyUcIF2wLlroEqQFEsSbAhy\/BF42QlL4lUdUS0cAAPk7PafFnhokmbg2Skj0CN9dtWlxBGDszQeH6kdUS0cAAP2LxejmjNINBLJfc3hRxQZnhG+dBK23t27qEEdUS0cAAMJCPsbCyFi2EKuhIjR8FOxLMgMMBKSEChnYBkdUS0cAAMs4SkQs8Plx39K+G3osYia2QR5gBLnsyIm8DkdUS0cAANFgvV19Qr+DjCD+VI9ncRVX3pcfBLyly75V61dTSFIAANEo391sZyCjuFpU0yy2PWYlrl8ABC1Yddsa\/UdUS0cAANCctnuhx+ItXQPhY9ykozj36PhcBGD2nH7bBkdUS0cAANY8nyC9cCseHTJEnvv8hZLF1GA+BEn6s+1RcEdUS0cAAN60b0CUs3pQ36DSdMP3NoNcDa2fBFOgjzCQrEdUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO0dUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan0dUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1479,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":101837,"flow_last_seen":101837,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":101837,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1479,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_packet_id":1,"flow_last_seen":101837,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":101837,"pkt":"UlQAEjUCCAAn5uVZCABFAABtAsIAAIAR5ekKAAIP1eVv4HAJEwwAWTJ5PKcxAijtzcGdOPipHVZyGEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1538,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":3,"flow_last_seen":106200,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":106200,"pkt":"UlQAEjUCCAAn5uVZCABFAABtgo8AAIAR6zkKAAIPwSX\/gnAJ8LAAWcdbqxExAsF5aprYo0LmkOznoEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1539,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_packet_id":3,"flow_last_seen":106200,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":106200,"pkt":"UlQAEjUCCAAn5uVZCABFAABt7XkAAIAREsQKAAIPUD3d9nAJd3EAWRpRkUIxAvIfqgvF6WkSbnxZFUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAONVJKmT8c3egN9Xa0CwzKQP3iGM"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1905,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":2,"flow_last_seen":106314,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":106314,"pkt":"UlQAEjUCCAAn5uVZCABFAABtDeEAAIARAL0KAAIPQh7dtXAJLuwAWUvy0dkxAnflHs8XZg0HoKrR0EQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1906,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_packet_id":2,"flow_last_seen":106314,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":106314,"pkt":"UlQAEjUCCAAn5uVZCABFAABthP0AAIARBkIKAAIPLVh12nAJGv0AWUikdrExAmyl2\/D4Flpgn2PiMkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00539{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1907,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":2,"flow_last_seen":106314,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":106314,"pkt":"UlQAEjUCCAAn5uVZCABFAABtv\/wAAIAR2kwKAAIPucvaXHAJ3oIAWXW3EqAxAn\/MqZ\/PxBBVRWBQQEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1911,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":267,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90738,"flow_last_seen":106390,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":99,"midstream":0,"thread_ts_msec":106390,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.7.155.210","src_port":50291,"dst_port":28365,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1940,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_packet_id":2,"flow_last_seen":111377,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111377,"pkt":"UlQAEjUCCAAn5uVZCABFAABtaUIAAIARBHoKAAIPSIx4KXAJunsAWR8sGNIxAigwQqvDAye6DaSDvEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00538{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1942,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":3,"flow_last_seen":111378,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111378,"pkt":"UlQAEjUCCAAn5uVZCABFAABt\/AEAAIARkCAKAAIPWHhJ13AJX\/IAWXHaSscxAtAehZxkzy2fwIIymUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1945,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_packet_id":2,"flow_last_seen":111410,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111410,"pkt":"UlQAEjUCCAAn5uVZCABFAABtEcUAAIARHzgKAAIPYPacfnAJxHkAWT0ZQMwxAkCcLpcbJhOCUhZqY0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1946,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_packet_id":2,"flow_last_seen":111410,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111410,"pkt":"UlQAEjUCCAAn5uVZCABFAABtsyAAAIARLMEKAAIPUrX72nAJjhAAWVsqHvMxAk+XtvUwrHAU08XIV0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1948,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_packet_id":2,"flow_last_seen":111444,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111444,"pkt":"UlQAEjUCCAAn5uVZCABFAABthF0AAIARuZoKAAIPGBrYX3AJNkEAWWmMsfExAus4eyslc+D\/5IAGmEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1950,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_packet_id":3,"flow_last_seen":111444,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111444,"pkt":"UlQAEjUCCAAn5uVZCABFAABtDz8AAIARfkcKAAIPLoBya3AJGbIAWdVLEhcxAss2QwDi0TkE52jmskQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1952,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_packet_id":3,"flow_last_seen":111487,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111487,"pkt":"UlQAEjUCCAAn5uVZCABFAABtxVIAAIAR+2sKAAIPPPEwwnAJUzUAWasISBwxAt4pRwswk32ROCfamkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1953,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_packet_id":3,"flow_last_seen":111487,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111487,"pkt":"UlQAEjUCCAAn5uVZCABFAABtRC4AAIARXOUKAAIPWUs0E3AJs7oAWXRDNJkxApTDctXNPn16teun9UQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1954,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_packet_id":2,"flow_last_seen":111487,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111487,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTNAAAIAR3pMKAAIPUtmwNHAJHRYAWfPlAk8xAh8B\/ES6G5uz6coo8EQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1958,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_packet_id":2,"flow_last_seen":111540,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111540,"pkt":"UlQAEjUCCAAn5uVZCABFAABtGY4AAIAR6JUKAAIPXwrNQ3AJLVMAWRLXRBcxAlgwW8d9kC2rZ7siq0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_packet_id":3,"flow_last_seen":111540,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111540,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTIMAAIARTx0KAAIPy9zG9HAJBKoAWTL89yQxAua0C8l8g6aKgyk\/10QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1963,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_packet_id":2,"flow_last_seen":111857,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":111857,"pkt":"UlQAEjUCCAAn5uVZCABFAABtOYAAAIAR2+4KAAIPSMnQOXAJltkAWbNfr0MxAtDKk1upIWPM3ig4bEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1968,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":333,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":114930,"flow_last_seen":114930,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":114930,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50327,"dst_port":46906,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1968,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":333,"flow_packet_id":1,"flow_last_seen":114930,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":114930,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0bAtAAIAGmk4KAAIPRXai5cSXtzoqx\/sEAAAAAIAC+vDeFgAAAgQFtAEDAwgBAQQC"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1969,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":334,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":114930,"flow_last_seen":114930,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":114930,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"189.147.72.83","src_port":50328,"dst_port":26108,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1969,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":334,"flow_packet_id":1,"flow_last_seen":114930,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":114930,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0z\/pAAIAGGNQKAAIPvZNIU8SYZfyEcE5AAAAAAIAC+vBk5AAAAgQFtAEDAwgBAQQC"} +00451{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1970,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":333,"flow_packet_id":2,"flow_last_seen":115039,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":115039,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsBeIAAEAGgIBFdqLlCgACD7c6xJcA8yoBKsf7BWAS\/\/\/XGAAAAgQFtA=="} +00441{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1971,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":333,"flow_packet_id":3,"flow_last_seen":115039,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":115039,"pkt":"UlQAEjUCCAAn5uVZCABFAAAobAxAAIAGmlkKAAIPRXai5cSXtzoqx\/sFAPMqAlAQ+vDz5AAA"} +00871{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1972,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":333,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":114930,"flow_last_seen":115040,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":533,"flow_tot_l4_payload_len":533,"flow_avg_l4_payload_len":133,"midstream":0,"thread_ts_msec":115040,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50327,"dst_port":46906,"l4_proto":"tcp","ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00450{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1974,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":334,"flow_packet_id":2,"flow_last_seen":115124,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":115124,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsBeQAAEAGYvO9k0hTCgACD2X8xJgA9CQBhHBOQWAS\/\/9j5QAAAgQFtA=="} +00441{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1975,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":334,"flow_packet_id":3,"flow_last_seen":115126,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":115126,"pkt":"UlQAEjUCCAAn5uVZCABFAAAoz\/tAAIAGGN8KAAIPvZNIU8SYZfyEcE5BAPQkAlAQ+vCAsQAA"} +00870{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1976,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":334,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":114930,"flow_last_seen":115127,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":538,"flow_tot_l4_payload_len":538,"flow_avg_l4_payload_len":134,"midstream":0,"thread_ts_msec":115127,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"189.147.72.83","src_port":50328,"dst_port":26108,"l4_proto":"tcp","ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1980,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":335,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":115369,"flow_last_seen":115369,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":115369,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":28681,"dst_port":37058,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1980,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":335,"flow_packet_id":1,"flow_last_seen":115369,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":115369,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ticAAIARadEKAAIPDsj\/5XAJkMIAJDeaLGAxAs8iaaH\/Df9W3JltAwABAAUAAADDglFLQA=="} +00491{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1982,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":335,"flow_packet_id":2,"flow_last_seen":115702,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":115702,"pkt":"CAAn5uVZUlQAEjUCCABFAABKBegAAEARWf8OyP\/lCgACD5DCcAkANl\/hLGAxAs8iaaH\/Df9W3JltAwEBABcAAADCkA7I\/+WyNgAAAAAgAMOCUUtEGERIlw=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1999,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":116628,"flow_last_seen":116628,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":116628,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":6888,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1999,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_packet_id":1,"flow_last_seen":116628,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":116628,"pkt":"UlQAEjUCCAAn5uVZCABFAABtIxgAAIARvpEKAAIPUAf8wHAJGugAWSw6p+kxAjYZLonacBdkV9ywAUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +01411{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2000,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_packet_id":2,"flow_last_seen":116679,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":116679,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBfMAAEARGTFQB\/zACgACDxrocAkC3\/Iip+kxAjYZLonacBdkV9ywAUQAAMACAAAGR1RLRwAAZxkkdSip9v6JKj37UBrDicBfjMAEUAf8wBroAQAAAASysOQuFEdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegldTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEFdTSFIAAAPVZnOFlO42Ib8H+pWWlT4wyAL3BBga2F82QUdUS0cAAAZMeTOG2LuCeHzpFv+0pfJ1qOd4BGfoa2Sp9EdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzuldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtUw=="} +00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2003,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_packet_id":3,"flow_last_seen":116776,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":116776,"pkt":"UlQAEjUCCAAn5uVZCABFAABte4sAAIAR7VYKAAIPLR+YcHAJaOMAWSdx+0cxAtvllYjgRR1H\/sPbPUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2005,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_packet_id":3,"flow_last_seen":116859,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":116859,"pkt":"UlQAEjUCCAAn5uVZCABFAABt9MUAAIARu2AKAAIPUkAsC3AJBUgAWR\/CHmUxAhaifRIPh7YCtQDKL0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2007,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_packet_id":2,"flow_last_seen":116893,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":116893,"pkt":"UlQAEjUCCAAn5uVZCABFAABteh4AAIARB1kKAAIPUc1bLXAJnMkAWejZ01kxAnkrgDtFtjvoOXjfs0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2009,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_packet_id":3,"flow_last_seen":116916,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":116916,"pkt":"UlQAEjUCCAAn5uVZCABFAABtSkYAAIARukQKAAIPbYS8YnAJ9YMAWSTZAPYxAt0gaIFrQZ34NDjR2kQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2010,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_packet_id":3,"flow_last_seen":116942,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":116942,"pkt":"UlQAEjUCCAAn5uVZCABFAABtkeQAAIARbpkKAAIPYOzNB3AJh+oAWWt89cIxAlSvaqi63PpUHKTx3UQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2012,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_packet_id":3,"flow_last_seen":116952,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":116952,"pkt":"UlQAEjUCCAAn5uVZCABFAABtMigAAIARW8EKAAIPXjZCUnAJ+JUAWdgAXr4xAg\/r1cFsj19qlWaDPkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAACidCo0G3v\/IJjwziXwskXn9hKth"} +00621{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2082,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":9752,"flow_last_seen":9752,"flow_idle_time":120000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":121253,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ffa4:e108","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2085,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":335,"flow_packet_id":3,"flow_last_seen":121820,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"thread_ts_msec":121820,"pkt":"UlQAEjUCCAAn5uVZCABFAAA5tigAAIARac8KAAIPDsj\/5XAJkMIAJc6JzTYxAkzkFwP\/aHzSItv7AwABAAYAAADDg0dVRUA="} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2111,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_packet_id":3,"flow_last_seen":123877,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":123877,"pkt":"UlQAEjUCCAAn5uVZCABFAABtptcAAIAR2PwKAAIPpIQKGXAJ2AYAWdpE9ZMxAnuYArMNMRKsJogRPUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2113,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":337,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":123912,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.116.64.132","src_port":28681,"dst_port":51227,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2113,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":337,"flow_packet_id":1,"flow_last_seen":123912,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":123912,"pkt":"UlQAEjUCCAAn5uVZCABFAABtUhMAAIARg2YKAAIPGHRAhHAJyBsAWUp2fKAxAtxaLOqCcitFlOv4V0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2114,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":338,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":123912,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.198.205.196","src_port":28681,"dst_port":20778,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2114,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":338,"flow_packet_id":1,"flow_last_seen":123912,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":123912,"pkt":"UlQAEjUCCAAn5uVZCABFAABt60MAAIARl6IKAAIP3cbNxHAJUSoAWRoYg28xAvjrsUFUSfHbBKidMkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2115,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":339,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":123912,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":54130,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2115,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":339,"flow_packet_id":1,"flow_last_seen":123912,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":123912,"pkt":"UlQAEjUCCAAn5uVZCABFAABtoEYAAIAR\/8UKAAIPV3s26nAJ03IAWfTcKgkxAlGmPJUzLkH07Ma7h0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +01410{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2118,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":338,"flow_packet_id":2,"flow_last_seen":124065,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":124065,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBkcAAEARuhndxs3ECgACD1EqcAkC3zKOg28xAvjrsUFUSfHbBKidMkQAAMACAAAGR1RLRwAAhAWx\/4G\/aeOxkw5wrlcHOTlCresE3cbNxFEqAQAAAAT9knizFEdUS0cAAIPPdMtTw3ywAQrcKHskULaFt8T9BFd7NurTckdUS0cAAIBDDfCNVDqFgBWTNBe\/R1a2V7AXBLm7Sq3Q8UdUS0cAAI1c\/QX9I39S2eczHf8bGxQqBh3SBCaOd+rCRFdTSFIAAIsML3baZ9qjEzov01XuwUWPp8CvBBiB6TxOFldTSFIAAIgInuBYn2DWNYTpgSOhE3nGOSSqBGLQGpoTgldTSFIAAJMpLUy99S6l5+o3G\/7HZbY0zUPGBFnUW5sUS1NOT1cAAJJLJdecP9uDvZhuUeP7MwcedtuWBM8mo+QaekdUS0cAAJ6Xxzbx1oA8a67zMFTEYzHds+ukBEziVWkYyldTSFIAAJ7Bez1ZQQgPxovuLAykgS8CMrDdBLAKqQox\/0dUS0cAAJp\/6ofTpH0Z7c9sfONgy\/6jjg5ZBFTFYV4FUFdTSFIAAJgFqYyWS9v2Yq4KyYrmzTVJWc5SBGP6\/WMuK0dUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO0dUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAALd6AZ7svQKtiRxAHRTzpxSemu\/LBNXlb+ATDEdUS0cAALSr6ArQaneMzMJ81PWuqjO12gqLBLV2NdR1LkdUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSEdUS0cAALFbZ+HgSIrho0RaGRNTd1qTgMZFBC0fmHBo40dUS0cAAL1cZVAaZZhJTOPlkpw6jfT8aYRtBD\/kr6kHkA=="} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2119,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_packet_id":3,"flow_last_seen":124065,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":124065,"pkt":"UlQAEjUCCAAn5uVZCABFAABtOI8AAIAR8XkKAAIPubtKrXAJ0PEAWeogCGsxAoAKiW4WeGL5TjmTYEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2120,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124066,"flow_last_seen":124066,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124066,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49732,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2120,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_packet_id":1,"flow_last_seen":124066,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":124066,"pkt":"UlQAEjUCCAAn5uVZCABFAABtpB8AAIAR69kKAAIPJo536nAJwkQAWcjqSEIxAiBrw4qXLe42xzCJ9UQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2121,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":341,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124066,"flow_last_seen":124066,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124066,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.129.233.60","src_port":28681,"dst_port":19990,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2121,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":341,"flow_packet_id":1,"flow_last_seen":124066,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":124066,"pkt":"UlQAEjUCCAAn5uVZCABFAABtsCgAAIARfIsKAAIPGIHpPHAJThYAWZr\/PMAxAkVlEJdEiTyKQUzsekQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2123,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.208.26.154","src_port":28681,"dst_port":4994,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2123,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_packet_id":1,"flow_last_seen":124090,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":124090,"pkt":"UlQAEjUCCAAn5uVZCABFAABtt4sAAIAR+XsKAAIPYtAamnAJE4IAWYPzFGQxAgG2rIRjjgWOdH93UEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2124,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":343,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.212.91.155","src_port":28681,"dst_port":5195,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2124,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":343,"flow_packet_id":1,"flow_last_seen":124090,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":124090,"pkt":"UlQAEjUCCAAn5uVZCABFAABt2TsAAIARn8YKAAIPWdRbm3AJFEsAWd1KrbwxApZ9ZL+wNENsMFG4eUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2125,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":124090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"207.38.163.228","src_port":28681,"dst_port":6778,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2125,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_packet_id":1,"flow_last_seen":124090,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":124090,"pkt":"UlQAEjUCCAAn5uVZCABFAABtN+oAAIARg3wKAAIPzyaj5HAJGnoAWUl8GqIxAsDHb8ARC\/TCVyKtTkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +01408{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2126,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_packet_id":2,"flow_last_seen":124181,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":124181,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBkkAAEARxyomjnfqCgACD8JEcAkC3z99SEIxAiBrw4qXLe42xzCJ9UQAAMACAAAGR1RLRwAAjVz9Bf0jf1LZ5zMd\/xsbFCoGHdIEJo536sJEAQAAAAT9X3JyFEdUS0cAAIQFsf+Bv2njsZMOcK5XBzk5Qq3rBN3GzcRRKkdUS0cAAIPPdMtTw3ywAQrcKHskULaFt8T9BFd7NurTckdUS0cAAIBDDfCNVDqFgBWTNBe\/R1a2V7AXBLm7Sq3Q8VdTSFIAAIsML3baZ9qjEzov01XuwUWPp8CvBBiB6TxOFldTSFIAAIgInuBYn2DWNYTpgSOhE3nGOSSqBGLQGpoTgldTSFIAAJMpLUy99S6l5+o3G\/7HZbY0zUPGBFnUW5sUS1NOT1cAAJJLJdecP9uDvZhuUeP7MwcedtuWBM8mo+QaekdUS0cAAJ6Xxzbx1oA8a67zMFTEYzHds+ukBEziVWkYyldTSFIAAJ7Bez1ZQQgPxovuLAykgS8CMrDdBLAKqQox\/0dUS0cAAJp\/6ofTpH0Z7c9sfONgy\/6jjg5ZBFTFYV4FUFdTSFIAAJgFqYyWS9v2Yq4KyYrmzTVJWc5SBGP6\/WMuK0dUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO0dUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAALd6AZ7svQKtiRxAHRTzpxSemu\/LBNXlb+ATDEdUS0cAALSr6ArQaneMzMJ81PWuqjO12gqLBLV2NdR1LkdUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSEdUS0cAALFbZ+HgSIrho0RaGRNTd1qTgMZFBC0fmHBo40dUS0cAAL1cZVAaZZhJTOPlkpw6jfT8aYRtBD\/kr6kHkA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2164,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":345,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":126831,"flow_last_seen":126831,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":126831,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50330,"dst_port":46906,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2164,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":345,"flow_packet_id":1,"flow_last_seen":126831,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":126831,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0bCBAAIAGmjkKAAIPRXai5cSatzq0d6IdAAAAAIAC+vCtSgAAAgQFtAEDAwgBAQQC"} +00451{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2165,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":345,"flow_packet_id":2,"flow_last_seen":126943,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":126943,"pkt":"CAAn5uVZUlQAEjUCCABFAAAsBmMAAEAGf\/9FdqLlCgACD7c6xJoBCaABtHeiHmAS\/\/8wNgAAAgQFtA=="} +00440{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2166,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":345,"flow_packet_id":3,"flow_last_seen":126943,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":126943,"pkt":"UlQAEjUCCAAn5uVZCABFAAAobCFAAIAGmkQKAAIPRXai5cSatzq0d6IeAQmgAlAQ+vBNAgAA"} +00871{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2167,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":345,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":126831,"flow_last_seen":126944,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":513,"flow_tot_l4_payload_len":513,"flow_avg_l4_payload_len":128,"midstream":0,"thread_ts_msec":126944,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50330,"dst_port":46906,"l4_proto":"tcp","ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2197,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":346,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.226.85.105","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2197,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":346,"flow_packet_id":1,"flow_last_seen":129174,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":129174,"pkt":"UlQAEjUCCAAn5uVZCABFAABtuPMAAIAR0zIKAAIPTOJVaXAJGMoAWVtEeBkxArN0R\/zFhR7fMHiNqUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2198,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":347,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.10.169.10","src_port":28681,"dst_port":12799,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2198,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":347,"flow_packet_id":1,"flow_last_seen":129174,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":129174,"pkt":"UlQAEjUCCAAn5uVZCABFAABt3TUAAIAR+CYKAAIPsAqpCnAJMf8AWSFl+80xAiQL9J1qTYJox\/q2yUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2199,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":348,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129174,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.197.97.94","src_port":28681,"dst_port":1360,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2199,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":348,"flow_packet_id":1,"flow_last_seen":129174,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":129174,"pkt":"UlQAEjUCCAAn5uVZCABFAABttG4AAIARw98KAAIPVMVhXnAJBVAAWURxEsIxAlakBl2ebhXyeemOeEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00532{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2200,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":349,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129210,"flow_last_seen":129210,"flow_idle_time":120000,"flow_min_l4_payload_len":117,"flow_max_l4_payload_len":117,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":117,"midstream":0,"thread_ts_msec":129210,"l3_proto":"ip4","src_ip":"84.197.97.94","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3} +00576{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2200,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":349,"flow_packet_id":1,"flow_last_seen":129210,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":151,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":151,"pkt_l4_len":117,"thread_ts_msec":129210,"pkt":"CAAn5uVZUlQAEjUCCABFwACJBngAAH8BcgpUxWFeCgACDwMDv5kAAAAARQAAbbRuAAB\/EcTfCgACD1TFYV5wCQVQAFlEcRLCMQJWpAZdnm4V8nnpjnhEAAA6AAAABUdUS0cAACidCo0G3v\/IJjwziXwskXn9hKthBF0v4jVwCQEBAACHpNmcaMjLrgz72SMJ7seAsLgKkg=="} +00610{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2200,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":349,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129210,"flow_last_seen":129210,"flow_idle_time":120000,"flow_min_l4_payload_len":117,"flow_max_l4_payload_len":117,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":117,"midstream":0,"thread_ts_msec":129210,"l3_proto":"ip4","src_ip":"84.197.97.94","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":5.868061} +01408{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2201,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":346,"flow_packet_id":2,"flow_last_seen":129344,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":129344,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBnkAAEARwydM4lVpCgACDxjKcAkC3ybmeBkxArN0R\/zFhR7fMHiNqUQAAMACAAAGR1RLRwAAnpfHNvHWgDxrrvMwVMRjMd2z66QETOJVaRjKAQAAAAS4IqVOFEdUS0cAAIQFsf+Bv2njsZMOcK5XBzk5Qq3rBN3GzcRRKkdUS0cAAIPPdMtTw3ywAQrcKHskULaFt8T9BFd7NurTckdUS0cAAIBDDfCNVDqFgBWTNBe\/R1a2V7AXBLm7Sq3Q8UdUS0cAAI1c\/QX9I39S2eczHf8bGxQqBh3SBCaOd+rCRFdTSFIAAIsML3baZ9qjEzov01XuwUWPp8CvBBiB6TxOFldTSFIAAIgInuBYn2DWNYTpgSOhE3nGOSSqBGLQGpoTgldTSFIAAJMpLUy99S6l5+o3G\/7HZbY0zUPGBFnUW5sUS1NOT1cAAJJLJdecP9uDvZhuUeP7MwcedtuWBM8mo+QaeldTSFIAAJ7Bez1ZQQgPxovuLAykgS8CMrDdBLAKqQox\/0dUS0cAAJp\/6ofTpH0Z7c9sfONgy\/6jjg5ZBFTFYV4FUFdTSFIAAJgFqYyWS9v2Yq4KyYrmzTVJWc5SBGP6\/WMuK0dUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO0dUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAALSr6ArQaneMzMJ81PWuqjO12gqLBLV2NdR1LkdUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSEdUS0cAALFbZ+HgSIrho0RaGRNTd1qTgMZFBC0fmHBo40dUS0cAAL1cZVAaZZhJTOPlkpw6jfT8aYRtBD\/kr6kHkEdUS0cAALyzuhm5M4uYhLkABGRqZbdy38iOBGIjVe59rQ=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2202,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":350,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129345,"flow_last_seen":129345,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":129345,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.250.253.99","src_port":28681,"dst_port":11819,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2202,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":350,"flow_packet_id":1,"flow_last_seen":129345,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":129345,"pkt":"UlQAEjUCCAAn5uVZCABFAABtA3wAAIARyZcKAAIPY\/r9Y3AJLisAWcb1VskxAtkesLI2UdbrHnvJmEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2203,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_packet_id":2,"flow_last_seen":129345,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":129345,"pkt":"UlQAEjUCCAAn5uVZCABFAABtFDMAAIARzrIKAAIPZAHninAJ3O4AWa5oGAExAiz8sZobXXh7jKY+cEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_packet_id":2,"flow_last_seen":129345,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":129345,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTdUAAIARVp8KAAIPVBw14XAJrzsAWRB8uXsxAsNFs8rL71MevwvUD0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00638{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":9752,"flow_last_seen":14765,"flow_idle_time":120000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":412,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":130927,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}} +00636{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":10750,"flow_last_seen":10750,"flow_idle_time":120000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":130927,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}} +00634{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":9752,"flow_last_seen":17749,"flow_idle_time":120000,"flow_min_l4_payload_len":8,"flow_max_l4_payload_len":16,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":13,"midstream":0,"thread_ts_msec":130927,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2247,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":351,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":131668,"flow_last_seen":131668,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":131668,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"187.37.87.189","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2247,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":351,"flow_packet_id":1,"flow_last_seen":131668,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131668,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0FboAAIARBg4KAAIPuyVXvXAJGMoAIPd5R05EED8AAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2248,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":2,"flow_last_seen":131668,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131668,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0f68AAIAR17kKAAIPd+BfYXAJtRQAIJbPR05EED8BAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2249,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":188,"flow_packet_id":2,"flow_last_seen":131669,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131669,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05JQAAIARi28KAAIPU4ZrIHAJl7QAIMzJR05EED8CAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2250,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":141,"flow_packet_id":2,"flow_last_seen":131669,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131669,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0s0oAAIARB\/AKAAIPrGHHDnAJGMoAIJbpR05EED8DAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2251,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":165,"flow_packet_id":2,"flow_last_seen":131670,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131670,"pkt":"UlQAEjUCCAAn5uVZCABFAAA06P4AAIARw6oKAAIPVksrtnAJqe4AIPcyR05EED8EAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2252,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":183,"flow_packet_id":2,"flow_last_seen":131670,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131670,"pkt":"UlQAEjUCCAAn5uVZCABFAAA085gAAIARz68KAAIPW6wPtnAJk8UAICP6R05EED8FAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2253,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":2,"flow_last_seen":131670,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131670,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05pMAAIARsCEKAAIPTudJDnAJGMoAIHJhR05EED8GAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2254,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":164,"flow_packet_id":2,"flow_last_seen":131671,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131671,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0MzkAAIARkVYKAAIPjsXbVXAJZnoAIFKKR05EED8HAQFUC1FLUlAGUk5BXS\/iNQlw"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2255,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":352,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":131671,"flow_last_seen":131671,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":131671,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.191.49.159","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2255,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":352,"flow_packet_id":1,"flow_last_seen":131671,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131671,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0NSMAAIARFykKAAIPsL8xn3AJGMoAICf2R05EED8IAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2256,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":128,"flow_packet_id":2,"flow_last_seen":131671,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131671,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09U4AAIARELMKAAIPTY3bG3AJkswAIGeoR05EED8JAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2257,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":166,"flow_packet_id":2,"flow_last_seen":131671,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131671,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0rnIAAIARKEIKAAIPWjv9unAJPMMAII5jR05EED8KAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2258,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":129,"flow_packet_id":2,"flow_last_seen":131672,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131672,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0790AAIARW48KAAIPsIoys3AJcuMAIMz6R05EED8LAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2259,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":182,"flow_packet_id":2,"flow_last_seen":131672,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131672,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0BKQAAIARed4KAAIPSQNnJXAJiwUAIOfsR05EED8MAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2260,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":139,"flow_packet_id":2,"flow_last_seen":131672,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131672,"pkt":"UlQAEjUCCAAn5uVZCABFAAA077wAAIARtrUKAAIPpanijnAJGMoAIIIXR05EED8NAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2261,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":137,"flow_packet_id":2,"flow_last_seen":131672,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131672,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05VAAAIARsFMKAAIPUkFGxXAJVL0AIDVVR05EED8OAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2262,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":173,"flow_packet_id":2,"flow_last_seen":131672,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131672,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0TpwAAIARiIYKAAIPeWPeJHAJr7wAIBvTR05EED8PAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2263,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":163,"flow_packet_id":2,"flow_last_seen":131673,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131673,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0yVgAAIARbDUKAAIPWH6gnnAJGMoAIBEwR05EED8QAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2264,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":2,"flow_last_seen":131673,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131673,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0p7UAAIARK7MKAAIPWKkCmXAJzL4AIPsUR05EED8RAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2265,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":2,"flow_last_seen":131673,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131673,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Wk0AAIARMwEKAAIPVhdLRXAJGMoAIGjuR05EED8SAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2266,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":2,"flow_last_seen":131673,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131673,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0rD4AAIARiPIKAAIPVuOilnAJGMoAIBDQR05EED8TAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2267,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":2,"flow_last_seen":131673,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":131673,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0JF4AAIARIm4KAAIPWkGNnXAJGMoAICJqR05EED8UAQFUC1FLUlAGUk5BXS\/iNQlw"} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2280,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":353,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":132831,"flow_last_seen":132831,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":132831,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.181.151.217","src_port":28681,"dst_port":25282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2280,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":353,"flow_packet_id":1,"flow_last_seen":132831,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132831,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0BqoAAIARzHEKAAIPw7WX2XAJYsIAIGTAR05EED8VAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2281,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":2,"flow_last_seen":132831,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132831,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0jJMAAIARUAgKAAIPp3KqnHAJXSQAIHPdR05EED8WAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2282,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":2,"flow_last_seen":132831,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132831,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0v84AAIARvTMKAAIPc0U+Y3AJGMoAIFidR05EED8XAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2283,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":160,"flow_packet_id":2,"flow_last_seen":132831,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132831,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0XroAAIARSzcKAAIPU5YxI3AJfsAAIB+VR05EED8YAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2284,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":195,"flow_packet_id":2,"flow_last_seen":132832,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132832,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0D4QAAIAR1i4KAAIPseeXEHAJGMoAIMFLR05EED8ZAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2285,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":140,"flow_packet_id":2,"flow_last_seen":132832,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132832,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0JXkAAIARS7IKAAIPTcVvunAJGMoAIEzDR05EED8aAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2286,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":200,"flow_packet_id":2,"flow_last_seen":132832,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132832,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0oO8AAIAR8ngKAAIPiscQe3AJzwEAILjHR05EED8bAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2287,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":172,"flow_packet_id":2,"flow_last_seen":132832,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132832,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0dB0AAIAR1MIKAAIPV0WOhXAJPG8AIADRR05EED8cAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":167,"flow_packet_id":2,"flow_last_seen":132832,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132832,"pkt":"UlQAEjUCCAAn5uVZCABFAAA08GYAAIARdXYKAAIPXR1rsHAJT4sAIAqxR05EED8dAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2289,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":2,"flow_last_seen":132832,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132832,"pkt":"UlQAEjUCCAAn5uVZCABFAAA02U4AAIAREUQKAAIPBbQ+ZHAJtTEAICm\/R05EED8eAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2290,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":2,"flow_last_seen":132832,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132832,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09RgAAIARAUEKAAIPW6\/coXAJPWkAIK1NR05EED8fAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":180,"flow_packet_id":2,"flow_last_seen":132833,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132833,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0amgAAIARaXcKAAIPQoMYSHAJd\/cAIFBER05EED8gAQFUC1FLUlAGUk5BXS\/iNQlw"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2292,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":354,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":132833,"flow_last_seen":132833,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":132833,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.236.247.120","src_port":28681,"dst_port":1032,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2292,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":354,"flow_packet_id":1,"flow_last_seen":132833,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132833,"pkt":"UlQAEjUCCAAn5uVZCABFAAA02w8AAIARCzYKAAIPUOz3eHAJBAgAINaYR05EED8hAQFUC1FLUlAGUk5BXS\/iNQlw"} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2293,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":2,"flow_last_seen":132833,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132833,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0alcAAIAR6coKAAIPy94OqnAJWyQAIO1XR05EED8iAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2294,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":177,"flow_packet_id":2,"flow_last_seen":132833,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132833,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xBIAAIARbZAKAAIPRZ23anAJGMoAIA0yR05EED8jAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2295,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":135,"flow_packet_id":2,"flow_last_seen":132834,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132834,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0fT4AAIARi9MKAAIPwfpjnnAJGMoAIOSfR05EED8kAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2296,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":2,"flow_last_seen":132834,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132834,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0POsAAIARNbcKAAIPyHjzj3AJGMoAIE4vR05EED8lAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2297,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":2,"flow_last_seen":132834,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132834,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0NAAAAIAR\/98KAAIPW0WfhXAJbWAAILrVR05EED8mAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2298,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":209,"flow_packet_id":2,"flow_last_seen":132834,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":132834,"pkt":"UlQAEjUCCAAn5uVZCABFAAA06UUAAIARhscKAAIPW7Ni6nAJGMoAIEuYR05EED8nAQFUC1FLUlAGUk5BXS\/iNQlw"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2308,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":329,"flow_packet_id":2,"flow_last_seen":134428,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":134428,"pkt":"UlQAEjUCCAAn5uVZCABFAABt42sAAIAR9S0KAAIPXHX5YnAJGp8AWRMY2acxAlcGA\/foqDhgI8cvZkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2309,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":328,"flow_packet_id":2,"flow_last_seen":134428,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":134428,"pkt":"UlQAEjUCCAAn5uVZCABFAABt2A0AAIARIWwKAAIPy9xpG3AJSzwAWfadNtMxAvhTojwebGcOOnMkR0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2310,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_packet_id":2,"flow_last_seen":134428,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":134428,"pkt":"UlQAEjUCCAAn5uVZCABFAABtAsMAAIAR5egKAAIP1eVv4HAJEwwAWfhP39IxAiTPawjpKg8FqMjKpUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2360,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139506,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.118.53.212","src_port":28681,"dst_port":29998,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2360,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_packet_id":1,"flow_last_seen":139506,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139506,"pkt":"UlQAEjUCCAAn5uVZCABFAABtAv8AAIARQCgKAAIPtXY11HAJdS4AWScUhfMxArbJ5SyHh4zpjzvfRkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2361,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139506,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"63.228.175.169","src_port":28681,"dst_port":1936,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2361,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_packet_id":1,"flow_last_seen":139506,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139506,"pkt":"UlQAEjUCCAAn5uVZCABFAABtYr4AAIAR3CUKAAIPP+SvqXAJB5AAWZrqJBYxAlmizjMkdrKTCQRuaEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2362,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":357,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139506,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.35.85.238","src_port":28681,"dst_port":32173,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2362,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":357,"flow_packet_id":1,"flow_last_seen":139506,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139506,"pkt":"UlQAEjUCCAAn5uVZCABFAABtewQAAIAR+1sKAAIPYiNV7nAJfa0AWf9BqZoxAuJR0ARRd\/sw16p3JUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +01408{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2372,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_packet_id":2,"flow_last_seen":139668,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":139668,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBs0AAEARedS1djXUCgACD3UucAkC3zh9hfMxArbJ5SyHh4zpjzvfRkQAAMACAAAGR1RLRwAAtKvoCtBqd4zMwnzU9a6qM7XaCosEtXY11HUuAQAAAARfhHP4FEdUS0cAAIQFsf+Bv2njsZMOcK5XBzk5Qq3rBN3GzcRRKkdUS0cAAIBDDfCNVDqFgBWTNBe\/R1a2V7AXBLm7Sq3Q8UdUS0cAAI1c\/QX9I39S2eczHf8bGxQqBh3SBCaOd+rCRFdTSFIAAIsML3baZ9qjEzov01XuwUWPp8CvBBiB6TxOFldTSFIAAIgInuBYn2DWNYTpgSOhE3nGOSSqBGLQGpoTgldTSFIAAJMpLUy99S6l5+o3G\/7HZbY0zUPGBFnUW5sUS1NOT1cAAJJLJdecP9uDvZhuUeP7MwcedtuWBM8mo+QaekdUS0cAAJ6Xxzbx1oA8a67zMFTEYzHds+ukBEziVWkYyldTSFIAAJ7Bez1ZQQgPxovuLAykgS8CMrDdBLAKqQox\/0dUS0cAAJp\/6ofTpH0Z7c9sfONgy\/6jjg5ZBFTFYV4FUFdTSFIAAJgFqYyWS9v2Yq4KyYrmzTVJWc5SBGP6\/WMuK0dUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO0dUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSEdUS0cAALFbZ+HgSIrho0RaGRNTd1qTgMZFBC0fmHBo40dUS0cAAL1cZVAaZZhJTOPlkpw6jfT8aYRtBD\/kr6kHkEdUS0cAALyzuhm5M4uYhLkABGRqZbdy38iOBGIjVe59rUdUS0cAALrtVGIh6HCMeHje7ytMi7+QCmj9BC\/grq4Yyg=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2373,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":358,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139669,"flow_last_seen":139669,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":139669,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.224.174.174","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2373,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":358,"flow_packet_id":1,"flow_last_seen":139669,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139669,"pkt":"UlQAEjUCCAAn5uVZCABFAABtmlYAAIARtYwKAAIPL+CurnAJGMoAWfYTyxgxAvXWHJDN+FF7HrIjWEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2374,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_packet_id":3,"flow_last_seen":139669,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139669,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTeQAAIAR4qUKAAIPSfqz7XAJUXAAWTtzDAwxAhYFwQyFnvxYxDh4UUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2375,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_packet_id":3,"flow_last_seen":139669,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139669,"pkt":"UlQAEjUCCAAn5uVZCABFAABtxQMAAIAR4QkKAAIPvKXLvnAJVesAWccLy3UxAr1ooy\/Zmhwx1EOQ8UQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2379,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_packet_id":3,"flow_last_seen":139695,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139695,"pkt":"UlQAEjUCCAAn5uVZCABFAABtX58AAIARHekKAAIPXNlUEHAJTv8AWRxrcuoxAvEddJz1CNyRxwOe00QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +01409{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2380,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_packet_id":2,"flow_last_seen":139713,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":139713,"pkt":"CAAn5uVZUlQAEjUCCABFAALzBs8AAEARdY8\/5K+pCgACDweQcAkC3wv2JBYxAlmizjMkdrKTCQRuaEQAAMACAAAGR1RLRwAAvVxlUBplmElM4+WSnDqN9PxphG0EP+SvqQeQAQAAAAQC89xEFEdUS0cAAISEnKMAahWoBBfUee10B\/B49\/r0BBh0QITIG0dUS0cAAIQFsf+Bv2njsZMOcK5XBzk5Qq3rBN3GzcRRKkdUS0cAAIPPdMtTw3ywAQrcKHskULaFt8T9BFd7NurTckdUS0cAAIBDDfCNVDqFgBWTNBe\/R1a2V7AXBLm7Sq3Q8UdUS0cAAI1c\/QX9I39S2eczHf8bGxQqBh3SBCaOd+rCRFdTSFIAAIsML3baZ9qjEzov01XuwUWPp8CvBBiB6TxOFldTSFIAAIgInuBYn2DWNYTpgSOhE3nGOSSqBGLQGpoTgldTSFIAAJMpLUy99S6l5+o3G\/7HZbY0zUPGBFnUW5sUS1NOT1cAAJJLJdecP9uDvZhuUeP7MwcedtuWBM8mo+QaekdUS0cAAJ6Xxzbx1oA8a67zMFTEYzHds+ukBEziVWkYyldTSFIAAJ7Bez1ZQQgPxovuLAykgS8CMrDdBLAKqQox\/0dUS0cAAJp\/6ofTpH0Z7c9sfONgy\/6jjg5ZBFTFYV4FUFdTSFIAAJgFqYyWS9v2Yq4KyYrmzTVJWc5SBGP6\/WMuK0dUS0cAAKZeyrvsa5mvejLQ38QnOIQ2zbdtBGQB54rc7ldTSFIAAKQeYlqSZYffwoHRlw8bFrfmBFSvBFQcNeGvO0dUS0cAAK10JPaTOb0hgYkPVi8cpzY7gtJoBFx1+WIan1dTSFIAAKr7G8iP9T\/W+jUmPMkpEJiqR57KBMvcaRtLPEdUS0cAALSr6ArQaneMzMJ81PWuqjO12gqLBLV2NdR1LkdUS0cAALNy1PV19iuZm7NzjEzMA6wUOO22BFJALAsFSEdUS0cAALFbZ+HgSIrho0RaGRNTd1qTgMZFBC0fmHBo4w=="} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2382,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_packet_id":3,"flow_last_seen":139724,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139724,"pkt":"UlQAEjUCCAAn5uVZCABFAABtGLkAAIARtUAKAAIPsGOwFHAJGMoAWZkZdrExAg1GSrdXL+O9TXzC9kQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2383,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_packet_id":3,"flow_last_seen":139724,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":139724,"pkt":"UlQAEjUCCAAn5uVZCABFAABtceoAAIARV2EKAAIPrbe3bnAJ6hAAWRX5yaAxAh\/9BvdPXg4EHkta+EQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAIek2ZxoyMuuDPvZIwnux4CwuAqS"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2525,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":3,"flow_last_seen":152618,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":152618,"pkt":"UlQAEjUCCAAn5uVZCABFAABtv\/0AAIAR2ksKAAIPucvaXHAJ3oIAWWGJo3cxAvUqie+XZ8I4MOlY7kQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2526,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":3,"flow_last_seen":152619,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":152619,"pkt":"UlQAEjUCCAAn5uVZCABFAABtDeIAAIARALwKAAIPQh7dtXAJLuwAWUb9hToxArVYIH1ZKsd\/uJMQM0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2527,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_packet_id":3,"flow_last_seen":152619,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":152619,"pkt":"UlQAEjUCCAAn5uVZCABFAABthP4AAIARBkEKAAIPLVh12nAJGv0AWYQlGHcxArF+TA2rx0u82pqvx0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2584,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_packet_id":3,"flow_last_seen":157735,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":157735,"pkt":"UlQAEjUCCAAn5uVZCABFAABtTNEAAIAR3pIKAAIPUtmwNHAJHRYAWW7a1ysxAv0xARnqbOwDKCN3NUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2585,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_packet_id":3,"flow_last_seen":157736,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":157736,"pkt":"UlQAEjUCCAAn5uVZCABFAABtGY8AAIAR6JQKAAIPXwrNQ3AJLVMAWaXpjUExAjTUCUmhKozUcF9w9kQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2611,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":359,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":160009,"flow_last_seen":160009,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":160009,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":51685,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2611,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":359,"flow_packet_id":1,"flow_last_seen":160009,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":160009,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4K8AAAER3GoKAAIP7\/\/\/+snlB2wAtiNJTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2611,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":359,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":160009,"flow_last_seen":160009,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":160009,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":51685,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2621,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":359,"flow_packet_id":2,"flow_last_seen":161017,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":161017,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LAAAAER3GkKAAIP7\/\/\/+snlB2wAtiNJTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2635,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":359,"flow_packet_id":3,"flow_last_seen":162017,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":162017,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LEAAAER3GgKAAIP7\/\/\/+snlB2wAtiNJTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2645,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_packet_id":3,"flow_last_seen":162802,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":162802,"pkt":"UlQAEjUCCAAn5uVZCABFAABtOYEAAIAR2+0KAAIPSMnQOXAJltkAWe6G\/a8xAp990wTPUYO\/Pfo6nUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2646,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_packet_id":3,"flow_last_seen":162802,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":162802,"pkt":"UlQAEjUCCAAn5uVZCABFAABteh8AAIARB1gKAAIPUc1bLXAJnMkAWbiO848xAsrceesGB02tmHOza0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2649,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_packet_id":3,"flow_last_seen":163118,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":163118,"pkt":"UlQAEjUCCAAn5uVZCABFAABtaUMAAIARBHkKAAIPSIx4KXAJunsAWYYe1\/IxAlVh9Sy2e9u2IvEBSkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2654,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_packet_id":3,"flow_last_seen":163151,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":163151,"pkt":"UlQAEjUCCAAn5uVZCABFAABtEcYAAIARHzcKAAIPYPacfnAJxHkAWQoVn34xAkioRMbk8SJGF6bCb0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2655,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_packet_id":3,"flow_last_seen":163151,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":163151,"pkt":"UlQAEjUCCAAn5uVZCABFAABtsyEAAIARLMAKAAIPUrX72nAJjhAAWR8yTh8xApwt1TxvgGusIqghDUQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2657,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_packet_id":3,"flow_last_seen":163183,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":163183,"pkt":"UlQAEjUCCAAn5uVZCABFAABthF4AAIARuZkKAAIPGBrYX3AJNkEAWamMeO8xAjwE6fsqCjd3\/pEK9EQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2666,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_packet_id":3,"flow_last_seen":163335,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":163335,"pkt":"UlQAEjUCCAAn5uVZCABFAABtIxkAAIARvpAKAAIPUAf8wHAJGugAWXr3ZJ8xAtfG84fh56mDEe0qUEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2720,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_packet_id":3,"flow_last_seen":168224,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":168224,"pkt":"UlQAEjUCCAAn5uVZCABFAABtYr8AAIAR3CQKAAIPP+SvqXAJB5AAWcmhvWcxAkYxxPd4wtcssZ9PX0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2725,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_packet_id":3,"flow_last_seen":168391,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":168391,"pkt":"UlQAEjUCCAAn5uVZCABFAABtAwAAAIARQCcKAAIPtXY11HAJdS4AWVKoRtYxAgh8ZUKNU31EKcU+K0QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2727,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":360,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168428,"flow_last_seen":168428,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168428,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"198.58.218.12","src_port":28681,"dst_port":47912,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2727,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":360,"flow_packet_id":1,"flow_last_seen":168428,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":168428,"pkt":"UlQAEjUCCAAn5uVZCABFAABtVroAAIARN3AKAAIPxjraDHAJuygAWfAoVB4xAiIUq1VNOT5K4PsAnkQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2732,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168555,"flow_last_seen":168555,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168555,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":28681,"dst_port":9915,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2732,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_packet_id":1,"flow_last_seen":168555,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":168555,"pkt":"UlQAEjUCCAAn5uVZCABFAABtB2EAAIARDDsKAAIPVoHEVHAJJrsAWdbAQsoxAjcNEhOQ8aGFyag54kQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +01408{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2733,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_packet_id":2,"flow_last_seen":168593,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":168593,"pkt":"CAAn5uVZUlQAEjUCCABFAALzB7wAAEARSVpWgcRUCgACDya7cAkC37LQQsoxAjcNEhOQ8aGFyag54kQAAMACAAAGR1RLRwAAUhNI53eBGeJh0nCkclkfZJnzMvMEVoHEVCa7AQAAAATmnBkoFEdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegkdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzukdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj1dTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqkdUS0cAABK1XVsEZ16ugW6JpsS4xfhpSq81BEjJ0DmW2UdUS0cAABZMZh8YJqCRZ8rsFWpJujOrF1VMBFHNWy2cyVdTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeUdUS0cAAABa1S31uxK2I4OJWHaC\/PKs7lhZBFK1+9qOEA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2734,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168594,"flow_last_seen":168594,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168594,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.192.210.182","src_port":28681,"dst_port":6754,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00537{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2734,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_packet_id":1,"flow_last_seen":168594,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":168594,"pkt":"UlQAEjUCCAAn5uVZCABFAABtbeQAAIARLxYKAAIPvsDStnAJGmIAWe\/nYtExAgjn\/Ke847x2NG4oVEQAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2742,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":363,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":168840,"flow_last_seen":168840,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":168840,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":38297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2742,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":363,"flow_packet_id":1,"flow_last_seen":168840,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"thread_ts_msec":168840,"pkt":"UlQAEjUCCAAn5uVZCABFAABteiAAAIARB1cKAAIPUc1bLXAJlZkAWXbGOhUxApJjO\/JuqWKA3F9q70QAADoAAAAFR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAADgZnrrTUxbZJrkUeNZFbiSwaUPd"} +01410{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2744,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_packet_id":2,"flow_last_seen":168854,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":168854,"pkt":"CAAn5uVZUlQAEjUCCABFAALzB8MAAEAR0rG+wNK2CgACDxpicAkC32qFYtExAgjn\/Ke847x2NG4oVEQAAMACAAAGR1RLRwAAVhpgfx\/FIwIUkbHoonVeeVgxwBsEvsDSthpiAQAAAAQZ71djFEdUS0cAAD\/LrtDBHsrvB2sw44AqY2QCrQYQBDNEmdZmjUdUS0cAADcgJ3MxU+9gPezRvKa4p+wbOpp4BLnL2lzegkdUS0cAACn0WLPxWtQpnmCbIRk+uW\/YiZplBGBBRMKKmUdUS0cAACpy2K\/2hky2jG7eBxG55EuSykYdBLVUshDrZkdUS0cAACwUV8A2ZtuYGpHmurFJ9ZjbPjd\/BEIe3bUu7FdTSFIAACfu4Bqdy+iW81L+1nr6boaqfinyBC1Yddoa\/UdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzukdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj1dTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABEOG4JNEDwVGDdOEVl98CTJsF5uBMvcxvQEqkdUS0cAABK1XVsEZ16ugW6JpsS4xfhpSq81BEjJ0DmW2UdUS0cAABZMZh8YJqCRZ8rsFWpJujOrF1VMBFHNWy2cyVdTSFIAAAl5O+8DCDmOkVzxf\/SPVwlYhBdwBEiMeCm6e0dUS0cAAAucDVWlpiFF+O+mADztiMF+lbMgBMEl\/4LwsEdUS0cAAAyXtfcHfbQ8qEf8F4epyaClpDRCBFh4Sddf8kdUS0cAAA1pNBGyU44u8atjdhBEZcvofBcyBFA93fZ3cUdUS0cAAAAs7ncgF1geHmh4DMpMbatHwhb+BGD2nH7EeQ=="} +00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2803,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_packet_id":3,"flow_last_seen":174268,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174268,"pkt":"UlQAEjUCCAAn5uVZCABFAABybeUAAIARLxAKAAIPvsDStnAJGmIAXsbRDJkxAiMikaZOqXdSUPahXUQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="} +00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2804,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_packet_id":3,"flow_last_seen":174269,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174269,"pkt":"UlQAEjUCCAAn5uVZCABFAAByB2IAAIARDDUKAAIPVoHEVHAJJrsAXjsDcFExAhHLtY5GdmAVhlELQEQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2806,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174303,"flow_last_seen":174303,"flow_idle_time":180000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174303,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":28681,"dst_port":10825,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00545{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2806,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_packet_id":1,"flow_last_seen":174303,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174303,"pkt":"UlQAEjUCCAAn5uVZCABFAAByStEAAIARbHkKAAIPwqO0fnAJKkkAXkeElzExAuaUt3SA\/qxG7F60jUQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="} +00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2807,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":360,"flow_packet_id":2,"flow_last_seen":174303,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174303,"pkt":"UlQAEjUCCAAn5uVZCABFAAByVrsAAIARN2oKAAIPxjraDHAJuygAXpm7NG4xAlN4rvcHLSWuyVzKGkQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="} +00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2810,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":303,"flow_packet_id":3,"flow_last_seen":174321,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174321,"pkt":"UlQAEjUCCAAn5uVZCABFAAByxlcAAIARNIMKAAIPjoSlDXAJd2YAXu8TjWExApO4DvtDKbdx2klNVkQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2811,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":365,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":180000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174322,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.23.24.213","src_port":28681,"dst_port":18561,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00545{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2811,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":365,"flow_packet_id":1,"flow_last_seen":174322,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174322,"pkt":"UlQAEjUCCAAn5uVZCABFAABy\/iwAAIARW1MKAAIPvBcY1XAJSIEAXn4ZciIxAgUt47TCA6DBC1+HrEQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2812,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":366,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":180000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174322,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.8.55.158","src_port":28681,"dst_port":51140,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2812,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":366,"flow_packet_id":1,"flow_last_seen":174322,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174322,"pkt":"UlQAEjUCCAAn5uVZCABFAAByI9AAAIARdPYKAAIPXgg3nnAJx8QAXqKieDQxAq3mE0dDpkvWQzLgPUQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="} +01410{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2813,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_packet_id":2,"flow_last_seen":174323,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":174323,"pkt":"CAAn5uVZUlQAEjUCCABFAALzB+sAAEAR7N7Co7R+CgACDypJcAkC36eTlzExAuaUt3SA\/qxG7F60jUQAAMACAAAGR1RLRwAAW5ZMJAC\/sp0EyBIYLqaZItjn8QIEwqO0fipJAQAAAAQkVMV3FEdUS0cAAFxg+taEWAYB1unX7flSWQRG3beNBGic4kjQCldTSFIAAFpCOi4aZIiG9lYEyciBumqkMMTzBMY62gy7KEdUS0cAAFf2jq05FgyfJOGIcRJLg6NdtQ1eBLw9NLcuTEdUS0cAAFYaYH8fxSMCFJGx6KJ1XnlYMcAbBL7A0rYaYkdUS0cAAFFI2BA3K8AVe0IqJAEnw9\/D630lBI6EpQ13ZkdUS0cAAFITSOd3gRniYdJwpHJZH2SZ8zLzBFaBxFQmu0dUS0cAAE3VqZZmQu9JEb4xS9XAL1zJJdrgBLwXGNVIgVdTSFIAAEwNRRSjJbzqx43c9rTKLbxkbHgKBF4IN57HxEdUS0cAAElxJg9dajjzW3txW7a4q7j8IGI0BFHNWy2VmUdUS0cAAEE1vJAZC\/Oid7YdKVGKEGbtSapFBJUco6\/DJFdTSFIAAEJDtkelhifx87ftq707Fzo\/U0PdBC+TNBWPeEdUS0cAAGqU5DC0wpx7Tt\/+AtuQJkODlGIrBC\/cuoxr+UdUS0cAAGSQPhJYYczqO9fA1uqwCWebPjcpBMEgftbozEdUS0cAAGfwY9tAxh1AXF0ZU2EOIfqDQ08tBHbwRccYzEdUS0cAAGcZJHUoqfb+iSo9+1Aaw4nAX4zABFAH\/MAa6EdUS0cAAB9npzFZ8csWEevUVjGg\/Ev3bcglBF8KzUMtU0dUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzukdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZskdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mjw=="} +00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2815,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":363,"flow_packet_id":2,"flow_last_seen":174342,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174342,"pkt":"UlQAEjUCCAAn5uVZCABFAAByeiEAAIARB1EKAAIPUc1bLXAJlZkAXranfCExAmltWPgHip8OOUDUwEQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2816,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174342,"flow_last_seen":174342,"flow_idle_time":180000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174342,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":28681,"dst_port":49956,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2816,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_packet_id":1,"flow_last_seen":174342,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174342,"pkt":"UlQAEjUCCAAn5uVZCABFAAByzKsAAIARKPUKAAIPlRyjr3AJwyQAXo4hNNYxAkNtQBP87WWbzy94OkQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2817,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":368,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174343,"flow_last_seen":174343,"flow_idle_time":180000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":174343,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":28681,"dst_port":36728,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2817,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":368,"flow_packet_id":1,"flow_last_seen":174343,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":94,"thread_ts_msec":174343,"pkt":"UlQAEjUCCAAn5uVZCABFAAByuwkAAIARD7sKAAIPL5M0FXAJj3gAXq06x7YxAq8Sv7XsAP61JE4GfUQAAD8AAAAHR1RLRwAAKJ0KjQbe\/8gmPDOJfCyRef2Eq2EEXS\/iNXAJAQEAAF3Q\/QP6n0+w02aNGZLhtNuwNXioAEFMT0M="} +01407{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2827,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_packet_id":2,"flow_last_seen":174648,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":769,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":769,"pkt_l4_len":735,"thread_ts_msec":174648,"pkt":"CAAn5uVZUlQAEjUCCABFAALzB\/MAAEARKy2VHKOvCgACD8MkcAkC37mfNNYxAkNtQBP87WWbzy94OkQAAMACAAAGR1RLRwAAQTW8kBkL86J3th0pUYoQZu1JqkUElRyjr8MkAQAAAAThq6+iFEdUS0cAAFxg+taEWAYB1unX7flSWQRG3beNBGic4kjQCkdUS0cAAFuWTCQAv7KdBMgSGC6mmSLY5\/ECBMKjtH4qSVdTSFIAAFpCOi4aZIiG9lYEyciBumqkMMTzBMY62gy7KEdUS0cAAFf2jq05FgyfJOGIcRJLg6NdtQ1eBLw9NLcuTEdUS0cAAFYaYH8fxSMCFJGx6KJ1XnlYMcAbBL7A0rYaYkdUS0cAAFFI2BA3K8AVe0IqJAEnw9\/D630lBI6EpQ13ZkdUS0cAAFITSOd3gRniYdJwpHJZH2SZ8zLzBFaBxFQmu1dTSFIAAEwNRRSjJbzqx43c9rTKLbxkbHgKBF4IN57HxEdUS0cAAElxJg9dajjzW3txW7a4q7j8IGI0BFHNWy2VmVdTSFIAAEJDtkelhifx87ftq707Fzo\/U0PdBC+TNBWPeEdUS0cAAGqU5DC0wpx7Tt\/+AtuQJkODlGIrBC\/cuoxr+UdUS0cAAGSQPhJYYczqO9fA1uqwCWebPjcpBMEgftbozEdUS0cAAGfwY9tAxh1AXF0ZU2EOIfqDQ08tBHbwRccYzEdUS0cAAGcZJHUoqfb+iSo9+1Aaw4nAX4zABFAH\/MAa6EdUS0cAABnDsbPWKLbuWCN54AyWtjRM+4cSBFlLNBOzukdUS0cAABjf5v+Urk90V\/WPMxinQSIciE4\/BDzxMMJTNUdUS0cAABiF4URzeX7Vdi93GjTzJphEA0s1BC6AcmsZsldTSFIAABreJpDCEhk5HaHmWa2KZ2KgQT+tBFLZsDQdFkdUS0cAABpaaFBDXGgpcSmxYhITGidbcBteBEuFZV3Mj0dUS0cAABZMZh8YJqCRZ8rsFWpJujOrF1VMBFHNWy2cyQ=="} +00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":35,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":63000,"flow_last_seen":63524,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":1137,"flow_avg_l4_payload_len":113,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.250.6.59","src_port":50196,"dst_port":12556,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00794{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":46,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":64032,"flow_last_seen":64562,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":304,"flow_tot_l4_payload_len":304,"flow_avg_l4_payload_len":33,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.181.156.244","src_port":50206,"dst_port":8255,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":73,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":69141,"flow_last_seen":69581,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1141,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.242.225","src_port":50232,"dst_port":15068,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":67,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":68108,"flow_last_seen":68639,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1147,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":50226,"dst_port":15677,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":42,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":64030,"flow_last_seen":65583,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":50202,"dst_port":57648,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":42,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":64030,"flow_last_seen":65583,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":50202,"dst_port":57648,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":36,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":63001,"flow_last_seen":63616,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1136,"flow_avg_l4_payload_len":113,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":50197,"dst_port":3931,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":63,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":67093,"flow_last_seen":69216,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":50222,"dst_port":6523,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":63,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":67093,"flow_last_seen":69216,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":50222,"dst_port":6523,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":61,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":67092,"flow_last_seen":69473,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.196.226","src_port":50220,"dst_port":3820,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":61,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":67092,"flow_last_seen":69473,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.196.226","src_port":50220,"dst_port":3820,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":43,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":64031,"flow_last_seen":64521,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1140,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":50203,"dst_port":18994,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00792{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":38,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":63001,"flow_last_seen":63445,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":598,"flow_avg_l4_payload_len":66,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":50199,"dst_port":36728,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":51,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":65062,"flow_last_seen":65418,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":1142,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.199.10.60","src_port":50211,"dst_port":23458,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00794{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":76,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":69142,"flow_last_seen":69227,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":1089,"flow_avg_l4_payload_len":108,"midstream":0,"thread_ts_msec":181645,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.118.70","src_port":50235,"dst_port":6906,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3065,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":2,"flow_last_seen":191700,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191700,"pkt":"UlQAEjUCCAAn5uVZCABFAAA00HEAAIARI3sKAAIPfCy+kXAJJ7oAIMCGR05EED8oAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3066,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":2,"flow_last_seen":191700,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191700,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0uoEAAIARu5gKAAIPXFhcOHAJUhEAIBhcR05EED8pAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3067,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":209,"flow_packet_id":3,"flow_last_seen":191700,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191700,"pkt":"UlQAEjUCCAAn5uVZCABFAAA06UYAAIARhsYKAAIPW7Ni6nAJGMoAIEuVR05EED8qAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3068,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":3,"flow_last_seen":191700,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191700,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0p7YAAIARK7IKAAIPWKkCmXAJzL4AIPr6R05EED8rAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3069,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":3,"flow_last_seen":191701,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191701,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09RkAAIARAUAKAAIPW6\/coXAJPWkAIK1AR05EED8sAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3070,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":2,"flow_last_seen":191701,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191701,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09PQAAIARS74KAAIPaWWEknAJ4ZIAIFNvR05EED8tAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3071,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":171,"flow_packet_id":2,"flow_last_seen":191701,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191701,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0mjoAAIARSycKAAIPxNmEb3AJYzIAIHZ9R05EED8uAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3072,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":352,"flow_packet_id":2,"flow_last_seen":191701,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191701,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0NSQAAIARFygKAAIPsL8xn3AJGMoAICfPR05EED8vAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3073,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":3,"flow_last_seen":191701,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191701,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0JF8AAIARIm0KAAIPWkGNnXAJGMoAICJOR05EED8wAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3074,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":3,"flow_last_seen":191702,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191702,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0POwAAIARNbYKAAIPyHjzj3AJGMoAIE4jR05EED8xAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3075,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":3,"flow_last_seen":191702,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191702,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Wk4AAIARMwAKAAIPVhdLRXAJGMoAIGjOR05EED8yAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3076,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":129,"flow_packet_id":3,"flow_last_seen":191702,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191702,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0794AAIARW44KAAIPsIoys3AJcuMAIMzSR05EED8zAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3077,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":137,"flow_packet_id":3,"flow_last_seen":191702,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191702,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05VEAAIARsFIKAAIPUkFGxXAJVL0AIDUvR05EED80AQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3078,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":128,"flow_packet_id":3,"flow_last_seen":191702,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191702,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09U8AAIARELIKAAIPTY3bG3AJkswAIGd8R05EED81AQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3079,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":2,"flow_last_seen":191703,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191703,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0XA0AAIARFJkKAAIPqv4TBnAJXnQAIAZ4R05EED82AQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3080,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":160,"flow_packet_id":3,"flow_last_seen":191703,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191703,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0XrsAAIARSzYKAAIPU5YxI3AJfsAAIB92R05EED83AQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3081,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":161,"flow_packet_id":2,"flow_last_seen":191703,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191703,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0tpUAAIARiEYKAAIP1XgaVnAJdPoAIL4lR05EED84AQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3082,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":184,"flow_packet_id":2,"flow_last_seen":191703,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191703,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09AsAAIARpNoKAAIPVu8+1XAJGMoAIHRfR05EED85AQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3083,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":3,"flow_last_seen":191703,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191703,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0rD8AAIARiPEKAAIPVuOilnAJGMoAIBCpR05EED86AQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3084,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":156,"flow_packet_id":2,"flow_last_seen":191703,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191703,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0lsMAAIARXJwKAAIPVvTkVnAJJ5MAIMANR05EED87AQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3085,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":190,"flow_packet_id":2,"flow_last_seen":191704,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191704,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0VboAAIARb2MKAAIPpanD43AJGMoAIKCTR05EED88AQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3086,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":2,"flow_last_seen":191704,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":191704,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0dUAAAIARISYKAAIPsKPnoHAJGMoAIHHbR05EED89AQFUC1FLUlAGUk5BXS\/iNQlw"} +00667{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":13118,"flow_last_seen":15640,"flow_idle_time":180000,"flow_min_l4_payload_len":1073,"flow_max_l4_payload_len":1073,"flow_tot_l4_payload_len":12876,"flow_avg_l4_payload_len":1073,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} +00654{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":12446,"flow_last_seen":12446,"flow_idle_time":180000,"flow_min_l4_payload_len":314,"flow_max_l4_payload_len":314,"flow_tot_l4_payload_len":314,"flow_avg_l4_payload_len":314,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"DHCP","breed":"Acceptable","category":"Network"}} +00649{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":12447,"flow_last_seen":12447,"flow_idle_time":180000,"flow_min_l4_payload_len":548,"flow_max_l4_payload_len":548,"flow_tot_l4_payload_len":548,"flow_avg_l4_payload_len":548,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","src_port":67,"dst_port":68,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"DHCP","breed":"Acceptable","category":"Network"}} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":143,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":73299,"flow_last_seen":75239,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.201.161","src_port":50256,"dst_port":2886,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":143,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":73299,"flow_last_seen":75239,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.201.161","src_port":50256,"dst_port":2886,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":149,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":74329,"flow_last_seen":74396,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1102,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":50262,"dst_port":30577,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00675{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":13118,"flow_last_seen":15640,"flow_idle_time":180000,"flow_min_l4_payload_len":1091,"flow_max_l4_payload_len":1091,"flow_tot_l4_payload_len":13092,"flow_avg_l4_payload_len":1091,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} +00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":77,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":69142,"flow_last_seen":70230,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":756,"flow_tot_l4_payload_len":1058,"flow_avg_l4_payload_len":105,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.29.135.209","src_port":50236,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00793{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":119,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":72264,"flow_last_seen":72720,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":848,"flow_avg_l4_payload_len":84,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"27.94.154.53","src_port":50250,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":121,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":72266,"flow_last_seen":72656,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":954,"flow_avg_l4_payload_len":95,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.202.31.113","src_port":50252,"dst_port":19768,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":153,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":75359,"flow_last_seen":77504,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.175.103","src_port":50266,"dst_port":4315,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":153,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":75359,"flow_last_seen":77504,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.175.103","src_port":50266,"dst_port":4315,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00794{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":63001,"flow_last_seen":78562,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1097,"flow_avg_l4_payload_len":91,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":50198,"dst_port":9915,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":69,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":68109,"flow_last_seen":70047,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.241.31.96","src_port":50228,"dst_port":14384,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":69,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":68109,"flow_last_seen":70047,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.241.31.96","src_port":50228,"dst_port":14384,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":146,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":74327,"flow_last_seen":74692,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":1108,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.90.112","src_port":50259,"dst_port":9852,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":122,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":72266,"flow_last_seen":72907,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1105,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":50253,"dst_port":43508,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00655{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":180000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":63717,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}} +00669{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":12529,"flow_last_seen":12529,"flow_idle_time":180000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":63717,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}} +00622{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":71216,"flow_last_seen":95489,"flow_idle_time":120000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00656{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"finished","flow_packets_processed":15,"flow_first_seen":12827,"flow_last_seen":41755,"flow_idle_time":180000,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":966,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"NetBIOS","breed":"Acceptable","category":"System"}} +00665{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"finished","flow_packets_processed":13,"flow_first_seen":15284,"flow_last_seen":23969,"flow_idle_time":180000,"flow_min_l4_payload_len":101,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":1601,"flow_avg_l4_payload_len":123,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00655{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":12529,"flow_last_seen":43193,"flow_idle_time":180000,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":348,"flow_avg_l4_payload_len":38,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"}} +00669{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":12529,"flow_last_seen":43193,"flow_idle_time":180000,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":348,"flow_avg_l4_payload_len":38,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"}} +00669{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3091,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":12461,"flow_last_seen":75501,"flow_idle_time":180000,"flow_min_l4_payload_len":91,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":637,"flow_avg_l4_payload_len":91,"midstream":0,"thread_ts_msec":191906,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"DHCPV6","breed":"Acceptable","category":"Network"}} +00703{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3099,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":3,"flow_last_seen":192636,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":243,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":243,"pkt_l4_len":209,"thread_ts_msec":192636,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAADlHP0AAIARA\/4KAAIPCgAC\/wCKAIoA0X6VEQKcLwoAAg8AigC7AAAgRU5GREVGRUVFSEVGRkhFSkVPREJEQUNBQ0FDQUNBQ0EAIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUJOAP9TTUIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQAAIQAAAAAAAAAAAOgDAAAAAAAAAAAhAFYAAwABAAAAAgAyAFxNQUlMU0xPVFxCUk9XU0UAAQCAqQMATVNFREdFV0lOMTAAAAAAAAoAAxAAAA8BVaoA"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3103,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":306,"flow_packet_id":2,"flow_last_seen":192907,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192907,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0J3gAAIARnXEKAAIPKfk\/yHAJWDYAIGDxR05EED8+AQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3104,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":2,"flow_last_seen":192907,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192907,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0H4EAAIARbHsKAAIPTB5WkHAJ0j0AIK37R05EED8\/AQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3105,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":195,"flow_packet_id":3,"flow_last_seen":192907,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192907,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0D4UAAIAR1i0KAAIPseeXEHAJGMoAIMEkR05EED9AAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3106,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":173,"flow_packet_id":3,"flow_last_seen":192907,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192907,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0Tp0AAIARiIUKAAIPeWPeJHAJr7wAIBuhR05EED9BAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3107,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":135,"flow_packet_id":3,"flow_last_seen":192907,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192907,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0fT8AAIARi9IKAAIPwfpjnnAJGMoAIOSBR05EED9CAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3108,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":140,"flow_packet_id":3,"flow_last_seen":192908,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192908,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0JXoAAIARS7EKAAIPTcVvunAJGMoAIEyaR05EED9DAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3109,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":3,"flow_last_seen":192908,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192908,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0NAEAAIAR\/94KAAIPW0WfhXAJbWAAILq3R05EED9EAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3110,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":136,"flow_packet_id":2,"flow_last_seen":192908,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192908,"pkt":"UlQAEjUCCAAn5uVZCABFAAA02xAAAIARCzUKAAIPUOz3eHAJPq8AIJvNR05EED9FAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3111,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":141,"flow_packet_id":3,"flow_last_seen":192908,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192908,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0s0sAAIARB+8KAAIPrGHHDnAJGMoAIJamR05EED9GAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3112,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":3,"flow_last_seen":192908,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192908,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0jJQAAIARUAcKAAIPp3KqnHAJXSQAIHOsR05EED9HAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3113,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":139,"flow_packet_id":3,"flow_last_seen":192908,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":192908,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0770AAIARtrQKAAIPpanijnAJGMoAIIHcR05EED9IAQFUC1FLUlAGUk5BXS\/iNQlw"} +00662{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":15469,"flow_last_seen":22405,"flow_idle_time":180000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":4368,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63964,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} +00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":223,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":84592,"flow_last_seen":85126,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1138,"flow_avg_l4_payload_len":113,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":50269,"dst_port":3186,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00793{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":148,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":74328,"flow_last_seen":88171,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":597,"flow_tot_l4_payload_len":850,"flow_avg_l4_payload_len":85,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"156.57.42.2","src_port":50261,"dst_port":33476,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00663{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"finished","flow_packets_processed":13,"flow_first_seen":15284,"flow_last_seen":23969,"flow_idle_time":180000,"flow_min_l4_payload_len":101,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":1601,"flow_avg_l4_payload_len":123,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":237,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":87671,"flow_last_seen":88801,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":50283,"dst_port":35004,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":237,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":87671,"flow_last_seen":88801,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":50283,"dst_port":35004,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00670{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":15469,"flow_last_seen":21843,"flow_idle_time":180000,"flow_min_l4_payload_len":624,"flow_max_l4_payload_len":624,"flow_tot_l4_payload_len":4368,"flow_avg_l4_payload_len":624,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63965,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} +00666{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":15285,"flow_last_seen":21297,"flow_idle_time":180000,"flow_min_l4_payload_len":95,"flow_max_l4_payload_len":95,"flow_tot_l4_payload_len":475,"flow_avg_l4_payload_len":95,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63960,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":221,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":83805,"flow_last_seen":84251,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":1139,"flow_avg_l4_payload_len":113,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":50267,"dst_port":9239,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":222,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":84592,"flow_last_seen":85055,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":1144,"flow_avg_l4_payload_len":114,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"210.209.249.84","src_port":50268,"dst_port":24751,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00783{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3194,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":16487,"flow_last_seen":192636,"flow_idle_time":180000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":603,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":201412,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}} +00620{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":95,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":71216,"flow_last_seen":95489,"flow_idle_time":120000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":293,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90746,"flow_last_seen":90799,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1111,"flow_avg_l4_payload_len":111,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":50317,"dst_port":21995,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":292,"flow_state":"finished","flow_packets_processed":24,"flow_first_seen":90746,"flow_last_seen":91392,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":3761,"flow_avg_l4_payload_len":156,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":50316,"dst_port":30566,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":289,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90746,"flow_last_seen":91151,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":620,"flow_tot_l4_payload_len":1717,"flow_avg_l4_payload_len":143,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":50313,"dst_port":35481,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":280,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90744,"flow_last_seen":90842,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":853,"flow_avg_l4_payload_len":85,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.168.34.105","src_port":50304,"dst_port":39908,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":285,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90745,"flow_last_seen":91380,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1100,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":50309,"dst_port":21301,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":283,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90745,"flow_last_seen":90863,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1090,"flow_avg_l4_payload_len":109,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":50307,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":295,"flow_state":"finished","flow_packets_processed":25,"flow_first_seen":90747,"flow_last_seen":91396,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":3774,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":50319,"dst_port":53489,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":298,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90747,"flow_last_seen":90902,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":670,"flow_tot_l4_payload_len":1773,"flow_avg_l4_payload_len":147,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":50322,"dst_port":55302,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00793{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":269,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":90739,"flow_last_seen":91076,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":99,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":50293,"dst_port":8890,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":296,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90747,"flow_last_seen":90793,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":1119,"flow_avg_l4_payload_len":111,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":50320,"dst_port":10825,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":284,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90745,"flow_last_seen":91127,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":663,"flow_tot_l4_payload_len":1764,"flow_avg_l4_payload_len":147,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":50308,"dst_port":61616,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":277,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90743,"flow_last_seen":96110,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1100,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":50301,"dst_port":54130,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":287,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90745,"flow_last_seen":91669,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":628,"flow_tot_l4_payload_len":1729,"flow_avg_l4_payload_len":144,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":50311,"dst_port":49956,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":291,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90746,"flow_last_seen":91171,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":690,"flow_tot_l4_payload_len":1789,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":50315,"dst_port":26851,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":279,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90744,"flow_last_seen":90809,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1114,"flow_avg_l4_payload_len":111,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":50303,"dst_port":24562,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":271,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":90740,"flow_last_seen":91277,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":663,"flow_tot_l4_payload_len":1764,"flow_avg_l4_payload_len":147,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":50295,"dst_port":49732,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":270,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":90740,"flow_last_seen":91408,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":100,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":50294,"dst_port":37058,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00793{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":272,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90741,"flow_last_seen":90825,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":598,"flow_tot_l4_payload_len":853,"flow_avg_l4_payload_len":85,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.58.211.52","src_port":50296,"dst_port":3806,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00921{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":275,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90742,"flow_last_seen":91375,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":601,"flow_tot_l4_payload_len":877,"flow_avg_l4_payload_len":87,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":50299,"dst_port":1194,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":294,"flow_state":"finished","flow_packets_processed":25,"flow_first_seen":90746,"flow_last_seen":91439,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":3759,"flow_avg_l4_payload_len":150,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.32.126.214","src_port":50318,"dst_port":59596,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":282,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":90744,"flow_last_seen":98168,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":600,"flow_avg_l4_payload_len":100,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.238.145.82","src_port":50306,"dst_port":33527,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":274,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90741,"flow_last_seen":90864,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":865,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":50298,"dst_port":6578,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +01250{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":290,"flow_state":"finished","flow_packets_processed":21,"flow_first_seen":90746,"flow_last_seen":90948,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":3245,"flow_avg_l4_payload_len":154,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":50314,"dst_port":6888,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"6": {"risk":"Self-signed Certificate","severity":"High","risk_score": {"total":500,"client":450,"server":50}},"9": {"risk":"TLS Expired Certificate","severity":"High","risk_score": {"total":260,"client":230,"server":30}},"15": {"risk":"TLS (probably) Not Carrying HTTPS","severity":"Low","risk_score": {"total":760,"client":680,"server":80}},"24": {"risk":"Missing SNI TLS Extension","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"4":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"}} +00796{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":273,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90741,"flow_last_seen":91415,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":600,"flow_tot_l4_payload_len":903,"flow_avg_l4_payload_len":90,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":50297,"dst_port":45710,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00797{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":299,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":90747,"flow_last_seen":90850,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":1111,"flow_avg_l4_payload_len":111,"midstream":0,"thread_ts_msec":211646,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":50323,"dst_port":26253,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3367,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":369,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":219447,"flow_last_seen":219447,"flow_idle_time":180000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":219447,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.187.171.240","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00476{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3367,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":369,"flow_packet_id":1,"flow_last_seen":219447,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"thread_ts_msec":219447,"pkt":"UlQAEjUCCAAn5uVZCABFAABD+bUAAIARLzoKAAIPWbur8HAJGMoAL2mkIFAxArFAxy3\/Egk2kZ9VAwABABAAAADDA1NDUEECglZDRUdUS0di"} +00661{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":40005,"flow_last_seen":43055,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":55708,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00654{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"finished","flow_packets_processed":15,"flow_first_seen":12827,"flow_last_seen":41755,"flow_idle_time":180000,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":966,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"NetBIOS","breed":"Acceptable","category":"System"}} +00655{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":40232,"flow_last_seen":40630,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":62539,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}} +00653{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":12529,"flow_last_seen":43193,"flow_idle_time":180000,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":348,"flow_avg_l4_payload_len":38,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"}} +00655{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":40232,"flow_last_seen":40630,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.252","src_port":50435,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}} +00669{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":40232,"flow_last_seen":40630,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":62539,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}} +00667{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":12529,"flow_last_seen":43193,"flow_idle_time":180000,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":348,"flow_avg_l4_payload_len":38,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"MDNS","breed":"Acceptable","category":"Network"}} +00669{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":40232,"flow_last_seen":40630,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:3","src_port":50435,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LLMNR","breed":"Acceptable","category":"Network"}} +00792{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":278,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":90743,"flow_last_seen":101917,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":597,"flow_tot_l4_payload_len":597,"flow_avg_l4_payload_len":99,"midstream":0,"thread_ts_msec":222018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.64.6.175","src_port":50302,"dst_port":4743,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":370,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229238,"flow_last_seen":229238,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":229238,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.172.56.198","src_port":28681,"dst_port":11984,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":370,"flow_packet_id":1,"flow_last_seen":229238,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":229238,"pkt":"UlQAEjUCCAAn5uVZCABFAABpeXIAAIARIJEKAAIPW6w4xnAJLtAAVXM5R05EED9JAQFMQVEyUApVRFBdL+I1CXBBRaArSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3452,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":371,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229238,"flow_last_seen":229238,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":229238,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.131.202.24","src_port":28681,"dst_port":44748,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00531{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3452,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":371,"flow_packet_id":1,"flow_last_seen":229238,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":229238,"pkt":"UlQAEjUCCAAn5uVZCABFAABp+fkAAIAR\/N8KAAIPbYPKGHAJrswAVYv2R05EED9KAQFMQVEyUApVRFBdL+I1CXA\/EL4kSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3453,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":372,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229239,"flow_last_seen":229239,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":229239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.179.185.126","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3453,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":372,"flow_packet_id":1,"flow_last_seen":229239,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":229239,"pkt":"UlQAEjUCCAAn5uVZCABFAABpnhUAAIARey4KAAIPW7O5fnAJGMoAVSnyR05EED9LAQFMQVEyUApVRFBdL+I1CXBXghXNSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3454,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":373,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229239,"flow_last_seen":229239,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":229239,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.122.233.15","src_port":28681,"dst_port":11488,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3454,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":373,"flow_packet_id":1,"flow_last_seen":229239,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":229239,"pkt":"UlQAEjUCCAAn5uVZCABFAABpd+QAAIARdQcKAAIPWHrpD3AJLOAAVT9CR05EED9MAQFMQVEyUApVRFBdL+I1CXDHjOZsSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3455,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":374,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229240,"flow_last_seen":229240,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":229240,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"62.35.190.5","src_port":28681,"dst_port":18604,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3455,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":374,"flow_packet_id":1,"flow_last_seen":229240,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":229240,"pkt":"UlQAEjUCCAAn5uVZCABFAABpQyQAAIAR7ygKAAIPPiO+BXAJSKwAVQDtR05EED9NAQFMQVEyUApVRFBdL+I1CXAx8WVwSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00795{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3481,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":267,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":90738,"flow_last_seen":115276,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":599,"flow_tot_l4_payload_len":599,"flow_avg_l4_payload_len":74,"midstream":0,"thread_ts_msec":232090,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.7.155.210","src_port":50291,"dst_port":28365,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00662{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":54,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":65065,"flow_last_seen":65065,"flow_idle_time":180000,"flow_min_l4_payload_len":146,"flow_max_l4_payload_len":182,"flow_tot_l4_payload_len":1042,"flow_avg_l4_payload_len":173,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57623,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00630{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":349,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":129210,"flow_last_seen":129210,"flow_idle_time":120000,"flow_min_l4_payload_len":117,"flow_max_l4_payload_len":117,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":117,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"84.197.97.94","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00565{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":26,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61191,"flow_last_seen":61191,"flow_idle_time":180000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57619,"dst_port":5351,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00550{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":26,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61191,"flow_last_seen":61191,"flow_idle_time":180000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57619,"dst_port":5351,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":27,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61470,"flow_last_seen":61470,"flow_idle_time":180000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57620,"dst_port":5351,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00550{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":27,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61470,"flow_last_seen":61470,"flow_idle_time":180000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57620,"dst_port":5351,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":34,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61999,"flow_last_seen":61999,"flow_idle_time":180000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57621,"dst_port":5351,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00550{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":34,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61999,"flow_last_seen":61999,"flow_idle_time":180000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57621,"dst_port":5351,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":41,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":63029,"flow_last_seen":63029,"flow_idle_time":180000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57622,"dst_port":5351,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00550{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":41,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":63029,"flow_last_seen":63029,"flow_idle_time":180000,"flow_min_l4_payload_len":2,"flow_max_l4_payload_len":2,"flow_tot_l4_payload_len":2,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":242463,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.2","src_port":57622,"dst_port":5351,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3592,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":375,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243615,"flow_last_seen":243615,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243615,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.182.136.42","src_port":28681,"dst_port":27873,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3592,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":375,"flow_packet_id":1,"flow_last_seen":243615,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243615,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4xOkAAIARl9wKAAIPSbaIKnAJbOEAJMFk\/WUxApXeKd\/\/Y1FYXCcaAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3593,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":376,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243615,"flow_last_seen":243615,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243615,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"156.57.42.2","src_port":28681,"dst_port":33476,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3593,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":376,"flow_packet_id":1,"flow_last_seen":243615,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243615,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ZAkAAIARBGIKAAIPnDkqAnAJgsQAJKLUEkUxAuVTIJT\/qP0FXn0lAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3594,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":377,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243616,"flow_last_seen":243616,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243616,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.200.236.13","src_port":28681,"dst_port":12082,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3594,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":377,"flow_packet_id":1,"flow_last_seen":243616,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243616,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4dTEAAIARGJ8KAAIPtMjsDXAJLzIAJKGg4aIxAosfeY\/\/eGT6g79EAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3595,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":378,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243616,"flow_last_seen":243616,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243616,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.241.204.61","src_port":28681,"dst_port":43366,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3595,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":378,"flow_packet_id":1,"flow_last_seen":243616,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243616,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4WbQAAIARkcMKAAIPdvHMPXAJqWYAJNeIeFYxAnbwD8b\/wueFEbnIAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3596,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":379,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243616,"flow_last_seen":243616,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243616,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.140.63.147","src_port":28681,"dst_port":29545,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3596,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":379,"flow_packet_id":1,"flow_last_seen":243616,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243616,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4XhYAAIARQHEKAAIPUIw\/k3AJc2kAJI60HNIxAm253jL\/\/DUsuAicAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3597,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":380,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243616,"flow_last_seen":243616,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243616,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.86.49.195","src_port":28681,"dst_port":12019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3597,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":380,"flow_packet_id":1,"flow_last_seen":243616,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243616,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4QjYAAIARZ1cKAAIPU1Yxw3AJLvMAJNrQNs0xAkzfl3b\/farrz8NgAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3598,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":381,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243616,"flow_last_seen":243616,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243616,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.58.211.52","src_port":28681,"dst_port":3806,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3598,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":381,"flow_packet_id":1,"flow_last_seen":243616,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243616,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4HOwAAIAR8UsKAAIPTTrTNHAJDt4AJFHkJLoxAuJhVBX\/L5jVxMVLAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3600,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":382,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243617,"flow_last_seen":243617,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243617,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.175.11.126","src_port":28681,"dst_port":40958,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3600,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":382,"flow_packet_id":1,"flow_last_seen":243617,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243617,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4hLIAAIARUccKAAIPTK8LfnAJn\/4AJBoY5\/8xArpcZnf\/fHbjTrWkAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3601,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":383,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243617,"flow_last_seen":243617,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243617,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.71.243.60","src_port":28681,"dst_port":34498,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3601,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":383,"flow_packet_id":1,"flow_last_seen":243617,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243617,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4UWYAAIARlbwKAAIPVEfzPHAJhsIAJKBvgRYxAjrkQlr\/msltlxm3AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3602,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_packet_id":2,"flow_last_seen":243617,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243617,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4yVQAAIARg3UKAAIPGKfJNXAJuLIAJCN4SkoxAo4HvOj\/soTnwlDqAwABAAUAAADDglFLQA=="} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3603,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":384,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243617,"flow_last_seen":243617,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243617,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.64.6.175","src_port":28681,"dst_port":4743,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3603,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":384,"flow_packet_id":1,"flow_last_seen":243617,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243617,"pkt":"UlQAEjUCCAAn5uVZCABFAAA43QAAAIAR\/7YKAAIPS0AGr3AJEocAJBVa3zAxAlWwCWL\/xiCmeq0xAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3604,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":385,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243618,"flow_last_seen":243618,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243618,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.223.143.31","src_port":28681,"dst_port":47978,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3604,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":385,"flow_packet_id":1,"flow_last_seen":243618,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243618,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4\/aUAAIARXwIKAAIPQt+PH3AJu2oAJArFRk0xAj6CjL\/\/0mqDxRmrAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3605,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":386,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243618,"flow_last_seen":243618,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243618,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.172.10.90","src_port":28681,"dst_port":40162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3605,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":386,"flow_packet_id":1,"flow_last_seen":243618,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243618,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4jh4AAIARQIIKAAIPVawKWnAJnOIAJMbBHBkxAlNXbJT\/Dlfp0YW8AwABAAUAAADDglFLQA=="} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3606,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":387,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243618,"flow_last_seen":243618,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243618,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.135.8.7","src_port":28681,"dst_port":1219,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3606,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":387,"flow_packet_id":1,"flow_last_seen":243618,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243618,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4+tMAAIART0QKAAIP3IcIB3AJBMMAJPAlKrgxAjfJ1f\/\/gaqG6CvgAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3607,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":388,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243618,"flow_last_seen":243618,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243618,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"121.7.145.36","src_port":28681,"dst_port":33905,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3607,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":388,"flow_packet_id":1,"flow_last_seen":243618,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243618,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ezMAAIARqUcKAAIPeQeRJHAJhHEAJJWN\/8gxApK913z\/gDenUddtAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3608,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":389,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243619,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.215.183.71","src_port":28681,"dst_port":31310,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3608,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":389,"flow_packet_id":1,"flow_last_seen":243619,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243619,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4u\/wAAIARXIsKAAIPXte3R3AJek4AJJf+9SkxAmq7Jg\/\/iZSeKqUXAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3609,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":390,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243619,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"144.134.132.206","src_port":28681,"dst_port":16401,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3609,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":390,"flow_packet_id":1,"flow_last_seen":243619,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243619,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4UpwAAIARxrUKAAIPkIaEznAJQBEAJPna8QIxAuzMzPj\/kaDQT8GaAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3610,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":391,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243619,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"161.81.38.67","src_port":28681,"dst_port":9539,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3610,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":391,"flow_packet_id":1,"flow_last_seen":243619,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243619,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4tCAAAIARsvEKAAIPoVEmQ3AJJUMAJBFgv6MxAu6ZyV\/\/KIP7fjQNAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3611,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":392,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243619,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.0.69.215","src_port":28681,"dst_port":12608,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3611,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":392,"flow_packet_id":1,"flow_last_seen":243619,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243619,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4dFAAAIARSn8KAAIPKgBF13AJMUAAJKXILjwxAn8eQ6j\/CSSFULvYAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3612,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":393,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243619,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.115.158.103","src_port":28681,"dst_port":5110,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3612,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":393,"flow_packet_id":1,"flow_last_seen":243619,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243619,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4IqEAAIARMysKAAIPOnOeZ3AJE\/YAJCdXj4IxAmQ+fO3\/wCiiAvTUAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3613,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":394,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243619,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.84.134.136","src_port":28681,"dst_port":21407,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3613,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":394,"flow_packet_id":1,"flow_last_seen":243619,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243619,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4cl8AAIARkGoKAAIPpVSGiHAJU58AJMzg+ecxAvxyyOX\/AcvvtZ34AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3614,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":395,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243619,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"191.114.88.39","src_port":28681,"dst_port":18751,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3614,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":395,"flow_packet_id":1,"flow_last_seen":243619,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243619,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4JHMAAIAR8pkKAAIPv3JYJ3AJST8AJMC0Bt0xAgRkYlP\/5wIhcQKCAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3615,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":396,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243620,"flow_last_seen":243620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243620,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.59.24","src_port":28681,"dst_port":28755,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3615,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":396,"flow_packet_id":1,"flow_last_seen":243620,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243620,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4wP0AAIARwhkKAAIPcHc7GHAJcFMAJILWmYoxAj6+PNn\/IitSnN0JAwABAAUAAADDglFLQA=="} +00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3616,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":3,"flow_last_seen":243620,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243620,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4algAAIAR6cUKAAIPy94OqnAJWyQAJFdJ490xAt8d1vz\/Kbx9Jpd7AwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3617,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":397,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243620,"flow_last_seen":243620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243620,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":24634,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3617,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":397,"flow_packet_id":1,"flow_last_seen":243620,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243620,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4IxwAAIARvsIKAAIPUAf8wHAJYDoAJLXSHhkxAhskJtz\/UL0gO83JAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3618,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":398,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243620,"flow_last_seen":243620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243620,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"62.102.148.166","src_port":28681,"dst_port":31332,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3618,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":398,"flow_packet_id":1,"flow_last_seen":243620,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243620,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4mJwAAIARwv0KAAIPPmaUpnAJemQAJKL5fnExAgsJTj3\/xtLqX1mKAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3619,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":399,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243620,"flow_last_seen":243620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":243620,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.39.219.223","src_port":28681,"dst_port":31728,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3619,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":399,"flow_packet_id":1,"flow_last_seen":243620,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":243620,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4fjkAAIARJWYKAAIPryfb33AJe\/AAJATAGGAxAgbpDu3\/o+P+xpygAwABAAUAAADDglFLQA=="} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3626,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":381,"flow_packet_id":2,"flow_last_seen":243658,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":243658,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCeAAAEARREZNOtM0CgACDw7ecAkANlhRJLoxAuJhVBX\/L5jVxMVLAwEBABcAAADeDk060zQAAAAACAAAAMOCUUtEvA6+Qw=="} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":383,"flow_packet_id":2,"flow_last_seen":243755,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":243755,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCeEAAEARHTBUR\/M8CgACD4bCcAkANjtIgRYxAjrkQlr\/msltlxm3AwEBABcAAADChlRH8zwAAAAACAAAAMOCUUtE7jlqoQ=="} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3628,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_packet_id":3,"flow_last_seen":243760,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":243760,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCeIAAEARgtYYp8k1CgACD7iycAkANrRwSkoxAo4HvOj\/soTnwlDqAwEBABcAAACyuBinyTUAAAAAAAAAAMOCUUtENA6kKg=="} +00490{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3629,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":382,"flow_packet_id":2,"flow_last_seen":243795,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":243795,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCeMAAEARDIVMrwt+CgACD5\/+cAkANhSx5\/8xArpcZnf\/fHbjTrWkAwEBABcAAAD+n0yvC34AAAAACAAAAMOCUUtEYOLV6w=="} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3630,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":394,"flow_packet_id":2,"flow_last_seen":243816,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":243816,"pkt":"CAAn5uVZUlQAEjUCCABFAABJCeQAAEARONWlVIaICgACD1OfcAkANedj+ecxAvxyyOX\/AcvvtZ34AwEBABYAAACfU6VUhogwAAAASozdAsOCVVBDACAf"} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3631,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":380,"flow_packet_id":2,"flow_last_seen":243826,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":243826,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCeUAAEAR35ZTVjHDCgACDy7zcAkANlquNs0xAkzfl3b\/farrz8NgAwEBABcAAADzLlNWMcMNAAAAAAAQAMOCUUtEkRWlPQ=="} +00492{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3633,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":378,"flow_packet_id":2,"flow_last_seen":243968,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"thread_ts_msec":243968,"pkt":"CAAn5uVZUlQAEjUCCABFAABOCecAAEARIXt28cw9CgACD6lmcAkAOoHjeFYxAnbwD8b\/wueFEbnIAwEBABsAAABmqXbxzD0AAAAACAAAAMOCUUtIB7XPTgLKods="} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3634,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":384,"flow_packet_id":2,"flow_last_seen":244088,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":244088,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCegAAEAREr5LQAavCgACDxKHcAkANhLe3zAxAlWwCWL\/xiCmeq0xAwEBABcAAACHEktABq8AAAAACAAAAMOCUUtEatOUjQ=="} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3635,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":376,"flow_packet_id":2,"flow_last_seen":244095,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":244095,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCekAAEARnnCcOSoCCgACD4LEcAkANgOuEkUxAuVTIJT\/qP0FXn0lAwEBABcAAADEgpw5KgJZAAAAAAAIAMOCUUtENA+q8Q=="} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3636,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":379,"flow_packet_id":2,"flow_last_seen":244452,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":244452,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCeoAAEAR1ItQjD+TCgACD3NpcAkANq7MHNIxAm253jL\/\/DUsuAicAwEBABcAAABpc1CMP5MAAAAACAAAAMOCUUtEtjiVcw=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3710,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":400,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251734,"flow_last_seen":251734,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":251734,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"129.45.47.167","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3710,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":400,"flow_packet_id":1,"flow_last_seen":251734,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251734,"pkt":"UlQAEjUCCAAn5uVZCABFAAA086wAAIARiikKAAIPgS0vp3AJGMoAIFk6R05EED9OAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3711,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":166,"flow_packet_id":3,"flow_last_seen":251735,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251735,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0rnMAAIARKEEKAAIPWjv9unAJPMMAII4eR05EED9PAQFUC1FLUlAGUk5BXS\/iNQlw"} +00458{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3712,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":191,"flow_packet_id":2,"flow_last_seen":251735,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251735,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0RwQAAIARmdYKAAIPvpmPNnAJ\/\/8AINUGR05EED9QAQFUC1FLUlAGUk5BXS\/iNQlw"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3713,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":401,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251735,"flow_last_seen":251735,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":251735,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.178.192.76","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3713,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":401,"flow_packet_id":1,"flow_last_seen":251735,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251735,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0jpwAAIARMg8KAAIPrbLATHAJGMoAIJwMR05EED9RAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3717,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":352,"flow_packet_id":3,"flow_last_seen":251736,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251736,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0NSUAAIARFycKAAIPsL8xn3AJGMoAICepR05EED9VAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3720,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":3,"flow_last_seen":251737,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251737,"pkt":"UlQAEjUCCAAn5uVZCABFAAA00HIAAIARI3oKAAIPfCy+kXAJJ7oAIMBWR05EED9YAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3723,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":183,"flow_packet_id":3,"flow_last_seen":251737,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251737,"pkt":"UlQAEjUCCAAn5uVZCABFAAA085kAAIARz64KAAIPW6wPtnAJk8UAICOkR05EED9bAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3726,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":190,"flow_packet_id":3,"flow_last_seen":251737,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251737,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0VbsAAIARb2IKAAIPpanD43AJGMoAIKBxR05EED9eAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3727,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":185,"flow_packet_id":2,"flow_last_seen":251737,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251737,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0taAAAIARR0sKAAIPbYTEOnAJGMoAINg+R05EED9fAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3729,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":2,"flow_last_seen":251738,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251738,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0SboAAIARjAMKAAIPdqbiRnAJGMoAILEOR05EED9hAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3730,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":3,"flow_last_seen":251738,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251738,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0XA4AAIARFJgKAAIPqv4TBnAJXnQAIAZMR05EED9iAQFUC1FLUlAGUk5BXS\/iNQlw"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3731,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":402,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251738,"flow_last_seen":251738,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251738,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.219.202.2","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3731,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":402,"flow_packet_id":1,"flow_last_seen":251738,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251738,"pkt":"UlQAEjUCCAAn5uVZCABFAABpgBkAAIARlX4KAAIPTtvKAnAJGMoAVResR05EED9jAQFMQVEyUApVRFBdL+I1CXBvOYAkSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3732,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":403,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251739,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"197.244.171.132","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00530{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3732,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":403,"flow_packet_id":1,"flow_last_seen":251739,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251739,"pkt":"UlQAEjUCCAAn5uVZCABFAABpn\/EAAIARHQsKAAIPxfSrhHAJGMoAVUkZR05EED9kAQFMQVEyUApVRFBdL+I1CXA0OLGbSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3733,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":404,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251739,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.234.216.251","src_port":28681,"dst_port":17845,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3733,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":404,"flow_packet_id":1,"flow_last_seen":251739,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251739,"pkt":"UlQAEjUCCAAn5uVZCABFAABpjkwAAIARcEMKAAIPVurY+3AJRbUAVQcCR05EED9lAQFMQVEyUApVRFBdL+I1CXDHMdz4SAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3734,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":405,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251739,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.155.31.118","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3734,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":405,"flow_packet_id":1,"flow_last_seen":251739,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251739,"pkt":"UlQAEjUCCAAn5uVZCABFAABpJdUAAIAROI8KAAIPsJsfdnAJGMoAVbHHR05EED9mAQFMQVEyUApVRFBdL+I1CXBQgEyMSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3735,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":406,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251739,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.27.3.68","src_port":28681,"dst_port":57380,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3735,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":406,"flow_packet_id":1,"flow_last_seen":251739,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251739,"pkt":"UlQAEjUCCAAn5uVZCABFAABpkwUAAIARKxEKAAIPbRsDRHAJ4CQAVb5+R05EED9nAQFMQVEyUApVRFBdL+I1CXCQaKwvSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3737,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":407,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251739,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.181.151.217","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3737,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":407,"flow_packet_id":1,"flow_last_seen":251739,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251739,"pkt":"UlQAEjUCCAAn5uVZCABFAABpBqsAAIARzDsKAAIPw7WX2XAJGMoAVdFRR05EED9oAQFMQVEyUApVRFBdL+I1CXDKQckfSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3738,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":2,"flow_last_seen":251739,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251739,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0B\/8AAIARw8UKAAIPcHfybnAJHvIAIKDlR05EED9pAQFUC1FLUlAGUk5BXS\/iNQlw"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3739,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":408,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251740,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.103.2.245","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3739,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":408,"flow_packet_id":1,"flow_last_seen":251740,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251740,"pkt":"UlQAEjUCCAAn5uVZCABFAABp+vMAAIAR1iUKAAIPWmcC9XAJGMoAVbquR05EED9qAQFMQVEyUApVRFBdL+I1CXDvdHgBSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3740,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":409,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251740,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.194.53.68","src_port":28681,"dst_port":33770,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3740,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":409,"flow_packet_id":1,"flow_last_seen":251740,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251740,"pkt":"UlQAEjUCCAAn5uVZCABFAABp6gYAAIARuGgKAAIPVsI1RHAJg+oAVTU8R05EED9rAQFMQVEyUApVRFBdL+I1CXDTUzsOSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3741,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":410,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251740,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.28.130.131","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3741,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":410,"flow_packet_id":1,"flow_last_seen":251740,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251740,"pkt":"UlQAEjUCCAAn5uVZCABFAABpE5AAAIARO0YKAAIPXRyCg3AJGMoAVTPWR05EED9sAQFMQVEyUApVRFBdL+I1CXAD+PaCSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3742,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":411,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251740,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.143.28.64","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3742,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":411,"flow_packet_id":1,"flow_last_seen":251740,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251740,"pkt":"UlQAEjUCCAAn5uVZCABFAABpwd8AAIAR9sYKAAIPWY8cQHAJGMoAVVMGR05EED9tAQFMQVEyUApVRFBdL+I1CXAhZ3heSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3743,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":412,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251740,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.177.52.73","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3743,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":412,"flow_packet_id":1,"flow_last_seen":251740,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251740,"pkt":"UlQAEjUCCAAn5uVZCABFAABp3loAAIAR4SAKAAIPOrE0SXAJGMoAVVoRR05EED9uAQFMQVEyUApVRFBdL+I1CXAwmTIsSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3744,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":2,"flow_last_seen":251740,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251740,"pkt":"UlQAEjUCCAAn5uVZCABFAAA01LUAAIARp3wKAAIPXINV9XAJe\/8AIPQ\/R05EED9vAQFUC1FLUlAGUk5BXS\/iNQlw"} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3745,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":2,"flow_last_seen":251740,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251740,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0tBMAAIAREWMKAAIPUTIYAnAJRdIAIHOwR05EED9wAQFUC1FLUlAGUk5BXS\/iNQlw"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3746,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":413,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251741,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.65.188.29","src_port":28681,"dst_port":24676,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3746,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":413,"flow_packet_id":1,"flow_last_seen":251741,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251741,"pkt":"UlQAEjUCCAAn5uVZCABFAABptKwAAIARZmoKAAIPV0G8HXAJYGQAVfy4R05EED9xAQFMQVEyUApVRFBdL+I1CXAsjoyoSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3747,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":414,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251741,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.181.156.244","src_port":28681,"dst_port":8255,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3747,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":414,"flow_packet_id":1,"flow_last_seen":251741,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251741,"pkt":"UlQAEjUCCAAn5uVZCABFAABpyBYAAIARGbUKAAIPr7Wc9HAJID8AVaTlR05EED9yAQFMQVEyUApVRFBdL+I1CXAnhz4OSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3748,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":415,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251741,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.247.160.96","src_port":28681,"dst_port":17817,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3748,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":415,"flow_packet_id":1,"flow_last_seen":251741,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251741,"pkt":"UlQAEjUCCAAn5uVZCABFAABp2rQAAIARWGkKAAIPWvegYHAJRZkAVVg2R05EED9zAQFMQVEyUApVRFBdL+I1CXBQFbv4SAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3749,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":416,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251741,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.139.61.103","src_port":28681,"dst_port":24096,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3749,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":416,"flow_packet_id":1,"flow_last_seen":251741,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251741,"pkt":"UlQAEjUCCAAn5uVZCABFAABpgP4AAIARE4UKAAIPXIs9Z3AJXiAAVReAR05EED90AQFMQVEyUApVRFBdL+I1CXAgCH+PSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3750,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":417,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251741,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.187.236.179","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3750,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":417,"flow_packet_id":1,"flow_last_seen":251741,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251741,"pkt":"UlQAEjUCCAAn5uVZCABFAABpPOUAAIARpiEKAAIPXrvss3AJGMoAVc9JR05EED91AQFMQVEyUApVRFBdL+I1CXAK96N8SAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3751,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":418,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251741,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.129.149.103","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3751,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":418,"flow_packet_id":1,"flow_last_seen":251741,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251741,"pkt":"UlQAEjUCCAAn5uVZCABFAABpWIsAAIAR9QEKAAIPS4GVZ3AJGMoAVejfR05EED92AQFMQVEyUApVRFBdL+I1CXB7zyH1SAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3752,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":419,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251741,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.193.236.8","src_port":28681,"dst_port":46557,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3752,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":419,"flow_packet_id":1,"flow_last_seen":251741,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251741,"pkt":"UlQAEjUCCAAn5uVZCABFAABptLQAAIARPvcKAAIPTsHsCHAJtd0AVaGTR05EED93AQFMQVEyUApVRFBdL+I1CXBWRJ3QSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3753,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":420,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251741,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.227.127.34","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00531{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3753,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":420,"flow_packet_id":1,"flow_last_seen":251741,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251741,"pkt":"UlQAEjUCCAAn5uVZCABFAABp\/oQAAIARWesKAAIPVuN\/InAJGMoAVVdoR05EED94AQFMQVEyUApVRFBdL+I1CXD9RPkbSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3754,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":421,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251741,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.182.39.11","src_port":28681,"dst_port":12977,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3754,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":421,"flow_packet_id":1,"flow_last_seen":251741,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251741,"pkt":"UlQAEjUCCAAn5uVZCABFAABpD2cAAIARSE0KAAIPr7YnC3AJMrEAVZiQR05EED95AQFMQVEyUApVRFBdL+I1CXCiUoeySAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3755,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":422,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251742,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.123.35.219","src_port":28681,"dst_port":42211,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3755,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":422,"flow_packet_id":1,"flow_last_seen":251742,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251742,"pkt":"UlQAEjUCCAAn5uVZCABFAABpDCwAAIARpfMKAAIPWHsj23AJpOMAVY76R05EED96AQFMQVEyUApVRFBdL+I1CXA5574PSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3756,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":423,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251742,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.247.6.226","src_port":28681,"dst_port":9713,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00530{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3756,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":423,"flow_packet_id":1,"flow_last_seen":251742,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251742,"pkt":"UlQAEjUCCAAn5uVZCABFAABpUuIAAIARXLoKAAIPd\/cG4nAJJfEAVXf1R05EED97AQFMQVEyUApVRFBdL+I1CXCyY7kmSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3757,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":424,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251742,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.15.216.216","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00531{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3757,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":424,"flow_packet_id":1,"flow_last_seen":251742,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251742,"pkt":"UlQAEjUCCAAn5uVZCABFAABp9RgAAIARA3UKAAIPXQ\/Y2HAJGMoAVYvoR05EED98AQFMQVEyUApVRFBdL+I1CXCl\/OnPSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3758,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":425,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251742,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"145.82.53.165","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3758,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":425,"flow_packet_id":1,"flow_last_seen":251742,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251742,"pkt":"UlQAEjUCCAAn5uVZCABFAABpyoQAAIARnPkKAAIPkVI1pXAJGMoAVbRqR05EED99AQFMQVEyUApVRFBdL+I1CXBpxpNMSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3759,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":426,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251742,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.71.44.121","src_port":28681,"dst_port":14398,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3759,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":426,"flow_packet_id":1,"flow_last_seen":251742,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251742,"pkt":"UlQAEjUCCAAn5uVZCABFAABpjvsAAIARl7kKAAIP20cseXAJOD4AVTM8R05EED9+AQFMQVEyUApVRFBdL+I1CXDAVizdSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3760,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":427,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251742,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.249.13.30","src_port":28681,"dst_port":15138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00531{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3760,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":427,"flow_packet_id":1,"flow_last_seen":251742,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251742,"pkt":"UlQAEjUCCAAn5uVZCABFAABp\/4AAAIARz90KAAIPUfkNHnAJOyIAVV3HR05EED9\/AQFMQVEyUApVRFBdL+I1CXDXBU+pSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3761,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":428,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251742,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.162.97.8","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3761,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":428,"flow_packet_id":1,"flow_last_seen":251742,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251742,"pkt":"UlQAEjUCCAAn5uVZCABFAABpxSAAAIARsaoKAAIPVqJhCHAJGMoAVbYBR05EED+AAQFMQVEyUApVRFBdL+I1CXBICmgWSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3762,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":2,"flow_last_seen":251742,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251742,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0qf0AAIARfpoKAAIPU1yytnAJ39YAIDy8R05EED+BAQFUC1FLUlAGUk5BXS\/iNQlw"} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3763,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":429,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251742,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.215.213","src_port":28681,"dst_port":23576,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3763,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":429,"flow_packet_id":1,"flow_last_seen":251742,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251742,"pkt":"UlQAEjUCCAAn5uVZCABFAABpbRYAAIARQ+AKAAIPpanX1XAJXBgAVc6AR05EED+CAQFMQVEyUApVRFBdL+I1CXBThrh4SAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3764,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":430,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251742,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.8.95.165","src_port":28681,"dst_port":40763,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3764,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":430,"flow_packet_id":1,"flow_last_seen":251742,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251742,"pkt":"UlQAEjUCCAAn5uVZCABFAABpkTwAAIAR44sKAAIPWghfpXAJnzsAVR0tR05EED+DAQFMQVEyUApVRFBdL+I1CXDGRkbqSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3765,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":431,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251743,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.124.71.246","src_port":28681,"dst_port":49035,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3765,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":431,"flow_packet_id":1,"flow_last_seen":251743,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251743,"pkt":"UlQAEjUCCAAn5uVZCABFAABpAKcAAIARjVwKAAIPWHxH9nAJv4sAVfWnR05EED+EAQFMQVEyUApVRFBdL+I1CXBJizLGSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3766,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":432,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251743,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.6.118.53","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3766,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":432,"flow_packet_id":1,"flow_last_seen":251743,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251743,"pkt":"UlQAEjUCCAAn5uVZCABFAABpRRcAAIARCyMKAAIPaAZ2NXAJGMoAVRHkR05EED+FAQFMQVEyUApVRFBdL+I1CXCTBKSZSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3767,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":433,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251743,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.255.145.191","src_port":28681,"dst_port":47264,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00530{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3767,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":433,"flow_packet_id":1,"flow_last_seen":251743,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251743,"pkt":"UlQAEjUCCAAn5uVZCABFAABpc60AAIARxQkKAAIPY\/+Rv3AJuKAAVf+gR05EED+GAQFMQVEyUApVRFBdL+I1CXClGHrgSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3768,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":434,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251743,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.24.182.130","src_port":28681,"dst_port":22232,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3768,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":434,"flow_packet_id":1,"flow_last_seen":251743,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251743,"pkt":"UlQAEjUCCAAn5uVZCABFAABprogAAIARV1IKAAIPchi2gnAJVtgAVTeWR05EED+HAQFMQVEyUApVRFBdL+I1CXDG5k8JSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3769,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":435,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251743,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.24.146.101","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3769,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":435,"flow_packet_id":1,"flow_last_seen":251743,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251743,"pkt":"UlQAEjUCCAAn5uVZCABFAABpKe0AAIARBQsKAAIPbRiSZXAJGMoAVc8GR05EED+IAQFMQVEyUApVRFBdL+I1CXCk7CrTSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3770,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":436,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251743,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.68.179.137","src_port":28681,"dst_port":6406,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3770,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":436,"flow_packet_id":1,"flow_last_seen":251743,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251743,"pkt":"UlQAEjUCCAAn5uVZCABFAABpBbYAAIARmfEKAAIP20SziXAJGQYAVWDBR05EED+JAQFMQVEyUApVRFBdL+I1CXC3ZdA4SAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3771,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":437,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251743,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"31.38.163.2","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3771,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":437,"flow_packet_id":1,"flow_last_seen":251743,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251743,"pkt":"UlQAEjUCCAAn5uVZCABFAABpXhUAAIARDjgKAAIPHyajAnAJGMoAVb8RR05EED+KAQFMQVEyUApVRFBdL+I1CXCCZpWmSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3772,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":438,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251743,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.86.190.163","src_port":28681,"dst_port":14142,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3772,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":438,"flow_packet_id":1,"flow_last_seen":251743,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251743,"pkt":"UlQAEjUCCAAn5uVZCABFAABpnzUAAIARiUYKAAIPR1a+o3AJNz4AVZWpR05EED+LAQFMQVEyUApVRFBdL+I1CXAC+zbZSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3773,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":439,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251743,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.135.15.86","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3773,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":439,"flow_packet_id":1,"flow_last_seen":251743,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251743,"pkt":"UlQAEjUCCAAn5uVZCABFAABpeMgAAIAR9c8KAAIPsIcPVnAJGMoAVfORR05EED+MAQFMQVEyUApVRFBdL+I1CXBFn5s7SAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3774,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":440,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251743,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.165.170.112","src_port":28681,"dst_port":37087,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3774,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":440,"flow_packet_id":1,"flow_last_seen":251743,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251743,"pkt":"UlQAEjUCCAAn5uVZCABFAABptQEAAIARA14KAAIPy6WqcHAJkN8AVThSR05EED+NAQFMQVEyUApVRFBdL+I1CXAo9qhxSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3776,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":441,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251763,"flow_last_seen":251763,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251763,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.199.108","src_port":28681,"dst_port":56040,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3776,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":441,"flow_packet_id":1,"flow_last_seen":251763,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251763,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Im4AAIARH98KAAIPJO3HbHAJ2ugAJO8DDHExAr2T6ZT\/ObNg3LKLAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3777,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":442,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251763,"flow_last_seen":251763,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251763,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.204.130.55","src_port":28681,"dst_port":29545,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3777,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":442,"flow_packet_id":1,"flow_last_seen":251763,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251763,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4rcEAAIARpOEKAAIPWcyCN3AJc2kAJAgb5coxAv97fIL\/wg\/awj75AwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3778,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_packet_id":2,"flow_last_seen":251763,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251763,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4N+sAAIARg7AKAAIPzyaj5HAJGnoAJJXpWpsxApZGj4\/\/M2sG2xKbAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3779,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":443,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251763,"flow_last_seen":251763,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251763,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.14.31","src_port":28681,"dst_port":54754,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3779,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":443,"flow_packet_id":1,"flow_last_seen":251763,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251763,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4fpgAAIAR6jsKAAIPt7MOH3AJ1eIAJLe2EooxAi4mfNz\/nMcrpmwGAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3780,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":444,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251764,"flow_last_seen":251764,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251764,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.117.100.78","src_port":28681,"dst_port":9010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3780,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":444,"flow_packet_id":1,"flow_last_seen":251764,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251764,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4UCoAAIAR\/7gKAAIPenVkTnAJIzIAJIBDansxAgYVG\/L\/LLMv3hTlAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3781,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":445,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251764,"flow_last_seen":251764,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251764,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.165.153.100","src_port":28681,"dst_port":4509,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3781,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":445,"flow_packet_id":1,"flow_last_seen":251764,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251764,"pkt":"UlQAEjUCCAAn5uVZCABFAAA46o0AAIARNA8KAAIPdqWZZHAJEZ0AJA9uVrIxApK5\/N\/\/S91wOxBVAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3782,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":446,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251764,"flow_last_seen":251764,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251764,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.70.199.107","src_port":28681,"dst_port":60475,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3782,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":446,"flow_packet_id":1,"flow_last_seen":251764,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251764,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4X0EAAIARyrMKAAIPPUbHa3AJ7DsAJPE8LD4xAsnBWq\/\/QPrF+ExfAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3783,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":447,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251764,"flow_last_seen":251764,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251764,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.199.10.60","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3783,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":447,"flow_packet_id":1,"flow_last_seen":251764,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251764,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4SFUAAIARzU4KAAIPDscKPHAJW6IAJLlDLAcxApbO4XT\/cwIBXYVTAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3784,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":448,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251764,"flow_last_seen":251764,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251764,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":28681,"dst_port":15677,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3784,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":448,"flow_packet_id":1,"flow_last_seen":251764,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251764,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4bmcAAIARqKsKAAIPdPGionAJPT0AJKpxJOgxAhhawe3\/Limd\/+5dAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3785,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":449,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251765,"flow_last_seen":251765,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251765,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":28681,"dst_port":8826,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3785,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":449,"flow_packet_id":1,"flow_last_seen":251765,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251765,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4GZsAAIARKZ0KAAIPPe6tgHAJInoAJOPhCvwxAgItW0n\/R04QQpiaAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3786,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":450,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251765,"flow_last_seen":251765,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251765,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.206.254","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3786,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":450,"flow_packet_id":1,"flow_last_seen":251765,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251765,"pkt":"UlQAEjUCCAAn5uVZCABFAAA42YMAAIARFCgKAAIPcfzO\/nAJW6IAJIFz79cxAl8VURH\/jbBAJE\/yAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3787,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":451,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251765,"flow_last_seen":251765,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251765,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.35.66.21","src_port":28681,"dst_port":22234,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3787,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":451,"flow_packet_id":1,"flow_last_seen":251765,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251765,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4cGQAAIARogkKAAIP2iNCFXAJVtoAJDK0p14xAtJRuuP\/xO64lFQnAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3788,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":452,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251765,"flow_last_seen":251765,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251765,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.227.193.37","src_port":28681,"dst_port":27481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3788,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":452,"flow_packet_id":1,"flow_last_seen":251765,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251765,"pkt":"UlQAEjUCCAAn5uVZCABFAAA45uYAAIARQbcKAAIPROPBJXAJa1kAJDmsxWExAmB\/ov7\/ILlztKqjAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3789,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":453,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251766,"flow_last_seen":251766,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251766,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.127.26.138","src_port":28681,"dst_port":3083,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3789,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":453,"flow_packet_id":1,"flow_last_seen":251766,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251766,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4vI4AAIARDQ8KAAIPSn8ainAJDAsAJK0bcMQxAi7Uor7\/iLpVMcg4AwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3790,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":454,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251766,"flow_last_seen":251766,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251766,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.121.156","src_port":28681,"dst_port":23183,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3790,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":454,"flow_packet_id":1,"flow_last_seen":251766,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251766,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4KvkAAIARqwAKAAIP3xB5nHAJWo8AJB+2z\/kxApxnbG7\/V7LJCkocAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3791,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":455,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251766,"flow_last_seen":251766,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251766,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.153.206.183","src_port":28681,"dst_port":16919,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3791,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":455,"flow_packet_id":1,"flow_last_seen":251766,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251766,"pkt":"UlQAEjUCCAAn5uVZCABFAAA40tIAAIARUoMKAAIPOpnOt3AJQhcAJEqnUgYxAuLt\/9n\/QZRL+MItAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":456,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251766,"flow_last_seen":251766,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251766,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.241.112.255","src_port":28681,"dst_port":14766,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":456,"flow_packet_id":1,"flow_last_seen":251766,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251766,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4YcYAAIARAfAKAAIPWfFw\/3AJOa4AJH67gyUxArdDRQj\/pCyTUCoFAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3793,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":457,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251766,"flow_last_seen":251766,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251766,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.247.240.113","src_port":28681,"dst_port":13867,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3793,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":457,"flow_packet_id":1,"flow_last_seen":251766,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251766,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4GGIAAIARrdsKAAIPd\/fwcXAJNisAJOjuweIxAsYECAX\/QOJn+hSRAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3794,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":458,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251767,"flow_last_seen":251767,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251767,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.165.228.167","src_port":28681,"dst_port":12201,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3794,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":458,"flow_packet_id":1,"flow_last_seen":251767,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251767,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ZxQAAIARbEUKAAIPdqXkp3AJL6kAJC+Rp2UxAuAALpb\/keYhsfV8AwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3795,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":459,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251767,"flow_last_seen":251767,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251767,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.89.84.59","src_port":28681,"dst_port":11603,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3795,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":459,"flow_packet_id":1,"flow_last_seen":251767,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251767,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ylEAAIARq8AKAAIPZFlUO3AJLVMAJBSKOtoxAqNJl4L\/Q+vK6gY\/AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3796,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":460,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251767,"flow_last_seen":251767,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251767,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"210.194.116.78","src_port":28681,"dst_port":8342,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3796,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":460,"flow_packet_id":1,"flow_last_seen":251767,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251767,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4uwMAAIARLJIKAAIP0sJ0TnAJIJYAJBKPq\/gxAveDM1T\/GNrWWzb+AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3797,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":461,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251767,"flow_last_seen":251767,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251767,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.27.193.124","src_port":28681,"dst_port":50555,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3797,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":461,"flow_packet_id":1,"flow_last_seen":251767,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251767,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4hLMAAIARo1sKAAIPRRvBfHAJxXsAJLpQDHwxAtnMGyP\/Ae530uM8AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3798,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":462,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251767,"flow_last_seen":251767,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251767,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":47808,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3798,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":462,"flow_packet_id":1,"flow_last_seen":251767,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251767,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ptgAAIAR2TAKAAIPpIQKGXAJusAAJKP8z14xAu1XgQX\/2\/p02cVlAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3799,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_packet_id":3,"flow_last_seen":251767,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251767,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4AsQAAIAR5hwKAAIP1eVv4HAJEwwAJLgEbHwxAs+w3Nf\/4i4R4F1MAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3802,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":463,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251768,"flow_last_seen":251768,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251768,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.7.155.210","src_port":28681,"dst_port":28365,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3802,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":463,"flow_packet_id":1,"flow_last_seen":251768,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251768,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4RtEAAIARg\/sKAAIPyAeb0nAJbs0AJEUCvVsxAoZuEFj\/eIRjgIUUAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3803,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":464,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251768,"flow_last_seen":251768,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251768,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"101.128.66.8","src_port":28681,"dst_port":34512,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3803,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":464,"flow_packet_id":1,"flow_last_seen":251768,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251768,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4kWwAAIAR9bEKAAIPZYBCCHAJhtAAJEI7\/fExAretIzz\/aAK525tdAwABAAUAAADDglFLQA=="} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3804,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":465,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251768,"flow_last_seen":251768,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251768,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"2.28.39.18","src_port":28681,"dst_port":15672,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3804,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":465,"flow_packet_id":1,"flow_last_seen":251768,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251768,"pkt":"UlQAEjUCCAAn5uVZCABFAABptDMAAIARURQKAAIPAhwnEnAJPTgAVXP4R05EED+OAQFMQVEyUApVRFBdL+I1CXCOOiuSSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3806,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":466,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251768,"flow_last_seen":251768,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251768,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"70.119.248.5","src_port":28681,"dst_port":49929,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3806,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":466,"flow_packet_id":1,"flow_last_seen":251768,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251768,"pkt":"UlQAEjUCCAAn5uVZCABFAABpkwYAAIARXPIKAAIPRnf4BXAJwwkAVWk8R05EED+PAQFMQVEyUApVRFBdL+I1CXCywaF6SAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3807,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":467,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251769,"flow_last_seen":251769,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251769,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.64.177.53","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3807,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":467,"flow_packet_id":1,"flow_last_seen":251769,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251769,"pkt":"UlQAEjUCCAAn5uVZCABFAABphhwAAIARueMKAAIPPUCxNXAJW6IAVYBcR05EED+QAQFMQVEyUApVRFBdL+I1CXCCOR+jSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3808,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":468,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251769,"flow_last_seen":251769,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251769,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.214.12.247","src_port":28681,"dst_port":44001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3808,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":468,"flow_packet_id":1,"flow_last_seen":251769,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251769,"pkt":"UlQAEjUCCAAn5uVZCABFAABpuX4AAIARCSoKAAIPXtYM93AJq+EAVTOfR05EED+RAQFMQVEyUApVRFBdL+I1CXBhK2YwSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3809,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":2,"flow_last_seen":251769,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":251769,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0djcAAIARTnsKAAIPVYoUbnAJGMoAIJ\/SR05EED+SAQFUC1FLUlAGUk5BXS\/iNQlw"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3812,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":469,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251799,"flow_last_seen":251799,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251799,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":47184,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3812,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":469,"flow_packet_id":1,"flow_last_seen":251799,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251799,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4oEcAAIAR\/\/kKAAIPV3s26nAJuFAAJLIzoTgxArDMLAv\/7an+30aEAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3813,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":470,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251799,"flow_last_seen":251799,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251799,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":46790,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3813,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":470,"flow_packet_id":1,"flow_last_seen":251799,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251799,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4OJAAAIAR8a0KAAIPubtKrXAJtsYAJOap8QMxAqeUAH\/\/jC8uTIHOAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3814,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":471,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251800,"flow_last_seen":251800,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251800,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":43457,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3814,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":471,"flow_packet_id":1,"flow_last_seen":251800,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251800,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Ix0AAIARvsEKAAIPUAf8wHAJqcEAJCWpQioxAiz7xyr\/nieIBoQEAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3815,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":472,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251800,"flow_last_seen":251800,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251800,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":45744,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3815,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":472,"flow_packet_id":1,"flow_last_seen":251800,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251800,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4MioAAIARW\/QKAAIPXjZCUnAJsrAAJM24GMIxApxz2u3\/2r2JT7PGAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3816,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":473,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251800,"flow_last_seen":251800,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251800,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":28681,"dst_port":33564,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3816,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":473,"flow_packet_id":1,"flow_last_seen":251800,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251800,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4xlkAAIARNLsKAAIPjoSlDXAJgxwAJBv5lRAxAnDtJP\/\/krkp4svrAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3817,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":474,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251800,"flow_last_seen":251800,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251800,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":45880,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3817,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":474,"flow_packet_id":1,"flow_last_seen":251800,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251800,"pkt":"UlQAEjUCCAAn5uVZCABFAAA47X8AAIAREvMKAAIPUD3d9nAJszgAJMAokygxAjI2Dmb\/+jgBaddtAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3818,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":475,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251800,"flow_last_seen":251800,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251800,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":28681,"dst_port":63978,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3818,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":475,"flow_packet_id":1,"flow_last_seen":251800,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251800,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4c2MAAIARyk4KAAIPvD00t3AJ+eoAJAlos2QxAuftnBD\/pwvk8vZaAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3819,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":476,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251801,"flow_last_seen":251801,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251801,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.18.172.208","src_port":28681,"dst_port":63172,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3819,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":476,"flow_packet_id":1,"flow_last_seen":251801,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251801,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4A+EAAIARG+MKAAIPYhKs0HAJ9sQAJMnKPv4xAlxBW0z\/giMaZpI1AwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3820,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":477,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251801,"flow_last_seen":251801,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251801,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":45640,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3820,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":477,"flow_packet_id":1,"flow_last_seen":251801,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251801,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4MisAAIARW\/MKAAIPXjZCUnAJskgAJDmNAoUxAlKurFf\/tMhKG0UTAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":478,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251801,"flow_last_seen":251801,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251801,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.235.85.44","src_port":28681,"dst_port":64914,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":478,"flow_packet_id":1,"flow_last_seen":251801,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251801,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4yu4AAIAR6aAKAAIPJOtVLHAJ\/ZIAJHPKDJ0xAhzqW27\/WgyBR+fAAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3822,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":479,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251801,"flow_last_seen":251801,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251801,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.13.148","src_port":28681,"dst_port":51896,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3822,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":479,"flow_packet_id":1,"flow_last_seen":251801,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251801,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4N\/YAAIARbU8KAAIPe80NlHAJyrgAJJ3qzYgxArBCiBL\/V0fRziF3AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3823,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":480,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251801,"flow_last_seen":251801,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":251801,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.74.26","src_port":28681,"dst_port":65498,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3823,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":480,"flow_packet_id":1,"flow_last_seen":251801,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":251801,"pkt":"UlQAEjUCCAAn5uVZCABFAAA49tgAAIARfTwKAAIPcHdKGnAJ\/9oAJJAPBCMxArDSw4b\/H0\/S10KbAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3824,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":481,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251802,"flow_last_seen":251802,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251802,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.120.219.74","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3824,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":481,"flow_packet_id":1,"flow_last_seen":251802,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251802,"pkt":"UlQAEjUCCAAn5uVZCABFAABplkUAAIARam0KAAIPUnjbSnAJGMoAVeuTR05EED+TAQFMQVEyUApVRFBdL+I1CXAFqezLSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3825,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":482,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251802,"flow_last_seen":251802,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":251802,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.193.23.172","src_port":28681,"dst_port":42227,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3825,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":482,"flow_packet_id":1,"flow_last_seen":251802,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":251802,"pkt":"UlQAEjUCCAAn5uVZCABFAABpmQMAAIARJwUKAAIPVsEXrHAJpPMAVbfKR05EED+UAQFMQVEyUApVRFBdL+I1CXAJ2N0DSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3828,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_packet_id":3,"flow_last_seen":251868,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":251868,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCiIAAEAR8WfPJqPkCgACDxp6cAkANsFJWpsxApZGj4\/\/M2sG2xKbAwEBABcAAAB6Gs8mo+QAAAAAAAAAAMOCUUtEhU4oKg=="} +00494{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3829,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":452,"flow_packet_id":2,"flow_last_seen":251884,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"thread_ts_msec":251884,"pkt":"CAAn5uVZUlQAEjUCCABFAABOCiMAAEARXmVE48ElCgACD2tZcAkAOq9\/xWExAmB\/ov7\/ILlztKqjAwEBABsAAABZa0TjwSUMAAAAAIAAAMOCUUtIaDpKbQye1TA="} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3830,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":447,"flow_packet_id":2,"flow_last_seen":251943,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":251943,"pkt":"CAAn5uVZUlQAEjUCCABFAABJCiQAAEARS28Oxwo8CgACD1uicAkANVFGLAcxApbO4XT\/cwIBXYVTAwEBABYAAACiWw7HCjwAAAAACAAAAMOCVVBDAQAC"} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3831,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":483,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251946,"flow_last_seen":251946,"flow_idle_time":180000,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":45,"flow_avg_l4_payload_len":45,"midstream":0,"thread_ts_msec":251946,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","src_port":1026,"dst_port":28681,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3831,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":483,"flow_packet_id":1,"flow_last_seen":251946,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":251946,"pkt":"CAAn5uVZUlQAEjUCCABFAABJCiUAAEARWG8KAAICCgACDwQCcAkANTvpCvwxAgItW0n\/R04QQpiaAwEBABYAAAB6Ij3urYAgAQAAAAAABMOCVVBDAR4I"} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3832,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":464,"flow_packet_id":2,"flow_last_seen":251973,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":251973,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCiYAAEARvOZlgEIICgACD4bQcAkANjtE\/fExAretIzz\/aAK525tdAwEBABcAAADQhmWAQghvAQAAAAAgAMOCUUtErD1IeA=="} +00486{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3833,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":450,"flow_packet_id":2,"flow_last_seen":251982,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":251982,"pkt":"CAAn5uVZUlQAEjUCCABFAABJCicAAEARI3Rx\/M7+CgACD1uicAkANRYs79cxAl8VURH\/jbBAJE\/yAwEBABYAAACiW3H8zv4kAgAAAAAACMOCVVBDAQYD"} +00485{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3834,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":448,"flow_packet_id":2,"flow_last_seen":252025,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":252025,"pkt":"CAAn5uVZUlQAEjUCCABFAABJCigAAEARTNp08aKiCgACDz09cAkANc3NJOgxAhhawe3\/Limd\/+5dAwEBABYAAAA9PXTxoqIVAAAAAAEAAMOCVVBDAQAD"} +00846{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3835,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":414,"flow_packet_id":2,"flow_last_seen":252054,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":351,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":351,"pkt_l4_len":317,"thread_ts_msec":252054,"pkt":"CAAn5uVZUlQAEjUCCABFAAFRCikAAEARFruvtZz0CgACDyA\/cAkBPRaQR05EASwmAQF4nOspZwx09GAJCV7IpZrkwOGyfuucL\/YKSgxA5ul7fKtUoo+BmEVqnEHz4w6DmFpJxQ2LoneAmCrvr076FrIPxLztrlNpZ7EdxKw+W5fmKQLWdjuUO\/SR5kEQ89YS9ZflgSfAzLXPkmy89kNMWCRtJA824U5n1tpM3b1g2yS2Nd0Ig5jgZiDeJq8GYpZ\/Z3v0URXC\/DbZ444gmHmnX+lhup8KiGl7R\/PjVDEmsCOZ7GQ+SyiA1fL1v10UzQBW4LDRdFE0H9gK9VmuD4QYQcxT0+2tT8gKgpiMCwOCLijKg5gF5Z\/yPsmBDVN5yXzfwIgRwtS61CEK9AVbMCQcgAyId4AMiFNAjNaqm2ApiPc8WIIcdRgZGBhi9R+ZGjIxpEgd+fTSj7OAHwDkZn\/e"} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3837,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":463,"flow_packet_id":2,"flow_last_seen":252237,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":252237,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCisAAEARAJDIB5vSCgACD27NcAkANlqcvVsxAoZuEFj\/eIRjgIUUAwEBABcAAADNbsgHm9IAAAAACAAAAMOCUUtEApadXA=="} +00841{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3838,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":434,"flow_packet_id":2,"flow_last_seen":252481,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":346,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":346,"pkt_l4_len":312,"thread_ts_msec":252481,"pkt":"CAAn5uVZUlQAEjUCCABFAAFMCiwAAEAROsxyGLaCCgACD1bYcAkBOFVRR05EAXxtAQF4nOvJYQx09GAJCV7MpZrkwOFSJLGt6UbYMQYgUyupuGFR9A4Q89baZ0k2XvtBzNP3+FapRIMV3Fqi\/rI88ASIWaTGGTQ\/7jCIqfL+6qRvIftAzDutVTcXRR8HMavP1qV5ioC13XbXqbSz2A5W0Jm1NlN3L0TbImkjeYi2tuVBe8QOgZjrt6lzbzQ6AGZunfPFXkEZxCz\/zvboo6oamPltsscdQTDT9o7mx6liTGCnM9nJfJZQABvWr\/Qw3U8FxNy+OaqgRk0brI2v\/+2iaAawNoeNpoui+UDMU9PtrU\/ICoKYjAsDgi4oyoFd9pL5voERI4MDWzDENiDjtpuBeJs8kAHxLZAB8SCc4cES5KjDyMDAEKv\/yNSQiSFF6sinl36cBfwAxlh+fA=="} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":96,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71535,"flow_last_seen":71535,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.160.214.137","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":96,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71535,"flow_last_seen":71535,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.160.214.137","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":100,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71536,"flow_last_seen":71536,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.133.122.217","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":100,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71536,"flow_last_seen":71536,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.133.122.217","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":115,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71540,"flow_last_seen":71540,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"154.3.42.104","src_port":28681,"dst_port":11804,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":115,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71540,"flow_last_seen":71540,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"154.3.42.104","src_port":28681,"dst_port":11804,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":101,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71537,"flow_last_seen":71537,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.126.102","src_port":28681,"dst_port":5193,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":101,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71537,"flow_last_seen":71537,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.126.102","src_port":28681,"dst_port":5193,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00913{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":345,"flow_state":"finished","flow_packets_processed":21,"flow_first_seen":126831,"flow_last_seen":130215,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":10878,"flow_avg_l4_payload_len":518,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50330,"dst_port":46906,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":131,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72851,"flow_last_seen":72851,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.225.140.186","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":131,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72851,"flow_last_seen":72851,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.225.140.186","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":106,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.39.154.69","src_port":28681,"dst_port":4832,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":106,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.39.154.69","src_port":28681,"dst_port":4832,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":86,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":70230,"flow_last_seen":70230,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.210.244.72","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":86,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":70230,"flow_last_seen":70230,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.210.244.72","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":127,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72850,"flow_last_seen":72850,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.191.49.159","src_port":28681,"dst_port":1024,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":127,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72850,"flow_last_seen":72850,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.191.49.159","src_port":28681,"dst_port":1024,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":112,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71540,"flow_last_seen":71540,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.239.213.146","src_port":28681,"dst_port":21750,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":112,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71540,"flow_last_seen":71540,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.239.213.146","src_port":28681,"dst_port":21750,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":99,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71536,"flow_last_seen":71536,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.38.9.82","src_port":28681,"dst_port":24223,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":99,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71536,"flow_last_seen":71536,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.38.9.82","src_port":28681,"dst_port":24223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":107,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"202.151.63.59","src_port":28681,"dst_port":7624,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":107,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"202.151.63.59","src_port":28681,"dst_port":7624,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":103,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71537,"flow_last_seen":71537,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.134.167.82","src_port":28681,"dst_port":5820,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":103,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71537,"flow_last_seen":71537,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.134.167.82","src_port":28681,"dst_port":5820,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":97,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71535,"flow_last_seen":71535,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.78.134.188","src_port":28681,"dst_port":49046,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":97,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71535,"flow_last_seen":71535,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.78.134.188","src_port":28681,"dst_port":49046,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":104,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.98.115.128","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":104,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.98.115.128","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00667{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":12461,"flow_last_seen":75501,"flow_idle_time":180000,"flow_min_l4_payload_len":91,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":637,"flow_avg_l4_payload_len":91,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"DHCPV6","breed":"Acceptable","category":"Network"}} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":102,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71537,"flow_last_seen":71537,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.39.233","src_port":28681,"dst_port":20855,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":102,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71537,"flow_last_seen":71537,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.39.233","src_port":28681,"dst_port":20855,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":132,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72851,"flow_last_seen":72851,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"79.86.173.45","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":132,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":72851,"flow_last_seen":72851,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"79.86.173.45","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":110,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71539,"flow_last_seen":71539,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.132.75.56","src_port":28681,"dst_port":56009,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":110,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71539,"flow_last_seen":71539,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.132.75.56","src_port":28681,"dst_port":56009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":105,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.11.85","src_port":28681,"dst_port":10722,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":105,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":71538,"flow_last_seen":71538,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.11.85","src_port":28681,"dst_port":10722,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":134,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":72852,"flow_last_seen":131670,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.231.73.14","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":128,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72850,"flow_last_seen":251736,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.141.219.27","src_port":28681,"dst_port":37580,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00561{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":114,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":71540,"flow_last_seen":191702,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.23.75.69","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00560{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":88,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":70230,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.50.24.2","src_port":28681,"dst_port":17874,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":118,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":71541,"flow_last_seen":132832,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"5.180.62.100","src_port":28681,"dst_port":46385,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":117,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":71540,"flow_last_seen":251737,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.120.243.143","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":98,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":71536,"flow_last_seen":243855,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":121,"flow_avg_l4_payload_len":30,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.222.14.170","src_port":28681,"dst_port":23332,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":111,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":71540,"flow_last_seen":251736,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.65.141.157","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":139,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72853,"flow_last_seen":251737,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.226.142","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":141,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72853,"flow_last_seen":251737,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"172.97.199.14","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":126,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":72849,"flow_last_seen":192908,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.69.159.133","src_port":28681,"dst_port":28000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":136,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":72852,"flow_last_seen":192908,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.236.247.120","src_port":28681,"dst_port":16047,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":85,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":70230,"flow_last_seen":251769,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.138.20.110","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":135,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72852,"flow_last_seen":251736,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.250.99.158","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":125,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":72849,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.92.178.182","src_port":28681,"dst_port":57302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":116,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":71540,"flow_last_seen":251737,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.44.190.145","src_port":28681,"dst_port":10170,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":133,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72852,"flow_last_seen":251737,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.175.220.161","src_port":28681,"dst_port":15721,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":124,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":72848,"flow_last_seen":251738,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"170.254.19.6","src_port":28681,"dst_port":24180,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":130,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":72851,"flow_last_seen":131668,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.224.95.97","src_port":28681,"dst_port":46356,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":129,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72850,"flow_last_seen":251738,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.138.50.179","src_port":28681,"dst_port":29411,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":137,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":72853,"flow_last_seen":191702,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.65.70.197","src_port":28681,"dst_port":21693,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":109,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":71539,"flow_last_seen":251736,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.169.2.153","src_port":28681,"dst_port":52414,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":140,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":72853,"flow_last_seen":192908,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.197.111.186","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":108,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":71539,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.242.110","src_port":28681,"dst_port":7922,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":113,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":71540,"flow_last_seen":191701,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"105.101.132.146","src_port":28681,"dst_port":57746,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":87,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":70230,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.131.85.245","src_port":28681,"dst_port":31743,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":138,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":72853,"flow_last_seen":192908,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":252577,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"167.114.170.156","src_port":28681,"dst_port":23844,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00869{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3842,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":467,"flow_packet_id":2,"flow_last_seen":252632,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":369,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":369,"pkt_l4_len":335,"thread_ts_msec":252632,"pkt":"CAAn5uVZUlQAEjUCCABFAAFjCi8AAEARdNc9QLE1CgACD1uicAkBT2NQR05EAdAzAQF4nOvpZQx09GAJCV7IpZrkwOFi67DRdFE0HwOQqcVkJ\/NZQgHELP\/O9uijqhqIeadf6WG6nwqIWaTGGTQ\/7jBYtLXq5qLo42Bm2\/KgPWKHQMxba58l2XjtB6uV2NZ0I+wYiHnbzUC8TR5smFZSccOi6B1gtUvUX5YHngArCOUOfaR5EMRUeb9I2kh+H9jczqy1mbp7IaJXJ30LAYsWqc9yfSDECGKu3zrni72CMohZfbYuzVMEbFv5t8kedwTBtq3fps690egAiLl9c1RBjZo2iGl7R\/PjVDEmEPPUdHvrE7KCYG18\/W8XRTOAmIwLA4IuKMqDmAXln\/I+yYHVqrxkvm9gxAhhal3qEAU6nS0YYhuQAfEvkAHRAmRANAAZkFDxYAly1GFkYGCI1X9kasjEkCJ15NNLP84CfgD2yolx"} +00865{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3849,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":423,"flow_packet_id":2,"flow_last_seen":252853,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":364,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":364,"pkt_l4_len":330,"thread_ts_msec":252853,"pkt":"CAAn5uVZUlQAEjUCCABFAAFeCjQAAEAR5HN39wbiCgACDyXxcAkBSnmHR05EAatVAQF4nOtpYgx09GAJCS65pJLkwOFS\/p3t0UdVNQYg87abgXibPJi5fuucL\/YKyiBmkcS2phthx8BMNc6g+XGHQUytpOKGRdE7QMw7rVU3F0UfBzM7s9Zm6u4Fm7BNnXuj0QEQ8\/Q9vlUq0WATbq19lmTjtR\/EVHm\/SNpIfh9YW9vyoD1ih8BuCOUOfaR5EMSsPluX5ikC1nbbXafSzmI7RNvVSd9CwNrKv032uCMIdq\/tHc2PU8WYwIb1Kz1M91MBizpsNF0UzQd2uvos1wdCjGBtfP1vF0UzgJinpttbn5AVBDEZFwYEXVCUBzELyj\/lfZIDG6bykvm+gREjhKl1qUP0BIMDWzDEx0AGJPCADC0mO5nPEkAGxNEgKbDjPFiCHHUYGRgYYvUfmRoyMaRIHfn00o+zgB8A72GGiA=="} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3855,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":172,"flow_packet_id":3,"flow_last_seen":253024,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":253024,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0dB4AAIAR1MEKAAIPV0WOhXAJPG8AIABWR05EED+XAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3856,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":3,"flow_last_seen":253024,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":253024,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09PUAAIARS70KAAIPaWWEknAJ4ZIAIFMER05EED+YAQFUC1FLUlAGUk5BXS\/iNQlw"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3858,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":484,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":253024,"flow_last_seen":253024,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":253024,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"107.4.56.177","src_port":28681,"dst_port":10000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3858,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":484,"flow_packet_id":1,"flow_last_seen":253024,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":253024,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0rIYAAIAR3m4KAAIPawQ4sXAJJxAAIFfHR05EED+aAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3859,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":3,"flow_last_seen":253024,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":253024,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0v88AAIARvTIKAAIPc0U+Y3AJGMoAIFgZR05EED+bAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3861,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":3,"flow_last_seen":253024,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":253024,"pkt":"UlQAEjUCCAAn5uVZCABFAAA02U8AAIAREUMKAAIPBbQ+ZHAJtTEAIClAR05EED+dAQFUC1FLUlAGUk5BXS\/iNQlw"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3862,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":485,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":253025,"flow_last_seen":253025,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":253025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"154.3.42.209","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3862,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":485,"flow_packet_id":1,"flow_last_seen":253025,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":253025,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0fvgAAIAR6t0KAAIPmgMq0XAJGMoAIETqR05EED+eAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3863,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":200,"flow_packet_id":3,"flow_last_seen":253025,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":253025,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0oPAAAIAR8ncKAAIPiscQe3AJzwEAILhDR05EED+fAQFUC1FLUlAGUk5BXS\/iNQlw"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3864,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":486,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":253025,"flow_last_seen":253025,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":253025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.68.45.203","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3864,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":486,"flow_packet_id":1,"flow_last_seen":253025,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":253025,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0rssAAIAR+c8KAAIPWEQty3AJGMoAIIOtR05EED+gAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3865,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":156,"flow_packet_id":3,"flow_last_seen":253025,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":253025,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0lsQAAIARXJsKAAIPVvTkVnAJJ5MAIL+nR05EED+hAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3867,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":171,"flow_packet_id":3,"flow_last_seen":253025,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":253025,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0mjsAAIARSyYKAAIPxNmEb3AJYzIAIHYIR05EED+jAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3868,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":176,"flow_packet_id":2,"flow_last_seen":253025,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":253025,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0nFEAAIARxPEKAAIPKWOkBHAJGMoAIDxRR05EED+kAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3869,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":3,"flow_last_seen":253025,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":253025,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0H4IAAIARbHoKAAIPTB5WkHAJ0j0AIK2VR05EED+lAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3870,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":306,"flow_packet_id":3,"flow_last_seen":253026,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":253026,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0J3kAAIARnXAKAAIPKfk\/yHAJWDYAIGCJR05EED+mAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3871,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":213,"flow_packet_id":2,"flow_last_seen":253026,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":253026,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0zQYAAIARHcsKAAIPBbQ+JXAJGMoAIMXcR05EED+nAQFUC1FLUlAGUk5BXS\/iNQlw"} +00861{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3872,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":421,"flow_packet_id":2,"flow_last_seen":253031,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":361,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":361,"pkt_l4_len":327,"thread_ts_msec":253031,"pkt":"CAAn5uVZUlQAEjUCCABFAAFbCjcAAEARjIuvticLCgACDzKxcAkBR\/IfR05EAUOQAQF4nOtpYgx09GAJCV7IpZrkwOGyfps690aj\/QxA5p3OrLWZuntBzCI1zqD5cYdBTJX3i6SN5PeBmLdDuUMfaR4Eq22turko+jhY1F2n0s5iO4h5a4n6y\/LAEyCmVlJxw6LoHWDRtc+SbLwgVrQtD9ojdghshcS2phthxyBWXJ30LQRsRfXZujRPEYjoS61LHaJgw267GYi3yauBmOXf2R59VIUwv032uCMIZt7pV3qY7qcCtpjJTuazhAKIaXtH8+NUMSYQc\/vmqIIaNW2wNr7+t4uiGcBuUJ\/l+kCIEazWYaPpomg+EJNxYUDQBUV5ELOg\/FPeJzkmiHOY7xsYAdWyBa\/fOueLvQKQAfEZkAFxK0gEHAIgEbCfPFiCHHUYGRgYYvUfmRoyMaRIHfn00o+zgB8AlR+GzA=="} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":170,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82060,"flow_last_seen":82060,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"67.193.8.52","src_port":28681,"dst_port":38584,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":170,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82060,"flow_last_seen":82060,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"67.193.8.52","src_port":28681,"dst_port":38584,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":196,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82064,"flow_last_seen":82064,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.127.72.106","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":196,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82064,"flow_last_seen":82064,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.127.72.106","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":220,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":83564,"flow_last_seen":83804,"flow_idle_time":180000,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":138,"flow_avg_l4_payload_len":69,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":9239,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":220,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":83564,"flow_last_seen":83804,"flow_idle_time":180000,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":138,"flow_avg_l4_payload_len":69,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":9239,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":217,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83519,"flow_last_seen":83519,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"126.117.45.151","src_port":28681,"dst_port":19323,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":217,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83519,"flow_last_seen":83519,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"126.117.45.151","src_port":28681,"dst_port":19323,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":155,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82057,"flow_last_seen":82057,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.168.182.103","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":155,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82057,"flow_last_seen":82057,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.168.182.103","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":198,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82064,"flow_last_seen":82064,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.182.171.50","src_port":28681,"dst_port":15180,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":198,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82064,"flow_last_seen":82064,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.182.171.50","src_port":28681,"dst_port":15180,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":192,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.8.59.80","src_port":28681,"dst_port":35192,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":192,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.8.59.80","src_port":28681,"dst_port":35192,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":181,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82061,"flow_last_seen":82061,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.177.5.135","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":181,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82061,"flow_last_seen":82061,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.177.5.135","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":162,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82059,"flow_last_seen":82059,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.123.159.111","src_port":28681,"dst_port":44729,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":162,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82059,"flow_last_seen":82059,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.123.159.111","src_port":28681,"dst_port":44729,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":214,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83518,"flow_last_seen":83518,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.169.215.227","src_port":28681,"dst_port":26820,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":214,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83518,"flow_last_seen":83518,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.169.215.227","src_port":28681,"dst_port":26820,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":193,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.44.126.74","src_port":28681,"dst_port":54633,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":193,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.44.126.74","src_port":28681,"dst_port":54633,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":169,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82060,"flow_last_seen":82060,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.162.52.93","src_port":28681,"dst_port":34799,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":169,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82060,"flow_last_seen":82060,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.162.52.93","src_port":28681,"dst_port":34799,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":206,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82066,"flow_last_seen":82066,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.166.132.204","src_port":28681,"dst_port":11194,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":206,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82066,"flow_last_seen":82066,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.166.132.204","src_port":28681,"dst_port":11194,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":203,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"120.156.204.38","src_port":28681,"dst_port":54832,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":203,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"120.156.204.38","src_port":28681,"dst_port":54832,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":199,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82064,"flow_last_seen":82064,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.73.129.26","src_port":28681,"dst_port":53585,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":199,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82064,"flow_last_seen":82064,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.73.129.26","src_port":28681,"dst_port":53585,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":31,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":61975,"flow_last_seen":149634,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":50193,"dst_port":46010,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00555{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":31,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":61975,"flow_last_seen":149634,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":50193,"dst_port":46010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":207,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82066,"flow_last_seen":82066,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.242.191.215","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":207,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82066,"flow_last_seen":82066,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.242.191.215","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":208,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82066,"flow_last_seen":82066,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.249.64.215","src_port":28681,"dst_port":25058,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":208,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82066,"flow_last_seen":82066,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.249.64.215","src_port":28681,"dst_port":25058,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":212,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83518,"flow_last_seen":83518,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.3.223","src_port":28681,"dst_port":12848,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":212,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83518,"flow_last_seen":83518,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.3.223","src_port":28681,"dst_port":12848,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":197,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82064,"flow_last_seen":82064,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"208.92.106.151","src_port":28681,"dst_port":32476,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":197,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82064,"flow_last_seen":82064,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"208.92.106.151","src_port":28681,"dst_port":32476,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":168,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82059,"flow_last_seen":82059,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.157.59.43","src_port":28681,"dst_port":56919,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":168,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82059,"flow_last_seen":82059,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.157.59.43","src_port":28681,"dst_port":56919,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":61974,"flow_last_seen":149634,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.140.63.147","src_port":50190,"dst_port":29545,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":61974,"flow_last_seen":149634,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.140.63.147","src_port":50190,"dst_port":29545,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":215,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83519,"flow_last_seen":83519,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.159.27.22","src_port":28681,"dst_port":17563,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":215,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83519,"flow_last_seen":83519,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.159.27.22","src_port":28681,"dst_port":17563,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":189,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"115.195.105.243","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":189,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"115.195.105.243","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":30,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":61975,"flow_last_seen":149634,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.65.87.24","src_port":50192,"dst_port":16201,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00555{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":30,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":61975,"flow_last_seen":149634,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.65.87.24","src_port":50192,"dst_port":16201,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":179,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82061,"flow_last_seen":82061,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"178.51.146.115","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":179,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82061,"flow_last_seen":82061,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"178.51.146.115","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":186,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82062,"flow_last_seen":82062,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.182.44.202","src_port":28681,"dst_port":30277,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":186,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82062,"flow_last_seen":82062,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.182.44.202","src_port":28681,"dst_port":30277,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":174,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82060,"flow_last_seen":82060,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"196.74.159.56","src_port":28681,"dst_port":29271,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":174,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82060,"flow_last_seen":82060,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"196.74.159.56","src_port":28681,"dst_port":29271,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":29,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":61974,"flow_last_seen":149634,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"207.38.163.228","src_port":50191,"dst_port":6778,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":29,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":61974,"flow_last_seen":149634,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"207.38.163.228","src_port":50191,"dst_port":6778,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":205,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.29.197.138","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":205,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.29.197.138","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":210,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83517,"flow_last_seen":83517,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.100.120.146","src_port":28681,"dst_port":12838,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":210,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83517,"flow_last_seen":83517,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.100.120.146","src_port":28681,"dst_port":12838,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":218,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83519,"flow_last_seen":83519,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.155.52.115","src_port":28681,"dst_port":53956,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":218,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83519,"flow_last_seen":83519,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.155.52.115","src_port":28681,"dst_port":53956,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":211,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83517,"flow_last_seen":83517,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"186.93.139.92","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":211,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83517,"flow_last_seen":83517,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"186.93.139.92","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":154,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82057,"flow_last_seen":82057,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"174.115.111.224","src_port":28681,"dst_port":51984,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":154,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82057,"flow_last_seen":82057,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"174.115.111.224","src_port":28681,"dst_port":51984,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":201,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.170.209.214","src_port":28681,"dst_port":46210,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":201,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.170.209.214","src_port":28681,"dst_port":46210,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":194,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.150.126.156","src_port":28681,"dst_port":16471,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":194,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82063,"flow_last_seen":82063,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.150.126.156","src_port":28681,"dst_port":16471,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":178,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82061,"flow_last_seen":82061,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.46.253.7","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":178,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82061,"flow_last_seen":82061,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.46.253.7","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":216,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83519,"flow_last_seen":83519,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"212.68.248.153","src_port":28681,"dst_port":27223,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":216,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":83519,"flow_last_seen":83519,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"212.68.248.153","src_port":28681,"dst_port":27223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":204,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.126.240.32","src_port":28681,"dst_port":45313,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":204,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.126.240.32","src_port":28681,"dst_port":45313,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":202,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.134.139.39","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":202,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":82065,"flow_last_seen":82065,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.134.139.39","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":166,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82059,"flow_last_seen":251735,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.59.253.186","src_port":28681,"dst_port":15555,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":183,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82062,"flow_last_seen":251737,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.172.15.182","src_port":28681,"dst_port":37829,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":184,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":191703,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.239.62.213","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":195,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82063,"flow_last_seen":253025,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"177.231.151.16","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":219,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":83520,"flow_last_seen":253025,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.30.86.144","src_port":28681,"dst_port":53821,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":191,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82063,"flow_last_seen":251735,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.153.143.54","src_port":28681,"dst_port":65535,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":172,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82060,"flow_last_seen":253024,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.69.142.133","src_port":28681,"dst_port":15471,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":242,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":88941,"flow_last_seen":179376,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":511,"flow_avg_l4_payload_len":63,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":28681,"dst_port":52367,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":300,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":90809,"flow_last_seen":139723,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1817,"flow_avg_l4_payload_len":227,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":187,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":191700,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.88.92.56","src_port":28681,"dst_port":21009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":190,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82063,"flow_last_seen":251737,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.195.227","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":173,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82060,"flow_last_seen":192907,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"121.99.222.36","src_port":28681,"dst_port":44988,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":180,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82061,"flow_last_seen":132833,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.131.24.72","src_port":28681,"dst_port":30711,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":156,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82057,"flow_last_seen":253025,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.244.228.86","src_port":28681,"dst_port":10131,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00561{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":176,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82061,"flow_last_seen":253025,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.99.164.4","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":164,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131671,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.197.219.85","src_port":28681,"dst_port":26234,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":157,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82058,"flow_last_seen":251736,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.227.162.150","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":209,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82066,"flow_last_seen":253024,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.179.98.234","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":159,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82058,"flow_last_seen":191704,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.163.231.160","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00561{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":213,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":83518,"flow_last_seen":253026,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"5.180.62.37","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":167,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":132832,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.29.107.176","src_port":28681,"dst_port":20363,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":171,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82060,"flow_last_seen":253025,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"196.217.132.111","src_port":28681,"dst_port":25394,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":160,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82058,"flow_last_seen":191703,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.150.49.35","src_port":28681,"dst_port":32448,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":185,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":251737,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.196.58","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":165,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131670,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.75.43.182","src_port":28681,"dst_port":43502,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":161,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82058,"flow_last_seen":191703,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.120.26.86","src_port":28681,"dst_port":29946,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":188,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":131669,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.134.107.32","src_port":28681,"dst_port":38836,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":177,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82061,"flow_last_seen":132833,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.157.183.106","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":175,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82060,"flow_last_seen":253024,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"115.69.62.99","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":182,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":131672,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.3.103.37","src_port":28681,"dst_port":35589,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":200,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82064,"flow_last_seen":253025,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"138.199.16.123","src_port":28681,"dst_port":52993,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":163,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131673,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.126.160.158","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":3962,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":158,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82058,"flow_last_seen":251738,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":261823,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.166.226.70","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3982,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":487,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":264769,"flow_last_seen":264769,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":264769,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.78.134.188","src_port":28681,"dst_port":49046,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3982,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":487,"flow_packet_id":1,"flow_last_seen":264769,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":264769,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gnUAAIARDSsKAAIPGE6GvHAJv5YAIMPdR05EED+oAQFUC1FLUlAGUk5BXS\/iNQlw"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3983,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":488,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":264769,"flow_last_seen":264769,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":264769,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.90.112","src_port":28681,"dst_port":9852,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3983,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":488,"flow_packet_id":1,"flow_last_seen":264769,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":264769,"pkt":"UlQAEjUCCAAn5uVZCABFAABp4pAAAIAROcEKAAIPt7NacHAJJnwAVd0aR05EED+pAQFMQVEyUApVRFBdL+I1CXCJt7jZSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3984,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":489,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":264770,"flow_last_seen":264770,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":264770,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"108.44.45.25","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3984,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":489,"flow_packet_id":1,"flow_last_seen":264770,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":264770,"pkt":"UlQAEjUCCAAn5uVZCABFAABpkz4AAIARAfIKAAIPbCwtGXAJGMoAVdqpR05EED+qAQFMQVEyUApVRFBdL+I1CXAI8TopSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3985,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":490,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":264770,"flow_last_seen":264770,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":264770,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.3.215.132","src_port":28681,"dst_port":20356,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3985,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":490,"flow_packet_id":1,"flow_last_seen":264770,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":264770,"pkt":"UlQAEjUCCAAn5uVZCABFAABpirEAAIARcjwKAAIPWgPXhHAJT4QAVQgYR05EED+rAQFMQVEyUApVRFBdL+I1CXAxwKVdSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3986,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":491,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":264771,"flow_last_seen":264771,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":264771,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.42.210","src_port":28681,"dst_port":5512,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3986,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":491,"flow_packet_id":1,"flow_last_seen":264771,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":264771,"pkt":"UlQAEjUCCAAn5uVZCABFAABpGyoAAIARw5AKAAIPJOkq0nAJFYgAVWvGR05EED+sAQFMQVEyUApVRFBdL+I1CXAmCcrMSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3987,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":492,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":264771,"flow_last_seen":264771,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":264771,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"172.94.41.71","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3987,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":492,"flow_packet_id":1,"flow_last_seen":264771,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":264771,"pkt":"UlQAEjUCCAAn5uVZCABFAABpgtwAAIAR1fMKAAIPrF4pR3AJGMoAVRJfR05EED+tAQFMQVEyUApVRFBdL+I1CXB2YrRDSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00840{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3996,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":488,"flow_packet_id":2,"flow_last_seen":265025,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":343,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":343,"pkt_l4_len":309,"thread_ts_msec":265025,"pkt":"CAAn5uVZUlQAEjUCCABFAAFJCocAAEARUOu3s1pwCgACDyZ8cAkBNf6\/R05EAdfTAQF4nOvJYQx09GAJCd7JpZrkwOGyfXNUQY2aNgOQqcVkJ\/NZQgHELP822eOOoBqIeWuJ+svywBMg5m03A\/E2ebCoyvurk76F7AMxiyS2Nd0IOwZWu\/ZZko3XfhDzTtvyoD1ih8DM1qqbi6KPg5jrt6lzbzQ6ABbtzFqbqbsXbHFSccOi6B0gZvXZujRPkaMQKxZJG8mDrbjtrlNpZ7EdzAzlDn2keRDsSL7+t4uiGcBuUJ\/l+kCIEcS0ddhouiiaH8y8o\/lxqhgTiHlqur31CVlBEJNxYUDQBUV5ELOg\/FPeJzmwApWXzPcNjBghTK1LHaJAH7MFF6lxBs2PAzIgrgUyIOGFzID4yYMlyFGHkYGBIVb\/kakhE0OK1JFPL\/04C\/gBLLx7vA=="} +00837{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3999,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":491,"flow_packet_id":2,"flow_last_seen":265818,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":345,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":345,"pkt_l4_len":311,"thread_ts_msec":265818,"pkt":"CAAn5uVZUlQAEjUCCABFAAFLCokAAEARE1Ak6SrSCgACDxWIcAkBNyevR05EASbRAQF4nOtJZAx09GAJCV7HpZrkwOGi8lLrUofoCQYg83Yod+gjzYNgprtOpZ3FdhDzTmfW2kzdvWBma9XNRdHHwcy25UF7xA6BmEVqnEHz4w6DmLfWPkuy8doPYqq8vzrpW8g+EPP0Pb5VKtHHIKKLpI3kwaK3lqi\/LA8EW7x+mzr3RqMDIGb5t8kedwTVQEytpOKGRdE7QMzqs3VpniJgE267GYi3yauCmAXln\/I+yTGCTdg654u9ghKIaeuw0XRRNB\/Ykf1KD9P9VMCGMdnJfJaQB7tXYlvTjTCwYaem21ufkBUEMbdvjiqoUdNmcGALLv\/O9uijKpABCRCQCF\/\/20XRQAbETUAGxGgPliBHHUYGBoZY\/UemhkwMKVJHPr304yzgBwBT3ny5"} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":320,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.236.200.137","src_port":28681,"dst_port":48142,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":320,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95893,"flow_last_seen":95893,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.236.200.137","src_port":28681,"dst_port":48142,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":325,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.160.143.48","src_port":28681,"dst_port":37036,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":325,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":96049,"flow_last_seen":96049,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.160.143.48","src_port":28681,"dst_port":37036,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":305,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":93713,"flow_last_seen":93713,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.168.175.31","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":305,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":93713,"flow_last_seen":93713,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.168.175.31","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":323,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":56070,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":323,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":56070,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":322,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.219","src_port":28681,"dst_port":6909,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":322,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95923,"flow_last_seen":95923,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.219","src_port":28681,"dst_port":6909,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":314,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95754,"flow_last_seen":95754,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.237.202.91","src_port":28681,"dst_port":16117,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":314,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":95754,"flow_last_seen":95754,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.237.202.91","src_port":28681,"dst_port":16117,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":89829,"flow_last_seen":174528,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3570,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.84.178.16","src_port":28681,"dst_port":60262,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_state":"info","flow_packets_processed":12,"flow_first_seen":95264,"flow_last_seen":176255,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.220.186.140","src_port":28681,"dst_port":27641,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90005,"flow_last_seen":243646,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4494,"flow_avg_l4_payload_len":321,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":28681,"dst_port":24562,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90072,"flow_last_seen":163183,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.26.216.95","src_port":28681,"dst_port":13889,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":95754,"flow_last_seen":139756,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.217.84.16","src_port":28681,"dst_port":20223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_state":"info","flow_packets_processed":12,"flow_first_seen":95443,"flow_last_seen":176562,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.240.69.199","src_port":28681,"dst_port":6348,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":306,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":93714,"flow_last_seen":253026,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.249.63.200","src_port":28681,"dst_port":22582,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":90184,"flow_last_seen":180130,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3575,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":1194,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":304,"flow_state":"info","flow_packets_processed":18,"flow_first_seen":90880,"flow_last_seen":251799,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5105,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.32.126.214","src_port":28681,"dst_port":59596,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":95784,"flow_last_seen":139896,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.183.183.110","src_port":28681,"dst_port":59920,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":90073,"flow_last_seen":174761,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3575,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":95715,"flow_last_seen":139730,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2424,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.188.98","src_port":28681,"dst_port":62851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":95264,"flow_last_seen":179735,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":40137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":89967,"flow_last_seen":152618,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.203.218.92","src_port":28681,"dst_port":56962,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90072,"flow_last_seen":180633,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5191,"flow_avg_l4_payload_len":370,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":28681,"dst_port":43508,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_state":"info","flow_packets_processed":12,"flow_first_seen":89966,"flow_last_seen":180691,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":26253,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90039,"flow_last_seen":163151,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":50297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":89966,"flow_last_seen":152619,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.218","src_port":28681,"dst_port":6909,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90039,"flow_last_seen":163151,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":28681,"dst_port":36368,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":96049,"flow_last_seen":129345,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.28.53.225","src_port":28681,"dst_port":44859,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":95923,"flow_last_seen":139892,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.250.179.237","src_port":28681,"dst_port":20848,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":303,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90871,"flow_last_seen":251762,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1247,"flow_avg_l4_payload_len":207,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":28681,"dst_port":30566,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00568{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":89829,"flow_last_seen":174144,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3570,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":28681,"dst_port":35481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00568{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":301,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90845,"flow_last_seen":174321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1001,"flow_avg_l4_payload_len":166,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":28681,"dst_port":11852,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":95784,"flow_last_seen":139889,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2424,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.236.205.7","src_port":28681,"dst_port":34794,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_state":"info","flow_packets_processed":12,"flow_first_seen":90138,"flow_last_seen":252085,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3710,"flow_avg_l4_payload_len":309,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":28681,"dst_port":21301,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":243,"flow_state":"info","flow_packets_processed":19,"flow_first_seen":89016,"flow_last_seen":176659,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4777,"flow_avg_l4_payload_len":251,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":95716,"flow_last_seen":139781,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00568{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90864,"flow_last_seen":124089,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":943,"flow_avg_l4_payload_len":235,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":53489,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00568{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":95893,"flow_last_seen":123936,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":55302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90039,"flow_last_seen":180164,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5191,"flow_avg_l4_payload_len":370,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":30577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":89829,"flow_last_seen":152619,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":12012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":96049,"flow_last_seen":129345,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.1.231.138","src_port":28681,"dst_port":56558,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90138,"flow_last_seen":174723,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.217.176.52","src_port":28681,"dst_port":7446,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90005,"flow_last_seen":180322,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5191,"flow_avg_l4_payload_len":370,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":28681,"dst_port":61616,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90004,"flow_last_seen":163118,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.140.120.41","src_port":28681,"dst_port":47739,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":95784,"flow_last_seen":146329,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2424,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":63637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":90138,"flow_last_seen":174930,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3575,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":28681,"dst_port":46010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90183,"flow_last_seen":174679,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":28681,"dst_port":11603,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":95716,"flow_last_seen":243760,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":155,"flow_avg_l4_payload_len":51,"midstream":0,"thread_ts_msec":272055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.167.201.53","src_port":28681,"dst_port":47282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4128,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":493,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":280014,"flow_last_seen":280014,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":280014,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57552,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4128,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":493,"flow_packet_id":1,"flow_last_seen":280014,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":280014,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LMAAAER3GYKAAIP7\/\/\/+uDQB2wAtgxeTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4128,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":493,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":280014,"flow_last_seen":280014,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":280014,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57552,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4138,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":493,"flow_packet_id":2,"flow_last_seen":281023,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":281023,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LQAAAER3GUKAAIP7\/\/\/+uDQB2wAtgxeTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4148,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":493,"flow_packet_id":3,"flow_last_seen":282039,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":282039,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LUAAAER3GQKAAIP7\/\/\/+uDQB2wAtgxeTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":329,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":101122,"flow_last_seen":134428,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.117.249.98","src_port":28681,"dst_port":6815,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":328,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":101122,"flow_last_seen":134428,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.105.27","src_port":28681,"dst_port":19260,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":101162,"flow_last_seen":177309,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3570,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":26851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":95216,"flow_last_seen":162802,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.201.208.57","src_port":28681,"dst_port":38617,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":101837,"flow_last_seen":251767,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":190,"flow_avg_l4_payload_len":63,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":95893,"flow_last_seen":251793,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1751,"flow_avg_l4_payload_len":291,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":21995,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4158,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":101122,"flow_last_seen":168840,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2737,"flow_avg_l4_payload_len":342,"midstream":0,"thread_ts_msec":282200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.64.44.11","src_port":28681,"dst_port":1352,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4200,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":494,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287308,"flow_last_seen":287308,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287308,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.210.81.59","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4200,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":494,"flow_packet_id":1,"flow_last_seen":287308,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287308,"pkt":"UlQAEjUCCAAn5uVZCABFAABpuTwAAIARzSsKAAIPVtJRO3AJGMoAVf5iR05EED+uAQFMQVEyUApVRFBdL+I1CXBbSWKeSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4201,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":495,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287308,"flow_last_seen":287308,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287308,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.247.89.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4201,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":495,"flow_packet_id":1,"flow_last_seen":287308,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287308,"pkt":"UlQAEjUCCAAn5uVZCABFAABpBO4AAIARfnwKAAIPUfdZFHAJGMoAVSV2R05EED+vAQFMQVEyUApVRFBdL+I1CXBK2WDkSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4202,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":496,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287309,"flow_last_seen":287309,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287309,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.173.230.98","src_port":28681,"dst_port":19004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4202,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":496,"flow_packet_id":1,"flow_last_seen":287309,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287309,"pkt":"UlQAEjUCCAAn5uVZCABFAABpS4QAAIARIeEKAAIP2q3mYnAJSjwAVZ4oR05EED+wAQFMQVEyUApVRFBdL+I1CXD1PIvASAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4203,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":497,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287309,"flow_last_seen":287309,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287309,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.100.76.123","src_port":28681,"dst_port":39628,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4203,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":497,"flow_packet_id":1,"flow_last_seen":287309,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287309,"pkt":"UlQAEjUCCAAn5uVZCABFAABpHlMAAIARb0MKAAIPVGRMe3AJmswAVei0R05EED+xAQFMQVEyUApVRFBdL+I1CXAo12urSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":498,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287310,"flow_last_seen":287310,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287310,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"8.44.149.207","src_port":28681,"dst_port":30551,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":498,"flow_packet_id":1,"flow_last_seen":287310,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287310,"pkt":"UlQAEjUCCAAn5uVZCABFAABp7AUAAIARpHQKAAIPCCyVz3AJd1cAVT1hR05EED+yAQFMQVEyUApVRFBdL+I1CXDbuWSaSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4205,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":499,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287310,"flow_last_seen":287310,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287310,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.161.80.82","src_port":28681,"dst_port":8656,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4205,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":499,"flow_packet_id":1,"flow_last_seen":287310,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287310,"pkt":"UlQAEjUCCAAn5uVZCABFAABpPEAAAIARoEIKAAIPAaFQUnAJIdAAVf09R05EED+zAQFMQVEyUApVRFBdL+I1CXCAEXIkSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4206,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":500,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287310,"flow_last_seen":287310,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287310,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.143.34.225","src_port":28681,"dst_port":20071,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4206,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":500,"flow_packet_id":1,"flow_last_seen":287310,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287310,"pkt":"UlQAEjUCCAAn5uVZCABFAABpHKcAAIAREl4KAAIP3I8i4XAJTmcAVVqAR05EED+0AQFMQVEyUApVRFBdL+I1CXCHDBLySAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4207,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":501,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287310,"flow_last_seen":287310,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":287310,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.160.214.137","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4207,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":501,"flow_packet_id":1,"flow_last_seen":287310,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":287310,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0gncAAIARfQkKAAIPWKDWiXAJGMoAINp9R05EED+1AQFUC1FLUlAGUk5BXS\/iNQlw"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4208,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":502,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287311,"flow_last_seen":287311,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287311,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.156.58.211","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4208,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":502,"flow_packet_id":1,"flow_last_seen":287311,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287311,"pkt":"UlQAEjUCCAAn5uVZCABFAABpU7QAAIARcFIKAAIPL5w603AJGMoAVfKmR05EED+2AQFMQVEyUApVRFBdL+I1CXAIdAe9SAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4209,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":503,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287311,"flow_last_seen":287311,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":287311,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.210.244.72","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4209,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":503,"flow_packet_id":1,"flow_last_seen":287311,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":287311,"pkt":"UlQAEjUCCAAn5uVZCABFAAA022kAAIARFCYKAAIPStL0SHAJGMoAIMqKR05EED+3AQFUC1FLUlAGUk5BXS\/iNQlw"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4210,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":504,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287311,"flow_last_seen":287311,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287311,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.203.45.107","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4210,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":504,"flow_packet_id":1,"flow_last_seen":287311,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287311,"pkt":"UlQAEjUCCAAn5uVZCABFAABpqvYAAIARAEkKAAIPVcsta3AJGMoAVcw9R05EED+4AQFMQVEyUApVRFBdL+I1CXBb6lRUSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00558{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4211,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":505,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287312,"flow_last_seen":287312,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287312,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.2.62.28","src_port":28681,"dst_port":6387,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4211,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":505,"flow_packet_id":1,"flow_last_seen":287312,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287312,"pkt":"UlQAEjUCCAAn5uVZCABFAABpRQoAAIARgU0KAAIPKgI+HHAJGPMAVW5BR05EED+5AQFMQVEyUApVRFBdL+I1CXAtSm1tSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4212,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":506,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287312,"flow_last_seen":287312,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287312,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"136.32.84.139","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00530{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4212,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":506,"flow_packet_id":1,"flow_last_seen":287312,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287312,"pkt":"UlQAEjUCCAAn5uVZCABFAABpUpMAAIAR\/zYKAAIPiCBUi3AJGMoAVZzZR05EED+6AQFMQVEyUApVRFBdL+I1CXAH+JUcSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4213,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":507,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287312,"flow_last_seen":287312,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287312,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.4.204.220","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4213,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":507,"flow_packet_id":1,"flow_last_seen":287312,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287312,"pkt":"UlQAEjUCCAAn5uVZCABFAABpbgEAAIARwZMKAAIPMgTM3HAJGMoAVXirR05EED+7AQFMQVEyUApVRFBdL+I1CXD7jJmJSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4214,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":508,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287312,"flow_last_seen":287312,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287312,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.144.99.73","src_port":28681,"dst_port":10745,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4214,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":508,"flow_packet_id":1,"flow_last_seen":287312,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287312,"pkt":"UlQAEjUCCAAn5uVZCABFAABpGF4AAIARVj4KAAIPXJBjSXAJKfkAVVAmR05EED+8AQFMQVEyUApVRFBdL+I1CXDZtxe1SAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4215,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":509,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287313,"flow_last_seen":287313,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287313,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.142.109.190","src_port":28681,"dst_port":41370,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4215,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":509,"flow_packet_id":1,"flow_last_seen":287313,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287313,"pkt":"UlQAEjUCCAAn5uVZCABFAABpV3kAAIARDLAKAAIPXI5tvnAJoZoAVQupR05EED+9AQFMQVEyUApVRFBdL+I1CXA3XiHRSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4219,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":510,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287314,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"79.94.85.113","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00529{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4219,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":510,"flow_packet_id":1,"flow_last_seen":287314,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287314,"pkt":"UlQAEjUCCAAn5uVZCABFAABpnB4AAIAR7YcKAAIPT15VcXAJGMoAVSitR05EED++AQFMQVEyUApVRFBdL+I1CXC2+OrHSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4220,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":511,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287314,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.47.223.27","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00532{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4220,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":511,"flow_packet_id":1,"flow_last_seen":287314,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287314,"pkt":"UlQAEjUCCAAn5uVZCABFAABpmn8AAIARcKsKAAIPRC\/fG3AJGMoAVbg\/R05EED+\/AQFMQVEyUApVRFBdL+I1CXCJygjoSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4221,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":512,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287314,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"209.204.207.5","src_port":28681,"dst_port":49256,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00530{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4221,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":512,"flow_packet_id":1,"flow_last_seen":287314,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287314,"pkt":"UlQAEjUCCAAn5uVZCABFAABpsMgAAIAR3NoKAAIP0czPBXAJwGgAVVmNR05EED\/AAQFMQVEyUApVRFBdL+I1CXDFlVhWSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4222,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":513,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287314,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.196.216.12","src_port":28681,"dst_port":58910,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00530{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4222,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":513,"flow_packet_id":1,"flow_last_seen":287314,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287314,"pkt":"UlQAEjUCCAAn5uVZCABFAABph8IAAIARf+IKAAIPTsTYDHAJ5h4AVWPLR05EED\/BAQFMQVEyUApVRFBdL+I1CXDwiDmtSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4223,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":514,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287314,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.114.40.175","src_port":28681,"dst_port":23552,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00530{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4223,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":514,"flow_packet_id":1,"flow_last_seen":287314,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287314,"pkt":"UlQAEjUCCAAn5uVZCABFAABpvHwAAIAR9dcKAAIPU3Ior3AJXAAAVSFCR05EED\/CAQFMQVEyUApVRFBdL+I1CXAlJFuJSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4224,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":515,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287315,"flow_last_seen":287315,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287315,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.137.106.173","src_port":28681,"dst_port":11625,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00530{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4224,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":515,"flow_packet_id":1,"flow_last_seen":287315,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287315,"pkt":"UlQAEjUCCAAn5uVZCABFAABp2kQAAIARDPoKAAIP3IlqrXAJLWkAVTFkR05EED\/DAQFMQVEyUApVRFBdL+I1CXDPsw9NSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4225,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":516,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287315,"flow_last_seen":287315,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287315,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.246.147.72","src_port":28681,"dst_port":4572,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00531{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4225,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":516,"flow_packet_id":1,"flow_last_seen":287315,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287315,"pkt":"UlQAEjUCCAAn5uVZCABFAABpRHMAAIAR3sMKAAIPd\/aTSHAJEdwAVb+qR05EED\/EAQFMQVEyUApVRFBdL+I1CXCNl48ySAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4226,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":517,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287315,"flow_last_seen":287315,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287315,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.239.162.27","src_port":28681,"dst_port":7986,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00530{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4226,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":517,"flow_packet_id":1,"flow_last_seen":287315,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287315,"pkt":"UlQAEjUCCAAn5uVZCABFAABpwVIAAIARphgKAAIPJO+iG3AJHzIAVfUVR05EED\/FAQFMQVEyUApVRFBdL+I1CXD7uZMRSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4227,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":518,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287316,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":287316,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"202.151.63.59","src_port":28681,"dst_port":7624,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00458{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4227,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":518,"flow_packet_id":1,"flow_last_seen":287316,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":287316,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0odEAAIARgwYKAAIPypc\/O3AJHcgAIPrFR05EED\/GAQFUC1FLUlAGUk5BXS\/iNQlw"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4228,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":519,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287316,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":287316,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.48.23","src_port":28681,"dst_port":8070,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00530{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4228,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":519,"flow_packet_id":1,"flow_last_seen":287316,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"thread_ts_msec":287316,"pkt":"UlQAEjUCCAAn5uVZCABFAABp+G8AAIARKqgKAAIP20YwF3AJH4YAVfd3R05EED\/HAQFMQVEyUApVRFBdL+I1CXBhgiICSAlETnBpbmtmbG95ZEANSVVSTABQRlMARE4AQQAQTkFUAF0v4jUxAgBkGsTy6U4JcA8="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4229,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":441,"flow_packet_id":2,"flow_last_seen":287316,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287316,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Im8AAIARH94KAAIPJO3HbHAJ2ugAJBUGCNsxAuNxtNL\/CPfpN9LYAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4230,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":442,"flow_packet_id":2,"flow_last_seen":287316,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287316,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4rcIAAIARpOAKAAIPWcyCN3AJc2kAJDj2y8wxAiUpPSv\/Rrn8E2YBAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4232,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":443,"flow_packet_id":2,"flow_last_seen":287316,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287316,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4fpkAAIAR6joKAAIPt7MOH3AJ1eIAJOcKixsxAltvZJ3\/J+9VnMcrAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4233,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":444,"flow_packet_id":2,"flow_last_seen":287316,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287316,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4UCsAAIAR\/7cKAAIPenVkTnAJIzIAJATWADExAo7g1xX\/UsMoS78JAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4234,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":445,"flow_packet_id":2,"flow_last_seen":287316,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287316,"pkt":"UlQAEjUCCAAn5uVZCABFAAA46o4AAIARNA4KAAIPdqWZZHAJEZ0AJCmBxQgxAlSYrBT\/uwKjn\/DRAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4235,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":446,"flow_packet_id":2,"flow_last_seen":287316,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287316,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4X0IAAIARyrIKAAIPPUbHa3AJ7DsAJP\/PWsoxAkpdiLT\/eHh5GKHVAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4236,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":447,"flow_packet_id":3,"flow_last_seen":287316,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287316,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4SFYAAIARzU0KAAIPDscKPHAJW6IAJMUGRhsxArXtV+j\/H5+HjujJAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4237,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":448,"flow_packet_id":3,"flow_last_seen":287316,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287316,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4bmgAAIARqKoKAAIPdPGionAJPT0AJMviUBoxApd4Sjn\/cxgKEDAKAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4238,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":449,"flow_packet_id":2,"flow_last_seen":287317,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287317,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4GZwAAIARKZwKAAIPPe6tgHAJInoAJHWtl0wxAv6kAWL\/+\/CCocTXAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4239,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":450,"flow_packet_id":3,"flow_last_seen":287317,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287317,"pkt":"UlQAEjUCCAAn5uVZCABFAAA42YQAAIARFCcKAAIPcfzO\/nAJW6IAJAEE3wgxAgOmdSH\/0H4gecqXAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4240,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":451,"flow_packet_id":2,"flow_last_seen":287317,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287317,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4cGUAAIARoggKAAIP2iNCFXAJVtoAJF3i06MxAkIsdXj\/wUuQqp0yAwABAAUAAADDglFLQA=="} +00506{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4241,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":452,"flow_packet_id":3,"flow_last_seen":287317,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":102,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":102,"pkt_l4_len":68,"thread_ts_msec":287317,"pkt":"UlQAEjUCCAAn5uVZCABFAABY5ucAAIARQZYKAAIPROPBJXAJa1kARADZXS\/iNTECAGQaxPLpTglwD4ABACUAAAD5AHBpbmtmbG95ZADDAlFLSGg6Sm0MntUwA1NDUEABWkCCUFJA"} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4242,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":453,"flow_packet_id":2,"flow_last_seen":287317,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287317,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4vI8AAIARDQ4KAAIPSn8ainAJDAsAJKkhpdsxAs5hlqj\/iZ3V6LHZAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4243,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":454,"flow_packet_id":2,"flow_last_seen":287317,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287317,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4KvoAAIARqv8KAAIP3xB5nHAJWo8AJEDZm7AxAoxJqrn\/wqtsKTTpAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4244,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":455,"flow_packet_id":2,"flow_last_seen":287317,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287317,"pkt":"UlQAEjUCCAAn5uVZCABFAAA40tMAAIARUoIKAAIPOpnOt3AJQhcAJN+66b0xAqIxzuP\/eMZTcmrGAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4245,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":456,"flow_packet_id":2,"flow_last_seen":287317,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287317,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4YccAAIARAe8KAAIPWfFw\/3AJOa4AJPFp5YYxAoCOosj\/OHa29lcZAwABAAUAAADDglFLQA=="} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4246,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":457,"flow_packet_id":2,"flow_last_seen":287317,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287317,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4GGMAAIARrdoKAAIPd\/fwcXAJNisAJFAjk80xAmTFCx3\/jN719EK\/AwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4247,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":458,"flow_packet_id":2,"flow_last_seen":287317,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287317,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ZxUAAIARbEQKAAIPdqXkp3AJL6kAJGlj2\/MxAtwqPKX\/71GqEHY5AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4248,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":459,"flow_packet_id":2,"flow_last_seen":287318,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287318,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ylIAAIARq78KAAIPZFlUO3AJLVMAJBXHh8kxAm1Oslb\/QMgGyMhRAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4249,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":460,"flow_packet_id":2,"flow_last_seen":287318,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287318,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4uwQAAIARLJEKAAIP0sJ0TnAJIJYAJLLagd0xArmk2G\/\/xTH5mvqJAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4250,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":461,"flow_packet_id":2,"flow_last_seen":287318,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287318,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4hLQAAIARo1oKAAIPRRvBfHAJxXsAJMI2LHsxAo52edn\/cV3gW8YIAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4251,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":462,"flow_packet_id":2,"flow_last_seen":287318,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287318,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ptkAAIAR2S8KAAIPpIQKGXAJusAAJPOPnwwxAuhpszn\/cR802ujzAwABAAUAAADDglFLQA=="} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4255,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":463,"flow_packet_id":3,"flow_last_seen":287318,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287318,"pkt":"UlQAEjUCCAAn5uVZCABFAABURtIAAIARg94KAAIPyAeb0nAJbs0AQJQnXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRAKWnVwDU0NQQAFaQIJQUkA="} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4256,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":464,"flow_packet_id":3,"flow_last_seen":287318,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287318,"pkt":"UlQAEjUCCAAn5uVZCABFAABUkW0AAIAR9ZQKAAIPZYBCCHAJhtAAQOOyXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRKw9SHgDU0NQQAFaQIJQUkA="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4257,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":375,"flow_packet_id":2,"flow_last_seen":287318,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287318,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4xOoAAIARl9sKAAIPSbaIKnAJbOEAJGVz\/TgxAtC18iv\/B0QKGcvDAwABAAUAAADDglFLQA=="} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4258,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":469,"flow_packet_id":2,"flow_last_seen":287319,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287319,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4oEgAAIAR\/\/gKAAIPV3s26nAJuFAAJOQD+0UxAlzzAQH\/3gGOO8zDAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4259,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":470,"flow_packet_id":2,"flow_last_seen":287319,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287319,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4OJIAAIAR8asKAAIPubtKrXAJtsYAJICyRAkxAn4Pojr\/8sfkhyCVAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4260,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":471,"flow_packet_id":2,"flow_last_seen":287319,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287319,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Ix8AAIARvr8KAAIPUAf8wHAJqcEAJCASvQIxAv8J\/1H\/l2fXMsQYAwABAAUAAADDglFLQA=="} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4261,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":472,"flow_packet_id":2,"flow_last_seen":287319,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287319,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4MiwAAIARW\/IKAAIPXjZCUnAJsrAAJH\/enf4xAspae1f\/gGVTXZELAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4262,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":473,"flow_packet_id":2,"flow_last_seen":287319,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287319,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4xloAAIARNLoKAAIPjoSlDXAJgxwAJCxpUnUxAg7ggD\/\/NxJBmwgTAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4263,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":474,"flow_packet_id":2,"flow_last_seen":287319,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287319,"pkt":"UlQAEjUCCAAn5uVZCABFAAA47YAAAIAREvIKAAIPUD3d9nAJszgAJJKKy3MxAqI8tTf\/6XjLO5k5AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4264,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":475,"flow_packet_id":2,"flow_last_seen":287319,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287319,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4c2YAAIARyksKAAIPvD00t3AJ+eoAJOFJ3TAxAvqZaMH\/CFwIoWZ7AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4265,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":476,"flow_packet_id":2,"flow_last_seen":287319,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287319,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4A+IAAIARG+IKAAIPYhKs0HAJ9sQAJLcF39oxApYy4An\/uei2afgfAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4266,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":477,"flow_packet_id":2,"flow_last_seen":287319,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287319,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Mi0AAIARW\/EKAAIPXjZCUnAJskgAJJb7jfoxAhLEsBf\/rFBqRHO1AwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4267,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":478,"flow_packet_id":2,"flow_last_seen":287319,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287319,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4yu8AAIAR6Z8KAAIPJOtVLHAJ\/ZIAJFovBtwxApDJjOL\/Wd1Q5CDNAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4268,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":479,"flow_packet_id":2,"flow_last_seen":287320,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287320,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4N\/cAAIARbU4KAAIPe80NlHAJyrgAJFaA+QgxAqWZcSn\/gAzxJ1WWAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4269,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":480,"flow_packet_id":2,"flow_last_seen":287320,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287320,"pkt":"UlQAEjUCCAAn5uVZCABFAAA49tkAAIARfTsKAAIPcHdKGnAJ\/9oAJKN+5Y0xAj3dEGP\/53450VKjAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4270,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":520,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287320,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3339,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4270,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":520,"flow_packet_id":1,"flow_last_seen":287320,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287320,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ZdwAAIARkUoKAAIPtpuA5HAJDQsAJHV3JlgxAgeKfgb\/QAl\/goKTAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4271,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":521,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287320,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.250.32","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4271,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":521,"flow_packet_id":1,"flow_last_seen":287320,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287320,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4bsgAAIARU74KAAIPcf\/6IHAJW6IAJL21FLcxAmZpmf7\/pKzAzzBuAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4272,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":522,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287320,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.247.152.218","src_port":28681,"dst_port":51153,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4272,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":522,"flow_packet_id":1,"flow_last_seen":287320,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287320,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4bf4AAIARr9YKAAIPd\/eY2nAJx9EAJOOUIhMxApXGjpb\/GcsIrWIKAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4273,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":523,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287320,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.162.138.200","src_port":28681,"dst_port":24018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4273,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":523,"flow_packet_id":1,"flow_last_seen":287320,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287320,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4mI4AAIARCa4KAAIPAaKKyHAJXdIAJF+MUgcxArifvu7\/9NP8y9zRAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4274,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":524,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287320,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.193.171.146","src_port":28681,"dst_port":65362,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4274,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":524,"flow_packet_id":1,"flow_last_seen":287320,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287320,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4FToAAIARHRkKAAIPUMGrknAJ\/1IAJOZtMlwxAkiam+P\/4wXYHYNoAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4275,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":525,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287320,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.250.32","src_port":28681,"dst_port":52660,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4275,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":525,"flow_packet_id":1,"flow_last_seen":287320,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287320,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4bskAAIARU70KAAIPcf\/6IHAJzbQAJPX5Jo8xAmQqTHT\/pEmGswWBAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4276,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":526,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287321,"flow_last_seen":287321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287321,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.234.197.93","src_port":28681,"dst_port":1483,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4276,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":526,"flow_packet_id":1,"flow_last_seen":287321,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287321,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4UicAAIAR8jcKAAIPJOrFXXAJBcsAJDoZy6YxAjmiqQ7\/kfoEHxOTAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4277,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":527,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287321,"flow_last_seen":287321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287321,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.72.149.140","src_port":28681,"dst_port":37848,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4277,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":527,"flow_packet_id":1,"flow_last_seen":287321,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287321,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4C+4AAIARYuQKAAIPKkiVjHAJk9gAJK037dExAhQrbKv\/kLap5mV4AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4278,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_packet_id":3,"flow_last_seen":287321,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287321,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4pCAAAIAR7A0KAAIPJo536nAJwkQAJPFMfDIxAtiImQH\/jzzGhRCDAwABAAUAAADDglFLQA=="} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4279,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":339,"flow_packet_id":2,"flow_last_seen":287321,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287321,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4oEkAAIAR\/\/cKAAIPV3s26nAJ03IAJOC14ycxAiOIr1z\/1O0xo4v7AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4283,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":528,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287338,"flow_last_seen":287338,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287338,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":58442,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4283,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":528,"flow_packet_id":1,"flow_last_seen":287338,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287338,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4TFQAAIARXGMKAAIPdqgPR3AJ5EoAJFZzCp8xAhldo7D\/nouh\/5JxAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4284,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":529,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287338,"flow_last_seen":287338,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287338,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":28681,"dst_port":57929,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4284,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":529,"flow_packet_id":1,"flow_last_seen":287338,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287338,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4bmkAAIARqKkKAAIPdPGionAJ4kkAJLPAGLkxAkLutwr\/plPVYmEOAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4285,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":530,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287339,"flow_last_seen":287339,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287339,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.167.248.220","src_port":28681,"dst_port":59304,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4285,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":530,"flow_packet_id":1,"flow_last_seen":287339,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287339,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4R08AAIARd9MKAAIPdqf43HAJ56gAJAC0RuIxAloizj3\/IKmo60ApAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4286,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":531,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287339,"flow_last_seen":287339,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287339,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":51497,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4286,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":531,"flow_packet_id":1,"flow_last_seen":287339,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287339,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4sEQAAIARGPgKAAIP2meLAnAJySkAJM\/OzVgxAjVsdfr\/RlHjd+FEAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4287,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":532,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287339,"flow_last_seen":287339,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287339,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":10677,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4287,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":532,"flow_packet_id":1,"flow_last_seen":287339,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287339,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4y5UAAIAR2JYKAAIPchsYX3AJKbUAJHDz4UUxAmZfIED\/GvUdIOziAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":533,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287339,"flow_last_seen":287339,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287339,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.229.185.60","src_port":28681,"dst_port":6898,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":533,"flow_packet_id":1,"flow_last_seen":287339,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287339,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Yf0AAIAR7ocKAAIPJOW5PHAJGvIAJMq89f4xAvaeYrv\/4yEfRAEMAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4289,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":534,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287339,"flow_last_seen":287339,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287339,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":54436,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4289,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":534,"flow_packet_id":1,"flow_last_seen":287339,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287339,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4d8sAAIAR7jwKAAIPcfxWonAJ1KQAJNtwu\/oxAjBI83r\/Pfap\/tM3AwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4290,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":535,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287340,"flow_last_seen":287340,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287340,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":10655,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4290,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":535,"flow_packet_id":1,"flow_last_seen":287340,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287340,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4y5YAAIAR2JUKAAIPchsYX3AJKZ8AJB8CbiMxAnuCmhD\/TptNer8YAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":536,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287340,"flow_last_seen":287340,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287340,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.167.222.160","src_port":28681,"dst_port":56121,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4291,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":536,"flow_packet_id":1,"flow_last_seen":287340,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287340,"pkt":"UlQAEjUCCAAn5uVZCABFAAA472oAAIAR6fMKAAIPdqfeoHAJ2zkAJDox4S4xAkVI4Cn\/wFgJcQ9KAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4292,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":537,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287340,"flow_last_seen":287340,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287340,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.200.235","src_port":28681,"dst_port":2034,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4292,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":537,"flow_packet_id":1,"flow_last_seen":287340,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287340,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4KVkAAIARYb0KAAIP2qTI63AJB\/IAJCThTPoxAqo\/Wlv\/2OZmP\/U8AwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4293,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":538,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287340,"flow_last_seen":287340,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287340,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.41.253","src_port":28681,"dst_port":14339,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4293,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":538,"flow_packet_id":1,"flow_last_seen":287340,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287340,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4KckAAIARXgYKAAIPfNop\/XAJOAMAJB1VhfMxAgzInl7\/RlZyYyqeAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4294,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":539,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287340,"flow_last_seen":287340,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287340,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":28681,"dst_port":7510,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4294,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":539,"flow_packet_id":1,"flow_last_seen":287340,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287340,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4TE0AAIAR210KAAIPdw6P7XAJHVYAJNJtQpkxAuJpSWf\/lqU1njbcAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4295,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":540,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287340,"flow_last_seen":287340,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287340,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":28681,"dst_port":52131,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4295,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":540,"flow_packet_id":1,"flow_last_seen":287340,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287340,"pkt":"UlQAEjUCCAAn5uVZCABFAAA40EQAAIARblAKAAIPJOzLJXAJy6MAJCW3NH8xAlW+Kb3\/nA0t9fvsAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4296,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":541,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287340,"flow_last_seen":287340,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287340,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":11141,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4296,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":541,"flow_packet_id":1,"flow_last_seen":287340,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287340,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4y5cAAIAR2JQKAAIPchsYX3AJK4UAJCR19SkxAnnruD3\/VfHhyi3HAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4298,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":542,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287340,"flow_last_seen":287340,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287340,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":51675,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4298,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":542,"flow_packet_id":1,"flow_last_seen":287340,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287340,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4sEUAAIARGPcKAAIP2meLAnAJydsAJDGlWjgxAoBiHS\/\/ys1RrluwAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4299,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":543,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287340,"flow_last_seen":287340,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287340,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.39.159.60","src_port":28681,"dst_port":56896,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4299,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":543,"flow_packet_id":1,"flow_last_seen":287340,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287340,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4HicAAIAR\/xsKAAIPciefPHAJ3kAAJE4zs64xAnN+DR3\/DageGN9SAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4300,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_packet_id":2,"flow_last_seen":287341,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287341,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4t4wAAIAR+a8KAAIPYtAamnAJE4IAJND7vRQxAnW20t7\/omLlUBNqAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4301,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":544,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287341,"flow_last_seen":287341,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287341,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.184.29.35","src_port":28681,"dst_port":30582,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4301,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":544,"flow_packet_id":1,"flow_last_seen":287341,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287341,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4aA0AAIAROb4KAAIPb7gdI3AJd3YAJEWnxaoxAlt9b9v\/bJbSTvHEAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4302,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":545,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287341,"flow_last_seen":287341,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287341,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.49.159.77","src_port":28681,"dst_port":55915,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4302,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":545,"flow_packet_id":1,"flow_last_seen":287341,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287341,"pkt":"UlQAEjUCCAAn5uVZCABFAAA48bkAAIARKW4KAAIPdDGfTXAJ2msAJF3V9doxApW84Wv\/tYCHgSzKAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4303,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":546,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287341,"flow_last_seen":287341,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287341,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49867,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4303,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":546,"flow_packet_id":1,"flow_last_seen":287341,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287341,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4pCEAAIAR7AwKAAIPJo536nAJwssAJHrLLjcxApDvqAz\/3CaLJ4LzAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":547,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287341,"flow_last_seen":287341,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287341,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":43316,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":547,"flow_packet_id":1,"flow_last_seen":287341,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287341,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4AsYAAIAR5hoKAAIP1eVv4HAJqTQAJMEbfmExAteHtOT\/QHhYi6\/GAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4308,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":548,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287342,"flow_last_seen":287342,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287342,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.50.147.205","src_port":28681,"dst_port":17735,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4308,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":548,"flow_packet_id":1,"flow_last_seen":287342,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287342,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ETEAAIARP3YKAAIPSjKTzXAJRUcAJBlJ7wYxApvcMz\/\/9U9DMUIJAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4311,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":549,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287342,"flow_last_seen":287342,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287342,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.211.151.48","src_port":28681,"dst_port":11105,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4311,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":549,"flow_packet_id":1,"flow_last_seen":287342,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287342,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4710AAIARU0UKAAIPVNOXMHAJK2EAJJYcpUUxArXIKYz\/kbwYPGdaAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4312,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":550,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287342,"flow_last_seen":287342,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287342,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.238.145.82","src_port":28681,"dst_port":33527,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4312,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":550,"flow_packet_id":1,"flow_last_seen":287342,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287342,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4uG0AAIARB\/gKAAIP3O6RUnAJgvcAJOMGGNYxAt\/S407\/lCAJzVfnAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4315,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":551,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287355,"flow_last_seen":287355,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287355,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.24.129.230","src_port":28681,"dst_port":14766,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4315,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":551,"flow_packet_id":1,"flow_last_seen":287355,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287355,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4y1AAAIARhVcKAAIPXBiB5nAJOa4AJM4l8ZQxAnSYqJP\/t8Ky5S7oAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4316,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":552,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287356,"flow_last_seen":287356,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287356,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.250.6.59","src_port":28681,"dst_port":60012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4316,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":552,"flow_packet_id":1,"flow_last_seen":287356,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287356,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4LSIAAIARIE8KAAIP2voGO3AJ6mwAJFv3Fs8xAvvbwbr\/1nXIB48LAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4317,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":553,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287356,"flow_last_seen":287356,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287356,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3259,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4317,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":553,"flow_packet_id":1,"flow_last_seen":287356,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287356,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Zd0AAIARkUkKAAIPtpuA5HAJDLsAJIbmNEUxAmz\/VTb\/P+HNLoOzAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4318,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":554,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287356,"flow_last_seen":287356,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287356,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.203.72.224","src_port":28681,"dst_port":55577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4318,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":554,"flow_packet_id":1,"flow_last_seen":287356,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287356,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4djsAAIAR878KAAIPe8tI4HAJ2RkAJAkspc4xAm3DbCH\/4Py3j+\/RAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4319,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":555,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287356,"flow_last_seen":287356,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287356,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":28681,"dst_port":20387,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4319,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":555,"flow_packet_id":1,"flow_last_seen":287356,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287356,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4FYIAAIARgjoKAAIPfNoaEHAJT6MAJKeseAQxAjGV88P\/RlRqQuTCAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4320,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":556,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287356,"flow_last_seen":287356,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287356,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":28681,"dst_port":49787,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4320,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":556,"flow_packet_id":1,"flow_last_seen":287356,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287356,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4faQAAIARyJQKAAIPO2itBXAJwnsAJN9Ls+0xAhm42hj\/nrPQm8oDAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4321,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":557,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287356,"flow_last_seen":287356,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287356,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":28681,"dst_port":53163,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4321,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":557,"flow_packet_id":1,"flow_last_seen":287356,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287356,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4cDkAAIAR4CsKAAIPPd6gY3AJz6sAJOIPMO0xAsYU7XP\/BTXa9NnmAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4322,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":558,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287356,"flow_last_seen":287356,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287356,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.105.52.2","src_port":28681,"dst_port":6466,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4322,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":558,"flow_packet_id":1,"flow_last_seen":287356,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287356,"pkt":"UlQAEjUCCAAn5uVZCABFAAA41kUAAIARs\/UKAAIPcGk0AnAJGUIAJKu2eJ8xAkAhu6z\/VTdSfrPxAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4323,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":559,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287356,"flow_last_seen":287356,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287356,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":55080,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4323,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":559,"flow_packet_id":1,"flow_last_seen":287356,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287356,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4d8wAAIAR7jsKAAIPcfxWonAJ1ygAJJKIRiUxAiDNGY7\/+mSfmsLSAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4324,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":560,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287356,"flow_last_seen":287356,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287356,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":53883,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4324,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":560,"flow_packet_id":1,"flow_last_seen":287356,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287356,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4TFUAAIARXGIKAAIPdqgPR3AJ0nsAJOgSQicxAvqE8cb\/9ZD4EU5zAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4325,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":561,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287357,"flow_last_seen":287357,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287357,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":28681,"dst_port":57466,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4325,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":561,"flow_packet_id":1,"flow_last_seen":287357,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287357,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4GZ0AAIARKZsKAAIPPe6tgHAJ4HoAJK46s84xAsBvsbH\/BjmAt5H0AwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4326,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":562,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287357,"flow_last_seen":287357,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287357,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.242.110","src_port":28681,"dst_port":59879,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4326,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":562,"flow_packet_id":1,"flow_last_seen":287357,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287357,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4CAAAAIARw8AKAAIPcHfybnAJ6ecAJG2XDtYxAh1xX6b\/BpNjzG\/fAwABAAUAAADDglFLQA=="} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4333,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":376,"flow_packet_id":3,"flow_last_seen":287381,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287381,"pkt":"UlQAEjUCCAAn5uVZCABFAABUZAoAAIARBEUKAAIPnDkqAnAJgsQAQN7AXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRDQPqvEDU0NQQAFaQIJQUkA="} +00501{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4335,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":384,"flow_packet_id":3,"flow_last_seen":287381,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287381,"pkt":"UlQAEjUCCAAn5uVZCABFAABU3QEAAIAR\/5kKAAIPS0AGr3AJEocAQKLqXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRGrTlI0DU0NQQAFaQIJQUkA="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4337,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":563,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287383,"flow_last_seen":287383,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287383,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.105.52.2","src_port":28681,"dst_port":6831,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4337,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":563,"flow_packet_id":1,"flow_last_seen":287383,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287383,"pkt":"UlQAEjUCCAAn5uVZCABFAAA41kYAAIARs\/QKAAIPcGk0AnAJGq8AJKIX98gxAizVGZz\/7PAadrl+AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4338,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":564,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287384,"flow_last_seen":287384,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287384,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":28681,"dst_port":53144,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4338,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":564,"flow_packet_id":1,"flow_last_seen":287384,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287384,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4cDoAAIAR4CoKAAIPPd6gY3AJz5gAJMjOfpgxAhUgVRL\/yONTAZ1AAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4339,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":565,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287385,"flow_last_seen":287385,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287385,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.45.40.28","src_port":28681,"dst_port":2656,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4339,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":565,"flow_packet_id":1,"flow_last_seen":287385,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287385,"pkt":"UlQAEjUCCAAn5uVZCABFAAA41\/YAAIARvGYKAAIPci0oHHAJCmAAJNKz1WIxArUhdu3\/dYzCsyXMAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4340,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":566,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287385,"flow_last_seen":287385,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287385,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.176.62.40","src_port":28681,"dst_port":52755,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4340,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":566,"flow_packet_id":1,"flow_last_seen":287385,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287385,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4SZQAAIARbDoKAAIPOrA+KHAJzhMAJIArHp4xAhzR0R3\/lUZOjqTcAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4341,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":567,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287385,"flow_last_seen":287385,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287385,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.176.62.40","src_port":28681,"dst_port":52889,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4341,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":567,"flow_packet_id":1,"flow_last_seen":287385,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287385,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4SZUAAIARbDkKAAIPOrA+KHAJzpkAJLUzLuYxAjoHpQb\/BnBK9UIVAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4342,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":568,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287385,"flow_last_seen":287385,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287385,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.118.77","src_port":28681,"dst_port":56562,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4342,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":568,"flow_packet_id":1,"flow_last_seen":287385,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287385,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4yK4AAIARc90KAAIPe812TXAJ3PIAJIu6LIsxAsIW6HX\/wNTfuKzFAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4345,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":569,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287386,"flow_last_seen":287386,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287386,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.89.249.8","src_port":28681,"dst_port":50649,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4345,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":569,"flow_packet_id":1,"flow_last_seen":287386,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287386,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ghAAAIARajQKAAIPSVn5CHAJxdkAJEIx65kxAgUhZoj\/+H2oSNwcAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4346,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":570,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287387,"flow_last_seen":287387,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287387,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":28681,"dst_port":8890,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4346,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":570,"flow_packet_id":1,"flow_last_seen":287387,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287387,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4s\/EAAIARYc0KAAIPYVO3lHAJIroAJLoL938xArfD0B\/\/j2thPytlAwABAAUAAADDglFLQA=="} +00492{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4347,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":549,"flow_packet_id":2,"flow_last_seen":287409,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"thread_ts_msec":287409,"pkt":"CAAn5uVZUlQAEjUCCABFAABOCxcAAEARd3ZU05cwCgACDythcAkAOi0BpUUxArXIKYz\/kbwYPGdaAwEBABsAAABhK1TTlzBjAAAAAAAIAMOCUUtIp74gY1K8HTs="} +00506{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4352,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":549,"flow_packet_id":3,"flow_last_seen":287422,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":102,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":102,"pkt_l4_len":68,"thread_ts_msec":287422,"pkt":"UlQAEjUCCAAn5uVZCABFAABY714AAIARUyQKAAIPVNOXMHAJK2EARLczXS\/iNTECAGQaxPLpTglwD4ABACUAAAD5AHBpbmtmbG95ZADDAlFLSKe+IGNSvB07A1NDUEABWkCCUFJA"} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4353,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":380,"flow_packet_id":3,"flow_last_seen":287422,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287422,"pkt":"UlQAEjUCCAAn5uVZCABFAABUQjcAAIARZzoKAAIPU1Yxw3AJLvMAQBxiXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRJEVpT0DU0NQQAFaQIJQUkA="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4355,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":571,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287423,"flow_last_seen":287423,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287423,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.40.163.123","src_port":28681,"dst_port":55341,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4355,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":571,"flow_packet_id":1,"flow_last_seen":287423,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287423,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4CoUAAIARDn4KAAIPciije3AJ2C0AJGoKYhoxAqnTE7z\/9yPotMc0AwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4356,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":572,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287423,"flow_last_seen":287423,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287423,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.153.21.93","src_port":28681,"dst_port":36696,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4356,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":572,"flow_packet_id":1,"flow_last_seen":287423,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287423,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4mT0AAIARKXMKAAIPVpkVXXAJj1gAJLHHKl4xAkn2d3j\/H9LA72kqAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4358,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":573,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287424,"flow_last_seen":287424,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287424,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.239.173.18","src_port":28681,"dst_port":23327,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4358,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":573,"flow_packet_id":1,"flow_last_seen":287424,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287424,"pkt":"UlQAEjUCCAAn5uVZCABFAAA49UIAAIARRGIKAAIPR++tEnAJWx8AJIyDRvgxAlabW\/L\/UhfhU89DAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4359,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":574,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287424,"flow_last_seen":287424,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287424,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.17.132.18","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4359,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":574,"flow_packet_id":1,"flow_last_seen":287424,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287424,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4SSoAAIARglgKAAIP3xGEEnAJW6IAJNSDXLYxArzGF4H\/cFjUFKBTAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4360,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":575,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287424,"flow_last_seen":287424,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287424,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.202.31.113","src_port":28681,"dst_port":19768,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4360,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":575,"flow_packet_id":1,"flow_last_seen":287424,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287424,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4VqoAAIARPMEKAAIPe8ofcXAJTTgAJCDh3fcxApfnx0H\/RMwJgGjyAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4361,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":576,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287424,"flow_last_seen":287424,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287424,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":42925,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4361,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":576,"flow_packet_id":1,"flow_last_seen":287424,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287424,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4BsMAAIAREfsKAAIPaO6s+nAJp60AJK7rZGYxAghdQvz\/yzu+RGHoAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4362,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":577,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287425,"flow_last_seen":287425,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287425,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.148.100.237","src_port":28681,"dst_port":23459,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4362,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":577,"flow_packet_id":1,"flow_last_seen":287425,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287425,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4IygAAIARav0KAAIPO5Rk7XAJW6MAJAISvbAxAu9K+in\/ZCHuzn3vAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4363,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":578,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287425,"flow_last_seen":287425,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287425,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.205.243.44","src_port":28681,"dst_port":46006,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4363,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":578,"flow_packet_id":1,"flow_last_seen":287425,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287425,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4CGYAAIAR5UYKAAIPTc3zLHAJs7YAJJAoLu0xArTaFaf\/IMRpCls4AwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4365,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":393,"flow_packet_id":2,"flow_last_seen":287426,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287426,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4IqIAAIARMyoKAAIPOnOeZ3AJE\/YAJBej5dkxAotpW4P\/f5fj4o85AwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4366,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":579,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287426,"flow_last_seen":287426,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287426,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.170.108","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4366,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":579,"flow_packet_id":1,"flow_last_seen":287426,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287426,"pkt":"UlQAEjUCCAAn5uVZCABFAAA443oAAIARwa4KAAIP3xCqbHAJW6IAJB3OQmYxAjlvsOX\/oIbrdPhZAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4367,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":580,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287426,"flow_last_seen":287426,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287426,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.119.55.28","src_port":28681,"dst_port":20347,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4367,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":580,"flow_packet_id":1,"flow_last_seen":287426,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287426,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4AqcAAIARqGwKAAIPTHc3HHAJT3sAJBAC+9UxAqOKieH\/vJao0HURAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4368,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":581,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287426,"flow_last_seen":287426,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287426,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.115.108.10","src_port":28681,"dst_port":4641,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4368,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":581,"flow_packet_id":1,"flow_last_seen":287426,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287426,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4UmwAAIARNb0KAAIPOnNsCnAJEiEAJMh1i24xAs4wVdL\/66eaHiGOAwABAAUAAADDglFLQA=="} +00506{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4369,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":378,"flow_packet_id":3,"flow_last_seen":287426,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":102,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":102,"pkt_l4_len":68,"thread_ts_msec":287426,"pkt":"UlQAEjUCCAAn5uVZCABFAABYWbUAAIARkaIKAAIPdvHMPXAJqWYARJ5yXS\/iNTECAGQaxPLpTglwD4ABACUAAAD5AHBpbmtmbG95ZADDAlFLSAe1z04CyqHbA1NDUEABWkCCUFJA"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4370,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":582,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287427,"flow_last_seen":287427,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287427,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.83.5","src_port":28681,"dst_port":10624,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4370,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":582,"flow_packet_id":1,"flow_last_seen":287427,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287427,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4D9kAAIAR7LcKAAIP3xBTBXAJKYAAJNiyAvsxAqD\/vTn\/+ILQeebyAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4371,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":583,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287427,"flow_last_seen":287427,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287427,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.75.180.80","src_port":28681,"dst_port":35361,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4371,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":583,"flow_packet_id":1,"flow_last_seen":287427,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287427,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4\/H8AAIARJosKAAIPV0u0UHAJiiEAJBDsUqsxAkzLLuf\/psXzjIu9AwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4372,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":584,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287427,"flow_last_seen":287427,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287427,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.193.171.146","src_port":28681,"dst_port":18360,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4372,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":584,"flow_packet_id":1,"flow_last_seen":287427,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287427,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4FTsAAIARHRgKAAIPUMGrknAJR7gAJKWqCBAxAnpBcnj\/3QdfvG\/iAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4373,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":394,"flow_packet_id":3,"flow_last_seen":287427,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287427,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4cmAAAIARkGkKAAIPpVSGiHAJU58AJLeGDAAxAiYeJof\/9uroVqWzAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4375,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":585,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287428,"flow_last_seen":287428,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287428,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":35004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4375,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":585,"flow_packet_id":1,"flow_last_seen":287428,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287428,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4eOsAAIAR6KAKAAIPM0SZ1nAJiLwAJOz378YxApz\/UDL\/HPodvSquAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4376,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":586,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287428,"flow_last_seen":287428,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287428,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.124.66.33","src_port":28681,"dst_port":13060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4376,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":586,"flow_packet_id":1,"flow_last_seen":287428,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287428,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4aowAAIARpHwKAAIP3XxCIXAJMwQAJIMFpRgxAlSjvWv\/8mVu3vyzAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4377,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":587,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287428,"flow_last_seen":287428,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287428,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.134.154.158","src_port":28681,"dst_port":54130,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4377,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":587,"flow_packet_id":1,"flow_last_seen":287428,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287428,"pkt":"UlQAEjUCCAAn5uVZCABFAAA468YAAIARSbsKAAIPXoaannAJ03IAJBwFJkExAt95d93\/kWspTT1mAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4378,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":588,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287429,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.175.103","src_port":28681,"dst_port":4315,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4378,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":588,"flow_packet_id":1,"flow_last_seen":287429,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287429,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4DLwAAIARlzwKAAIP20avZ3AJENsAJCQQ\/3gxAnx8z9L\/v8jCD0mhAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4379,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":589,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287429,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.250.32","src_port":28681,"dst_port":52647,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4379,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":589,"flow_packet_id":1,"flow_last_seen":287429,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287429,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4bsoAAIARU7wKAAIPcf\/6IHAJzacAJLaE2zMxAs3BEeX\/D4QWXt\/3AwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4380,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":590,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287429,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":28681,"dst_port":48380,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4380,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":590,"flow_packet_id":1,"flow_last_seen":287429,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287429,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4GZEAAIAR6McKAAIPXwrNQ3AJvPwAJFbgNpAxAqs9YVn\/6PsJV+iuAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4381,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":591,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287429,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":53707,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4381,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":591,"flow_packet_id":1,"flow_last_seen":287429,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287429,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4TFYAAIARXGEKAAIPdqgPR3AJ0csAJDUYWrAxAvfRzcf\/0RWLVbNsAwABAAUAAADDglFLQA=="} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4382,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":592,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287429,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.36.249.91","src_port":28681,"dst_port":7190,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4382,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":592,"flow_packet_id":1,"flow_last_seen":287429,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287429,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4vG8AAIARd7cKAAIPAST5W3AJHBYAJLsVIrYxApaxIKP\/Sf4biBFTAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4383,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":593,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287430,"flow_last_seen":287430,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287430,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":28681,"dst_port":9747,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4383,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":593,"flow_packet_id":1,"flow_last_seen":287430,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287430,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4FYMAAIARgjkKAAIPfNoaEHAJJhMAJP95CIYxAgvOThr\/6kiruLFkAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4387,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":594,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287441,"flow_last_seen":287441,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287441,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":28681,"dst_port":7375,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4387,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":594,"flow_packet_id":1,"flow_last_seen":287441,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287441,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4q84AAIARltQKAAIPd+10FnAJHM8AJHWiRqMxAv7j56T\/YhObOI6NAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4388,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":595,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287441,"flow_last_seen":287441,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287441,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.182.21.156","src_port":28681,"dst_port":13732,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4388,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":595,"flow_packet_id":1,"flow_last_seen":287441,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287441,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4PToAAIARLBoKAAIPr7YVnHAJNaQAJL9a6RsxAuUYIw7\/NqvoaXnEAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4389,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":596,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287441,"flow_last_seen":287441,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287441,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.18.212.223","src_port":28681,"dst_port":58954,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4389,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":596,"flow_packet_id":1,"flow_last_seen":287441,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287441,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Gc0AAIARAugKAAIPPRLU33AJ5koAJHHsbGIxAkiqaWb\/aJtiTcYTAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4390,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":597,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287441,"flow_last_seen":287441,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287441,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":28681,"dst_port":52274,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4390,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":597,"flow_packet_id":1,"flow_last_seen":287441,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287441,"pkt":"UlQAEjUCCAAn5uVZCABFAAA40EUAAIARbk8KAAIPJOzLJXAJzDIAJO1tg54xAnXTk8r\/O6hdlaUQAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":598,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287442,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.172.184.48","src_port":28681,"dst_port":1512,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4391,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":598,"flow_packet_id":1,"flow_last_seen":287442,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287442,"pkt":"UlQAEjUCCAAn5uVZCABFAAA47j8AAIARhooKAAIPAay4MHAJBegAJLA8YlIxAt8gSpj\/l295TQ\/MAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4392,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":599,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287442,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":59875,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4392,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":599,"flow_packet_id":1,"flow_last_seen":287442,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287442,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4d80AAIAR7joKAAIPcfxWonAJ6eMAJHnCBoMxApjGEB\/\/C2FJxCqEAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4393,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":600,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287442,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.64.156.63","src_port":28681,"dst_port":60092,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4393,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":600,"flow_packet_id":1,"flow_last_seen":287442,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287442,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4j10AAIARAcoKAAIPAUCcP3AJ6rwAJFkNBpoxAv1g0pT\/iG86BJFZAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4394,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":601,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287442,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.200.161","src_port":28681,"dst_port":65274,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4394,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":601,"flow_packet_id":1,"flow_last_seen":287442,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287442,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4xdUAAIARLjAKAAIPcf\/IoXAJ\/voAJEpLNvQxAgTf9O3\/DFadIdtYAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4395,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":602,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287442,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.203.72.224","src_port":28681,"dst_port":53658,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4395,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":602,"flow_packet_id":1,"flow_last_seen":287442,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287442,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4djwAAIAR874KAAIPe8tI4HAJ0ZoAJNNBRMMxAhyq6zP\/5znER1hNAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4396,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":603,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287442,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.36.249.91","src_port":28681,"dst_port":64577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4396,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":603,"flow_packet_id":1,"flow_last_seen":287442,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287442,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4vHAAAIARd7YKAAIPAST5W3AJ\/EEAJBRLaNMxAg6ccNf\/0JByYJagAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4397,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":604,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287443,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287443,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.202.31.113","src_port":28681,"dst_port":53291,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4397,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":604,"flow_packet_id":1,"flow_last_seen":287443,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287443,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4VqsAAIARPMAKAAIPe8ofcXAJ0CsAJDKZegsxAkckPt7\/mgsklmBFAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4399,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":605,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287443,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287443,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.149.125.139","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4399,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":605,"flow_packet_id":1,"flow_last_seen":287443,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287443,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4qRgAAIARU20KAAIPtJV9i3AJGbIAJBIxCsIxAu35Vpv\/8HMK29aIAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4400,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":606,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287443,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287443,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":56070,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4400,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":606,"flow_packet_id":1,"flow_last_seen":287443,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287443,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4EccAAIARH2sKAAIPYPacfnAJ2wYAJBmvn8UxAiv5M0T\/zocfwhFKAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4401,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":607,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287443,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287443,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":28681,"dst_port":42288,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4401,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":607,"flow_packet_id":1,"flow_last_seen":287443,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287443,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4zKwAAIARKS4KAAIPlRyjr3AJpTAAJHwO5TExAicJIn\/\/QcLmUz\/mAwABAAUAAADDglFLQA=="} +00501{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4402,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":382,"flow_packet_id":3,"flow_last_seen":287443,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287443,"pkt":"UlQAEjUCCAAn5uVZCABFAABUhLMAAIARUaoKAAIPTK8LfnAJn\/4AQNfHXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRGDi1esDU0NQQAFaQIJQUkA="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4403,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":608,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287444,"flow_last_seen":287444,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287444,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.241.31.96","src_port":28681,"dst_port":4814,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4403,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":608,"flow_packet_id":1,"flow_last_seen":287444,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287444,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4KIwAAIARdskKAAIPb\/EfYHAJEs4AJBsknaAxAhfRa6T\/WluxI8gnAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4404,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":609,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287444,"flow_last_seen":287444,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287444,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.163.14.246","src_port":28681,"dst_port":23461,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4404,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":609,"flow_packet_id":1,"flow_last_seen":287444,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287444,"pkt":"UlQAEjUCCAAn5uVZCABFAAA41LcAAIARSVYKAAIPAaMO9nAJW6UAJKF4dK8xAreqPWv\/EJ97nSTRAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4405,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":610,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287444,"flow_last_seen":287444,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287444,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":28681,"dst_port":59016,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4405,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":610,"flow_packet_id":1,"flow_last_seen":287444,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287444,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4bmoAAIARqKgKAAIPdPGionAJ5ogAJNq+rbAxAgrowWD\/7X7x03jfAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4409,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":611,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287466,"flow_last_seen":287466,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287466,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.10.174.159","src_port":28681,"dst_port":4841,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4409,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":611,"flow_packet_id":1,"flow_last_seen":287466,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287466,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4g8cAAIARvzUKAAIPPQqun3AJEukAJOvIEqoxAs\/DLU3\/jNCwydjwAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4410,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":612,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287466,"flow_last_seen":287466,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287466,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":59384,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4410,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":612,"flow_packet_id":1,"flow_last_seen":287466,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287466,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4d84AAIAR7jkKAAIPcfxWonAJ5\/gAJG38WGgxAvrA9AH\/5wxqTRzFAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4411,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":613,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287466,"flow_last_seen":287466,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287466,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"106.104.88.139","src_port":28681,"dst_port":7423,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4411,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":613,"flow_packet_id":1,"flow_last_seen":287466,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287466,"pkt":"UlQAEjUCCAAn5uVZCABFAAA40YIAAIARmjAKAAIPamhYi3AJHP8AJO6Rh0sxAi1SA9T\/rJPa7K99AwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4412,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":614,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287467,"flow_last_seen":287467,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287467,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.247.152.218","src_port":28681,"dst_port":51920,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4412,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":614,"flow_packet_id":1,"flow_last_seen":287467,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287467,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4bf8AAIARr9UKAAIPd\/eY2nAJytAAJCStLAIxAufAkgr\/MTC83CHSAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4413,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":615,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287467,"flow_last_seen":287467,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287467,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.118.77","src_port":28681,"dst_port":60482,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4413,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":615,"flow_packet_id":1,"flow_last_seen":287467,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287467,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4yK8AAIARc9wKAAIPe812TXAJ7EIAJApE09cxAglzEtf\/H9RgA+nUAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4415,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_packet_id":3,"flow_last_seen":287468,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287468,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4StIAAIARbLIKAAIPwqO0fnAJKkkAJKD8qwQxAr9rbFn\/E2O9gCqIAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4417,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":616,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287468,"flow_last_seen":287468,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287468,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.195.236.249","src_port":28681,"dst_port":18557,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4417,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":616,"flow_packet_id":1,"flow_last_seen":287468,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287468,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4nYQAAIARWWUKAAIPSsPs+XAJSH0AJIkmbv4xAoixYoj\/ruMq7rpPAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4418,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":617,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287469,"flow_last_seen":287469,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287469,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.208.167.152","src_port":28681,"dst_port":30628,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4418,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":617,"flow_packet_id":1,"flow_last_seen":287469,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287469,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4WlgAAIART+UKAAIP3NCnmHAJd6QAJAc\/RhcxAoroF\/T\/2C63HF1NAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4424,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":618,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287484,"flow_last_seen":287484,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287484,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":28681,"dst_port":7380,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4424,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":618,"flow_packet_id":1,"flow_last_seen":287484,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287484,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4q88AAIARltMKAAIPd+10FnAJHNQAJFT6DAoxAv+ZWTf\/RWyWc6PiAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4425,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":619,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287484,"flow_last_seen":287484,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287484,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.172.184.48","src_port":28681,"dst_port":13281,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4425,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":619,"flow_packet_id":1,"flow_last_seen":287484,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287484,"pkt":"UlQAEjUCCAAn5uVZCABFAAA47kAAAIARhokKAAIPAay4MHAJM+EAJDxQkSsxAtpcwSP\/jwmQMVPzAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4426,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":620,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287485,"flow_last_seen":287485,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287485,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.163.14.246","src_port":28681,"dst_port":1630,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4426,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":620,"flow_packet_id":1,"flow_last_seen":287485,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287485,"pkt":"UlQAEjUCCAAn5uVZCABFAAA41LgAAIARSVUKAAIPAaMO9nAJBl4AJPMn4YQxAlF53yj\/dd5vPQJNAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4427,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":621,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287485,"flow_last_seen":287485,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287485,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":53516,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4427,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":621,"flow_packet_id":1,"flow_last_seen":287485,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287485,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4TFcAAIARXGAKAAIPdqgPR3AJ0QwAJIFNOG8xAuJ1OVr\/Qagv5jLKAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4428,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":622,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287485,"flow_last_seen":287485,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287485,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3227,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4428,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":622,"flow_packet_id":1,"flow_last_seen":287485,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287485,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Zd4AAIARkUgKAAIPtpuA5HAJDJsAJFFKXoYxAkQIlMH\/lnAUbszZAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4429,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":623,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287486,"flow_last_seen":287486,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287486,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.234.18.166","src_port":28681,"dst_port":61319,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4429,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":623,"flow_packet_id":1,"flow_last_seen":287486,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287486,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4pXEAAIARUaUKAAIPJOoSpnAJ74cAJJ77jRQxAj\/2hez\/gMz\/daIpAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4430,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":624,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287486,"flow_last_seen":287486,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287486,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"210.209.249.84","src_port":28681,"dst_port":24751,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4430,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":624,"flow_packet_id":1,"flow_last_seen":287486,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287486,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4v8UAAIARoroKAAIP0tH5VHAJYK8AJKahkc0xAgfCDEv\/dAkm3EAmAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4431,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":625,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287486,"flow_last_seen":287486,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287486,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":28681,"dst_port":57492,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4431,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":625,"flow_packet_id":1,"flow_last_seen":287486,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287486,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4GZ4AAIARKZoKAAIPPe6tgHAJ4JQAJLhHKq4xAgkNwfP\/egCU0iQ4AwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4432,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":626,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287487,"flow_last_seen":287487,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287487,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.206.254","src_port":28681,"dst_port":49737,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4432,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":626,"flow_packet_id":1,"flow_last_seen":287487,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287487,"pkt":"UlQAEjUCCAAn5uVZCABFAAA42YUAAIARFCYKAAIPcfzO\/nAJwkkAJB0QbGUxAmA\/pdn\/+9mbz8JIAwABAAUAAADDglFLQA=="} +00493{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4437,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":548,"flow_packet_id":2,"flow_last_seen":287495,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"thread_ts_msec":287495,"pkt":"CAAn5uVZUlQAEjUCCABFAABOCygAAEARhWlKMpPNCgACD0VHcAkAOiqo7wYxApvcMz\/\/9U9DMUIJAwEBABsAAABHRUoyk80DGgAAAAAgAMOCUUtIaqDPEamqqrE="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4438,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":627,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287496,"flow_last_seen":287496,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287496,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":28681,"dst_port":49815,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4438,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":627,"flow_packet_id":1,"flow_last_seen":287496,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287496,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4faUAAIARyJMKAAIPO2itBXAJwpcAJHfcBqQxApN\/gLb\/BhJ4KvMKAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4439,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":628,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287496,"flow_last_seen":287496,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287496,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.62.225.181","src_port":28681,"dst_port":46843,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4439,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":628,"flow_packet_id":1,"flow_last_seen":287496,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287496,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4I3YAAIAR4DwKAAIPST7htXAJtvsAJPbhbm8xAp1WIi7\/RMwucvQ\/AwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4440,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":629,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287496,"flow_last_seen":287496,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287496,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.65.87.24","src_port":28681,"dst_port":16201,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4440,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":629,"flow_packet_id":1,"flow_last_seen":287496,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287496,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4uwAAAIAR70wKAAIPLUFXGHAJP0kAJBnplzoxAjbrndX\/A0LHiNtwAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4441,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":630,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287496,"flow_last_seen":287496,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287496,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":28681,"dst_port":45710,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4441,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":630,"flow_packet_id":1,"flow_last_seen":287496,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287496,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4tisAAIARac0KAAIPDsj\/5XAJso4AJM+0PjAxAsAfMFX\/sUsJJdxUAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4442,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":631,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287496,"flow_last_seen":287496,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287496,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":3931,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4442,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":631,"flow_packet_id":1,"flow_last_seen":287496,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287496,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4TFgAAIARXF8KAAIPdqgPR3AJD1sAJJ52OqQxAgODGv\/\/0lHd\/JWpAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4444,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":632,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287497,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.231.59.187","src_port":28681,"dst_port":62234,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4444,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":632,"flow_packet_id":1,"flow_last_seen":287497,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287497,"pkt":"UlQAEjUCCAAn5uVZCABFAAA44CYAAIAR7d0KAAIPJOc7u3AJ8xoAJLTpw4sxAhlY3qr\/NTV5Fkl1AwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":633,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287497,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.149.2.44","src_port":28681,"dst_port":20964,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":633,"flow_packet_id":1,"flow_last_seen":287497,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287497,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4qlEAAIARxZMKAAIPvJUCLHAJUeQAJLk9s0oxAmOxGFD\/nla6l6SdAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4447,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":634,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287497,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.174.18.115","src_port":28681,"dst_port":50679,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4447,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":634,"flow_packet_id":1,"flow_last_seen":287497,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287497,"pkt":"UlQAEjUCCAAn5uVZCABFAAA43z4AAIAR+EYKAAIPRK4Sc3AJxfcAJGArsewxAkZWaQ3\/nH97eYCtAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4448,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":635,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287497,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.179.18.242","src_port":28681,"dst_port":47329,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4448,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":635,"flow_packet_id":1,"flow_last_seen":287497,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287497,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4AtoAAIARACgKAAIPGLMS8nAJuOEAJOQLk+AxAjoqms7\/EpJ2qTgYAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4449,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":636,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.48.23","src_port":28681,"dst_port":2556,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4449,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":636,"flow_packet_id":1,"flow_last_seen":287498,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287498,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4+HAAAIARKtgKAAIP20YwF3AJCfwAJJyOh38xArjfKrz\/ixOs5fFuAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4450,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":637,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.193.171.146","src_port":28681,"dst_port":53143,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4450,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":637,"flow_packet_id":1,"flow_last_seen":287498,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287498,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4FTwAAIARHRcKAAIPUMGrknAJz5cAJMAv05MxAs\/m8mT\/ClEe9gkcAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":638,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.194.73","src_port":28681,"dst_port":1995,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4451,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":638,"flow_packet_id":1,"flow_last_seen":287498,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287498,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4\/1EAAIARSCIKAAIPJOnCSXAJB8sAJHKbeI0xAhSNVXz\/qxoZujhsAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4452,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":639,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.242.225","src_port":28681,"dst_port":15068,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4452,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":639,"flow_packet_id":1,"flow_last_seen":287498,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287498,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4LcUAAIARV2QKAAIPtpvy4XAJOtwAJKuGpecxAl4nEaL\/XuFfzd0wAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4453,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":640,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":28681,"dst_port":7849,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4453,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":640,"flow_packet_id":1,"flow_last_seen":287498,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287498,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4q9AAAIARltIKAAIPd+10FnAJHqkAJG\/HvWUxAsdBW4j\/jSCp2lIvAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4454,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":641,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.36.249.91","src_port":28681,"dst_port":65430,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4454,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":641,"flow_packet_id":1,"flow_last_seen":287498,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287498,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4vHEAAIARd7UKAAIPAST5W3AJ\/5YAJLw5RCoxAvWJNmT\/MlKF7AwgAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4455,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":642,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287499,"flow_last_seen":287499,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287499,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.199.103","src_port":28681,"dst_port":2625,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4455,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":642,"flow_packet_id":1,"flow_last_seen":287499,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287499,"pkt":"UlQAEjUCCAAn5uVZCABFAAA47lgAAIARU\/0KAAIPJOnHZ3AJCkEAJBqP8cUxAr25Ar\/\/JJyC9yYuAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4456,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":643,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287499,"flow_last_seen":287499,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287499,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.39.142.122","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4456,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":643,"flow_packet_id":1,"flow_last_seen":287499,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287499,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4hoYAAIARPX4KAAIP3CeOenAJGMoAJO\/nqTExAl7uzN\/\/AnzFwRD\/AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4458,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":644,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287510,"flow_last_seen":287510,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287510,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"31.20.248.147","src_port":28681,"dst_port":30706,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4458,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":644,"flow_packet_id":1,"flow_last_seen":287510,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287510,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4sYAAAIARZX4KAAIPHxT4k3AJd\/IAJJLBYHsxAhtRQT7\/7FNlInUvAwABAAUAAADDglFLQA=="} +00506{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4460,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":548,"flow_packet_id":3,"flow_last_seen":287510,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":102,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":102,"pkt_l4_len":68,"thread_ts_msec":287510,"pkt":"UlQAEjUCCAAn5uVZCABFAABYETIAAIARP1UKAAIPSjKTzXAJRUcARFVcXS\/iNTECAGQaxPLpTglwD4ABACUAAAD5AHBpbmtmbG95ZADDAlFLSGqgzxGpqqqxA1NDUEABWkCCUFJA"} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4461,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_packet_id":3,"flow_last_seen":287510,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287510,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4zK0AAIARKS0KAAIPlRyjr3AJwyQAJGBIn7kxAuwDrqb\/F+I6wD1MAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4462,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":645,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287510,"flow_last_seen":287510,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287510,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.22.22.94","src_port":28681,"dst_port":34245,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4462,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":645,"flow_packet_id":1,"flow_last_seen":287510,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287510,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4nkUAAIARzOwKAAIPrRYWXnAJhcUAJDNBKq4xAgYwF03\/NgfX\/Xi7AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4463,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":377,"flow_packet_id":2,"flow_last_seen":287511,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287511,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4dTIAAIARGJ4KAAIPtMjsDXAJLzIAJA4k9ZAxAgoxLkf\/d90qtVTmAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4464,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":646,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287511,"flow_last_seen":287511,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287511,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":28681,"dst_port":49803,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4464,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":646,"flow_packet_id":1,"flow_last_seen":287511,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287511,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4faYAAIARyJIKAAIPO2itBXAJwosAJKMF2ZAxAtqv4AT\/Fb80TJ6XAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4465,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":647,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287511,"flow_last_seen":287511,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287511,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.10.152","src_port":28681,"dst_port":21293,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4465,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":647,"flow_packet_id":1,"flow_last_seen":287511,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287511,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4RnIAAIARuK8KAAIPJO0KmHAJUy0AJPl+XHkxAskuaNX\/HDK\/q6KcAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4466,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":648,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287511,"flow_last_seen":287511,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287511,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.18.212.223","src_port":28681,"dst_port":58290,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4466,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":648,"flow_packet_id":1,"flow_last_seen":287511,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287511,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Gc4AAIARAucKAAIPPRLU33AJ47IAJBnes4cxAkHUG2r\/LbR7NTt7AwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4467,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":649,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287511,"flow_last_seen":287511,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287511,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.218.135.222","src_port":28681,"dst_port":4548,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4467,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":649,"flow_packet_id":1,"flow_last_seen":287511,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287511,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4g+UAAIARbggKAAIPtNqH3nAJEcQAJO+G770xArTLEH7\/jQHeFbZ6AwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4468,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":650,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287512,"flow_last_seen":287512,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287512,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.117.100.78","src_port":28681,"dst_port":56128,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4468,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":650,"flow_packet_id":1,"flow_last_seen":287512,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287512,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4UCwAAIAR\/7YKAAIPenVkTnAJ20AAJHJOsW0xAnbjxuv\/\/HiNIhPOAwABAAUAAADDglFLQA=="} +00485{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4470,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":584,"flow_packet_id":2,"flow_last_seen":287522,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287522,"pkt":"CAAn5uVZUlQAEjUCCABFAABJCywAAEARZxZQwauSCgACD0e4cAkANfuZCBAxAnpBcnj\/3QdfvG\/iAwEBABYAAAC4R1DBq5IiAAAAAAAABMOCVVBDAQAD"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4472,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":651,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287523,"flow_last_seen":287523,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287523,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.47.227.91","src_port":28681,"dst_port":58856,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4472,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":651,"flow_packet_id":1,"flow_last_seen":287523,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287523,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4CF4AAIAR0L0KAAIPci\/jW3AJ5egAJPjap7IxApVwnk7\/0uKC7xajAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4473,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":652,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287523,"flow_last_seen":287523,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287523,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.64.156.63","src_port":28681,"dst_port":65023,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4473,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":652,"flow_packet_id":1,"flow_last_seen":287523,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287523,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4j14AAIARAckKAAIPAUCcP3AJ\/f8AJO+5lz0xAhibevD\/Qx72KfGGAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4474,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":653,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287523,"flow_last_seen":287523,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287523,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.139.21.182","src_port":28681,"dst_port":50110,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4474,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":653,"flow_packet_id":1,"flow_last_seen":287523,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287523,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4a\/MAAIARTnIKAAIPXosVtnAJw74AJB0B0VkxAqhkBKn\/L5QXH33+AwABAAUAAADDglFLQA=="} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4476,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":654,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287524,"flow_last_seen":287524,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287524,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.12.1.136","src_port":28681,"dst_port":6348,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4476,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":654,"flow_packet_id":1,"flow_last_seen":287524,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287524,"pkt":"UlQAEjUCCAAn5uVZCABFAAA47OMAAIAR7i4KAAIPUgwBiHAJGMwAJOVMPA8xApDPWCz\/B1toOQV6AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4477,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":388,"flow_packet_id":2,"flow_last_seen":287524,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287524,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ezQAAIARqUYKAAIPeQeRJHAJhHEAJIJEOt0xAl4OapX\/sxF+oJi+AwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4478,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":655,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287524,"flow_last_seen":287524,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287524,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.118.116.198","src_port":28681,"dst_port":44616,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4478,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":655,"flow_packet_id":1,"flow_last_seen":287524,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287524,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4QNUAAIARJJUKAAIPVHZ0xnAJrkgAJJ0QNNQxAr3qxML\/DEflBiRrAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4479,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":656,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287524,"flow_last_seen":287524,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287524,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":28681,"dst_port":2566,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4479,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":656,"flow_packet_id":1,"flow_last_seen":287524,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287524,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4q9EAAIARltEKAAIPd+10FnAJCgYAJNB+g8sxAsjmL\/\/\/+W9wv4kSAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4480,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":657,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287525,"flow_last_seen":287525,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287525,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":54914,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4480,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":657,"flow_packet_id":1,"flow_last_seen":287525,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287525,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4d88AAIAR7jgKAAIPcfxWonAJ1oIAJKxp+y0xAtdeZEv\/M0MLiIs3AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4481,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":658,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287525,"flow_last_seen":287525,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287525,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":28681,"dst_port":53195,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4481,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":658,"flow_packet_id":1,"flow_last_seen":287525,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287525,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4cDsAAIAR4CkKAAIPPd6gY3AJz8sAJBzA4aUxAqUUQ7b\/T4KVpwnGAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4482,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":659,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287525,"flow_last_seen":287525,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287525,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":28681,"dst_port":8075,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4482,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":659,"flow_packet_id":1,"flow_last_seen":287525,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287525,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4TE4AAIAR21wKAAIPdw6P7XAJH4sAJD0j5XoxApiKh9T\/xaAMVtckAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4483,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":660,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287525,"flow_last_seen":287525,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287525,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":10791,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4483,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":660,"flow_packet_id":1,"flow_last_seen":287525,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287525,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4y5gAAIAR2JMKAAIPchsYX3AJKicAJFzycEoxAhauS+b\/DT+f6g13AwABAAUAAADDglFLQA=="} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4484,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":381,"flow_packet_id":3,"flow_last_seen":287526,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287526,"pkt":"UlQAEjUCCAAn5uVZCABFAABUHO0AAIAR8S4KAAIPTTrTNHAJDt4AQF0iXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRLwOvkMDU0NQQAFaQIJQUkA="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4485,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":661,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287526,"flow_last_seen":287526,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287526,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":6527,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4485,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":661,"flow_packet_id":1,"flow_last_seen":287526,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287526,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4f+4AAIARjegKAAIPMjrulXAJGX8AJBvAOisxAiYf1xf\/54+utCWzAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4486,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":662,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287526,"flow_last_seen":287526,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287526,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.127.1.235","src_port":28681,"dst_port":37814,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4486,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":662,"flow_packet_id":1,"flow_last_seen":287526,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287526,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4cvoAAIARoUIKAAIPGH8B63AJk7YAJJQTdjIxAjwMxZH\/R7GLNFXlAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4489,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":663,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287532,"flow_last_seen":287532,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287532,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.59.117.166","src_port":28681,"dst_port":33192,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4489,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":663,"flow_packet_id":1,"flow_last_seen":287532,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287532,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4f2sAAIAR2VkKAAIPYDt1pnAJgagAJC22HGwxAndrsFf\/qZ9mRK3XAwABAAUAAADDglFLQA=="} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":629,"flow_packet_id":2,"flow_last_seen":287538,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":287538,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCzAAAEAR3wstQVcYCgACDz9JcAkANvi1lzoxAjbrndX\/A0LHiNtwAwEBABcAAABJPy1BVxhsAAAAAAAgAMOCUUtEjwL3nA=="} +00501{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4492,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":629,"flow_packet_id":3,"flow_last_seen":287539,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287539,"pkt":"UlQAEjUCCAAn5uVZCABFAABUuwEAAIAR7y8KAAIPLUFXGHAJP0kAQLx\/XS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRI8C95wDU0NQQAFaQIJQUkA="} +00492{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4493,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":644,"flow_packet_id":2,"flow_last_seen":287546,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"thread_ts_msec":287546,"pkt":"CAAn5uVZUlQAEjUCCABFAABOCzEAAEARS7gfFPiTCgACD3fycAkAOqIkYHsxAhtRQT7\/7FNlInUvAwEBABsAAADydx8U+JNEAAAAAAAgAMOCUUtIDsc7kg9JdUI="} +00485{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4494,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":520,"flow_packet_id":2,"flow_last_seen":287546,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287546,"pkt":"CAAn5uVZUlQAEjUCCABFAABJCzIAAEARK+S2m4DkCgACDw0LcAkANdqIJlgxAgeKfgb\/QAl\/goKTAwEBABYAAAALDbabgORxAAAAAAAABMOCVVBDAQEC"} +00507{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4495,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":644,"flow_packet_id":3,"flow_last_seen":287547,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":102,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":102,"pkt_l4_len":68,"thread_ts_msec":287547,"pkt":"UlQAEjUCCAAn5uVZCABFAABYsYEAAIARZV0KAAIPHxT4k3AJd\/IARKgyXS\/iNTECAGQaxPLpTglwD4ABACUAAAD5AHBpbmtmbG95ZADDAlFLSA7HO5IPSXVCA1NDUEABWkCCUFJA"} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4498,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":570,"flow_packet_id":2,"flow_last_seen":287556,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":287556,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCzQAAEARSnlhU7eUCgACDyK6cAkANv6K938xArfD0B\/\/j2thPytlAwEBABcAAAC6ImFTt5QAAAAACAAAAMOCUUtECWOmCA=="} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4499,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":572,"flow_packet_id":2,"flow_last_seen":287556,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":287556,"pkt":"CAAn5uVZUlQAEjUCCABFAABKCzUAAEAR92lWmRVdCgACD49YcAkANnIKKl4xAkn2d3j\/H9LA72kqAwEBABcAAABYj1aZFV3zAAAAAAAgAMOCUUtEnq8Y\/A=="} +00501{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4500,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":570,"flow_packet_id":3,"flow_last_seen":287557,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287557,"pkt":"UlQAEjUCCAAn5uVZCABFAABUs\/IAAIARYbAKAAIPYVO3lHAJIroAQBu0XS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRAljpggDU0NQQAFaQIJQUkA="} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4501,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":572,"flow_packet_id":3,"flow_last_seen":287557,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287557,"pkt":"UlQAEjUCCAAn5uVZCABFAABUmT4AAIARKVYKAAIPVpkVXXAJj1gAQFPHXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRJ6vGPwDU0NQQAFaQIJQUkA="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4503,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":664,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287573,"flow_last_seen":287573,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287573,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.163","src_port":28681,"dst_port":6594,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4503,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":664,"flow_packet_id":1,"flow_last_seen":287573,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287573,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4sKoAAIARXR4KAAIPMjruo3AJGcIAJJxxQOIxAiwR5H\/\/A0FXi02QAwABAAUAAADDglFLQA=="} +00501{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4508,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":379,"flow_packet_id":3,"flow_last_seen":287587,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287587,"pkt":"UlQAEjUCCAAn5uVZCABFAABUXhcAAIARQFQKAAIPUIw\/k3AJc2kAQLeMXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRLY4lXMDU0NQQAFaQIJQUkA="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4509,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":665,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287587,"flow_last_seen":287587,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287587,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.172.183.237","src_port":28681,"dst_port":4983,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4509,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":665,"flow_packet_id":1,"flow_last_seen":287587,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287587,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4gDYAAIAR9NYKAAIPAay37XAJE3cAJFumEpcxAgiXr7\/\/2lbLXOLdAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4510,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":666,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287588,"flow_last_seen":287588,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287588,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.36.106.134","src_port":28681,"dst_port":3927,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4510,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":666,"flow_packet_id":1,"flow_last_seen":287588,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287588,"pkt":"UlQAEjUCCAAn5uVZCABFAAA43PIAAIARlQkKAAIPUiRqhnAJD1cAJA8ak4oxAjgAPaP\/hNWMg9JHAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4511,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":667,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287588,"flow_last_seen":287588,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287588,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"159.196.95.223","src_port":28681,"dst_port":2003,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4511,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":667,"flow_packet_id":1,"flow_last_seen":287588,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287588,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4zm8AAIARYJMKAAIPn8Rf33AJB9MAJGm5aNUxAqxOVCz\/mvV75JXQAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4512,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":668,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287588,"flow_last_seen":287588,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287588,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.18.211.177","src_port":28681,"dst_port":18085,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4512,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":668,"flow_packet_id":1,"flow_last_seen":287588,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287588,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4pEYAAIAR15sKAAIP3xLTsXAJRqUAJIe4HvYxAigyRjH\/FUeQPwvwAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4513,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":669,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287589,"flow_last_seen":287589,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287589,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":64731,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4513,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":669,"flow_packet_id":1,"flow_last_seen":287589,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287589,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4sEYAAIARGPYKAAIP2meLAnAJ\/NsAJJxxzUAxAgNjbl7\/dS4o2dU\/AwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4514,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":670,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287589,"flow_last_seen":287589,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287589,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.200.235","src_port":28681,"dst_port":2846,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4514,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":670,"flow_packet_id":1,"flow_last_seen":287589,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287589,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4KVoAAIARYbwKAAIP2qTI63AJCx4AJLcJMiMxAoeFBdP\/7j2vJ1v6AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4516,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":671,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287599,"flow_last_seen":287599,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287599,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":28681,"dst_port":52669,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4516,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":671,"flow_packet_id":1,"flow_last_seen":287599,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287599,"pkt":"UlQAEjUCCAAn5uVZCABFAAA40EYAAIARbk4KAAIPJOzLJXAJzb0AJKgDLj8xApQmRAn\/N6Xl+M16AwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4517,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":672,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287599,"flow_last_seen":287599,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287599,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.218.135.222","src_port":28681,"dst_port":49867,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4517,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":672,"flow_packet_id":1,"flow_last_seen":287599,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287599,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4g+YAAIARbgcKAAIPtNqH3nAJwssAJDViKKgxAnjlEdj\/cQ2\/2K+2AwABAAUAAADDglFLQA=="} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4518,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":673,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287599,"flow_last_seen":287599,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287599,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.83.5","src_port":28681,"dst_port":4765,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4518,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":673,"flow_packet_id":1,"flow_last_seen":287599,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287599,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4D9oAAIAR7LYKAAIP3xBTBXAJEp0AJFUr+wExAqB5nCz\/DVvIGNE\/AwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4519,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":674,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287599,"flow_last_seen":287599,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287599,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"125.59.215.249","src_port":28681,"dst_port":14571,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4519,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":674,"flow_packet_id":1,"flow_last_seen":287599,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287599,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4HVYAAIARvBsKAAIPfTvX+XAJOOsAJCfnGBcxAs9tQX7\/w2tYVAbmAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4520,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":675,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287600,"flow_last_seen":287600,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287600,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.1.236","src_port":28681,"dst_port":9369,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4520,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":675,"flow_packet_id":1,"flow_last_seen":287600,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287600,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4tYkAAIARm+oKAAIP20YB7HAJJJkAJBECRKwxAt4\/ABb\/hxkC8dNEAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4521,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":676,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287600,"flow_last_seen":287600,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287600,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.118.77","src_port":28681,"dst_port":62191,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4521,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":676,"flow_packet_id":1,"flow_last_seen":287600,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287600,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4yLAAAIARc9sKAAIPe812TXAJ8u8AJPDAv5cxAuvpMAL\/jp3ukWCkAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4522,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":677,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287600,"flow_last_seen":287600,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287600,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.64.208.110","src_port":28681,"dst_port":55550,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4522,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":677,"flow_packet_id":1,"flow_last_seen":287600,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287600,"pkt":"UlQAEjUCCAAn5uVZCABFAAA419UAAIARhSIKAAIPAUDQbnAJ2P4AJBHjFBkxAsPyl+n\/cznHUWzNAwABAAUAAADDglFLQA=="} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4524,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":678,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287619,"flow_last_seen":287619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287619,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.83.5","src_port":28681,"dst_port":9128,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4524,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":678,"flow_packet_id":1,"flow_last_seen":287619,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287619,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4D9sAAIAR7LUKAAIP3xBTBXAJI6gAJELhIvwxAusiR4j\/8f2IxWvTAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4525,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":679,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287619,"flow_last_seen":287619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287619,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"150.116.225.105","src_port":28681,"dst_port":51438,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4525,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":679,"flow_packet_id":1,"flow_last_seen":287619,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287619,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4FOwAAIARodwKAAIPlnThaXAJyO4AJG4j2ZMxAqY9dtX\/ufEJpdJIAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4526,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":680,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287620,"flow_last_seen":287620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287620,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.83.132","src_port":28681,"dst_port":57131,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4526,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":680,"flow_packet_id":1,"flow_last_seen":287620,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287620,"pkt":"UlQAEjUCCAAn5uVZCABFAAA49qAAAIARcoUKAAIPcfxThHAJ3ysAJHYa7WAxAkWMX3b\/hjmo9dOoAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4527,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":681,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287620,"flow_last_seen":287620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287620,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.227.198.100","src_port":28681,"dst_port":6910,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4527,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":681,"flow_packet_id":1,"flow_last_seen":287620,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287620,"pkt":"UlQAEjUCCAAn5uVZCABFAAA407oAAIARVqQKAAIPPePGZHAJGv4AJN5lHCIxAr14S0P\/I9lo8haXAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4528,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":682,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287620,"flow_last_seen":287620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287620,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.220.41.241","src_port":28681,"dst_port":53072,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4528,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":682,"flow_packet_id":1,"flow_last_seen":287620,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287620,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4EYYAAIARtVMKAAIPPdwp8XAJz1AAJF6LLH8xAtZXHfH\/JrPq46o3AwABAAUAAADDglFLQA=="} +00485{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4529,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":575,"flow_packet_id":2,"flow_last_seen":287621,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287621,"pkt":"CAAn5uVZUlQAEjUCCABFAABJCz0AAEARyB17yh9xCgACD004cAkANaW\/3fcxApfnx0H\/RMwJgGjyAwEBABYAAAA4TXvKH3HdAQAAJLnyEcOCVVBDACAf"} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":683,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287621,"flow_last_seen":287621,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287621,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":50896,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":683,"flow_packet_id":1,"flow_last_seen":287621,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287621,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4TIgAAIART00KAAIPy9zG9HAJxtAAJN9thQwxAkMCBm7\/FTvBxMl9AwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4532,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":684,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287621,"flow_last_seen":287621,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287621,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":54459,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4532,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":684,"flow_packet_id":1,"flow_last_seen":287621,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287621,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4d9AAAIAR7jcKAAIPcfxWonAJ1LsAJAIyx3kxAgYKpY7\/aOt9S6g7AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4533,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":685,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287621,"flow_last_seen":287621,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287621,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":54436,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4533,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":685,"flow_packet_id":1,"flow_last_seen":287621,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287621,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4f+8AAIARjecKAAIPMjrulXAJ1KQAJOILYCMxAjXKOqv\/6SY4oPIVAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4534,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":686,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287622,"flow_last_seen":287622,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287622,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.241.31.96","src_port":28681,"dst_port":8349,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4534,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":686,"flow_packet_id":1,"flow_last_seen":287622,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287622,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4KI0AAIARdsgKAAIPb\/EfYHAJIJ0AJPzVnXIxAtRCP\/\/\/U6wSjk3sAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4535,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":687,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287622,"flow_last_seen":287622,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287622,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":28681,"dst_port":13965,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4535,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":687,"flow_packet_id":1,"flow_last_seen":287622,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287622,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4TE8AAIAR21sKAAIPdw6P7XAJNo0AJBLnDIExAt7B5Wr\/FSo0N8YCAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4536,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":688,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287623,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":53454,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4536,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":688,"flow_packet_id":1,"flow_last_seen":287623,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287623,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4DeQAAIARAO8KAAIPQh7dtXAJ0M4AJDBXQvUxAhR\/2YX\/K1Y5bdRvAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4537,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":689,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287623,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.36.234.196","src_port":28681,"dst_port":11629,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4537,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":689,"flow_packet_id":1,"flow_last_seen":287623,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287623,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ToQAAIARgzkKAAIPciTqxHAJLW0AJBhIXoAxAkriA03\/4x14cIOnAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4538,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":690,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287623,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.65.217.224","src_port":28681,"dst_port":3688,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4538,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":690,"flow_packet_id":1,"flow_last_seen":287623,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287623,"pkt":"UlQAEjUCCAAn5uVZCABFAAA49BgAAIARX2wKAAIPAUHZ4HAJDmgAJEQ+\/yExAvAJfMf\/6y9INj6FAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4539,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":691,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287623,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.18.212.223","src_port":28681,"dst_port":50637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4539,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":691,"flow_packet_id":1,"flow_last_seen":287623,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287623,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Gc8AAIARAuYKAAIPPRLU33AJxc0AJFg95bAxAucQY5v\/f+R9r9WQAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4540,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":692,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287624,"flow_last_seen":287624,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287624,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.93.150.146","src_port":28681,"dst_port":62507,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4540,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":692,"flow_packet_id":1,"flow_last_seen":287624,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287624,"pkt":"UlQAEjUCCAAn5uVZCABFAAA44a8AAIAReQcKAAIPPV2WknAJ9CsAJMTBJCQxAoJA4OH\/PAfqHONMAwABAAUAAADDglFLQA=="} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4541,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":592,"flow_packet_id":2,"flow_last_seen":287624,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287624,"pkt":"CAAn5uVZUlQAEjUCCABFAABJCz8AAEARaNcBJPlbCgACDxwWcAkANQxjIrYxApaxIKP\/Sf4biBFTAwEBABYAAAAWHAEk+VtoAAAAAAAACMOCVVBDAQAD"} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4542,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":693,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287624,"flow_last_seen":287624,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287624,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.110.153.177","src_port":28681,"dst_port":40022,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4542,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":693,"flow_packet_id":1,"flow_last_seen":287624,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287624,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4O4QAAIARDQMKAAIPTG6ZsXAJnFYAJPn8YrQxAnZtaQv\/n9b3vvUwAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4544,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":694,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287625,"flow_last_seen":287625,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287625,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.215.130.156","src_port":28681,"dst_port":12405,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4544,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":694,"flow_packet_id":1,"flow_last_seen":287625,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287625,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4QYUAAIARB64KAAIPYteCnHAJMHUAJDZ4DrQxAiqbwML\/ik8lSQqmAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4545,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":695,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287625,"flow_last_seen":287625,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287625,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":6514,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4545,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":695,"flow_packet_id":1,"flow_last_seen":287625,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287625,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4f\/AAAIARjeYKAAIPMjrulXAJGXIAJJ\/QywoxAh600cD\/Z0sXjxwVAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4547,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":696,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287635,"flow_last_seen":287635,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287635,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.189.72.230","src_port":28681,"dst_port":8161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4547,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":696,"flow_packet_id":1,"flow_last_seen":287635,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287635,"pkt":"UlQAEjUCCAAn5uVZCABFAAA419sAAIARwScKAAIPTL1I5nAJH+EAJHGdmxQxAhs79WL\/5rOWqttTAwABAAUAAADDglFLQA=="} +00486{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4548,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":582,"flow_packet_id":2,"flow_last_seen":287642,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287642,"pkt":"CAAn5uVZUlQAEjUCCABFAABJC0EAAEARMT\/fEFMFCgACDymAcAkANYrwAvsxAqD\/vTn\/+ILQeebyAwEBABYAAACAKd8QUwVbAAAAUuIIBsOCVVBDACAf"} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4549,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":579,"flow_packet_id":2,"flow_last_seen":287647,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287647,"pkt":"CAAn5uVZUlQAEjUCCABFAABJC0IAAEAR2dbfEKpsCgACD1uicAkANR9IQmYxAjlvsOX\/oIbrdPhZAwEBABYAAACiW98QqmwAAAAAAAAAAMOCVVBDACAf"} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4550,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":697,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287648,"flow_last_seen":287648,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287648,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":55050,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4550,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":697,"flow_packet_id":1,"flow_last_seen":287648,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287648,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4xQYAAIAR4TsKAAIPvKXLvnAJ1woAJG5n6fMxAkgngLv\/9SJanjBDAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4551,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":698,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287649,"flow_last_seen":287649,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287649,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.199.10.60","src_port":28681,"dst_port":53906,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4551,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":698,"flow_packet_id":1,"flow_last_seen":287649,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287649,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4SFcAAIARzUwKAAIPDscKPHAJ0pIAJEu2uwQxAtU0hKr\/xk0nZw+EAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4552,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":699,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287649,"flow_last_seen":287649,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287649,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"70.81.219.111","src_port":28681,"dst_port":19210,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4552,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":699,"flow_packet_id":1,"flow_last_seen":287649,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287649,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4p6oAAIARZTsKAAIPRlHbb3AJSwoAJOpkqYYxAsVQDcz\/Gcp7W8SLAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4554,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":700,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287650,"flow_last_seen":287650,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287650,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.222.213.44","src_port":28681,"dst_port":26536,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4554,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":700,"flow_packet_id":1,"flow_last_seen":287650,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287650,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4EC4AAIAR+20KAAIPTd7VLHAJZ6gAJD6\/j80xAmFomNX\/hJltpLzzAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4555,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":701,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287650,"flow_last_seen":287650,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287650,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.206.27.26","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4555,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":701,"flow_packet_id":1,"flow_last_seen":287650,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287650,"pkt":"UlQAEjUCCAAn5uVZCABFAAA497gAAIARwAUKAAIPW84bGnAJGbIAJGvVBNUxAmCShL7\/x+kiIK2UAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4556,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":702,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287651,"flow_last_seen":287651,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287651,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.190.184","src_port":28681,"dst_port":64163,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4556,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":702,"flow_packet_id":1,"flow_last_seen":287651,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287651,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4chMAAIARhe0KAAIPd+2+uHAJ+qMAJGQTatgxAgAitNP\/elk7XkwYAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4557,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":703,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287651,"flow_last_seen":287651,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287651,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":10728,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4557,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":703,"flow_packet_id":1,"flow_last_seen":287651,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287651,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4y5kAAIAR2JIKAAIPchsYX3AJKegAJMyryTsxAkvveEX\/LY19lANVAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4558,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":704,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287651,"flow_last_seen":287651,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287651,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.40.67.191","src_port":28681,"dst_port":14971,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4558,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":704,"flow_packet_id":1,"flow_last_seen":287651,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287651,"pkt":"UlQAEjUCCAAn5uVZCABFAAA40aUAAIARpxkKAAIPcihDv3AJOnsAJBfdxVoxAhq5U\/j\/FwVoiWG6AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4559,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":705,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287652,"flow_last_seen":287652,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287652,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.192.83.59","src_port":28681,"dst_port":33513,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4559,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":705,"flow_packet_id":1,"flow_last_seen":287652,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287652,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4rLMAAIARsvcKAAIPe8BTO3AJgukAJPoEj+8xAinDWtX\/DsHS0NmSAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4560,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":706,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287652,"flow_last_seen":287652,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287652,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":28681,"dst_port":8658,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4560,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":706,"flow_packet_id":1,"flow_last_seen":287652,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287652,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4FYQAAIARgjgKAAIPfNoaEHAJIdIAJCjPnVMxAjkNQeL\/paFX\/WDsAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4561,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":707,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287652,"flow_last_seen":287652,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287652,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.200.235","src_port":28681,"dst_port":1968,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4561,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":707,"flow_packet_id":1,"flow_last_seen":287652,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287652,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4KVsAAIARYbsKAAIP2qTI63AJB7AAJPeVODcxAvImcX3\/9qm0ZtA1AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4562,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":708,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287653,"flow_last_seen":287653,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287653,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.14.31","src_port":28681,"dst_port":64871,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4562,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":708,"flow_packet_id":1,"flow_last_seen":287653,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287653,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4fpoAAIAR6jkKAAIPt7MOH3AJ\/WcAJMojXCgxApxrrNj\/Fyhil+iSAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4563,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":709,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287653,"flow_last_seen":287653,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287653,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.244.68.65","src_port":28681,"dst_port":51967,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4563,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":709,"flow_packet_id":1,"flow_last_seen":287653,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287653,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4MWkAAIARPAgKAAIPfPREQXAJyv8AJMphmWQxAifMscf\/eKpY2cw3AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4564,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":710,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287653,"flow_last_seen":287653,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287653,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.121.156","src_port":28681,"dst_port":3624,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4564,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":710,"flow_packet_id":1,"flow_last_seen":287653,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287653,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4KvsAAIARqv4KAAIP3xB5nHAJDigAJLuYzT8xAgEvMjD\/L\/12cnnyAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4565,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":711,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287654,"flow_last_seen":287654,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287654,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.254.140.225","src_port":28681,"dst_port":63637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4565,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":711,"flow_packet_id":1,"flow_last_seen":287654,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287654,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4d4sAAIARuDsKAAIPcf6M4XAJ+JUAJLD2zz4xAsOA75z\/8iWSKOALAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4566,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":712,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287654,"flow_last_seen":287654,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287654,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.129.86.65","src_port":28681,"dst_port":49723,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4566,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":712,"flow_packet_id":1,"flow_last_seen":287654,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287654,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4iY0AAIARclYKAAIP3IFWQXAJwjsAJBVPjdUxAhcofkX\/cXC4fXJpAwABAAUAAADDglFLQA=="} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4570,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":550,"flow_packet_id":2,"flow_last_seen":287678,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":287678,"pkt":"CAAn5uVZUlQAEjUCCABFAABKC0cAAEAR9Qzc7pFSCgACD4L3cAkANqZmGNYxAt\/S407\/lCAJzVfnAwEBABcAAAD3gtzukVIAAAAACAAAAMOCUUtEjVPppA=="} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4572,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":550,"flow_packet_id":3,"flow_last_seen":287680,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287680,"pkt":"UlQAEjUCCAAn5uVZCABFAABUuG4AAIARB9sKAAIP3O6RUnAJgvcAQJ6QXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRI1T6aQDU0NQQAFaQIJQUkA="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4573,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":713,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287681,"flow_last_seen":287681,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287681,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":59978,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4573,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":713,"flow_packet_id":1,"flow_last_seen":287681,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287681,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4OJMAAIAR8aoKAAIPubtKrXAJ6koAJMbUmbcxAnjYq3f\/Qe30KGb7AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4574,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":714,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287681,"flow_last_seen":287681,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287681,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":51379,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4574,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":714,"flow_packet_id":1,"flow_last_seen":287681,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287681,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4sEcAAIARGPUKAAIP2meLAnAJyLMAJEZ8APMxAiBCN9P\/5if2N65XAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4575,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":715,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287681,"flow_last_seen":287681,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287681,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.174.174.69","src_port":28681,"dst_port":21358,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4575,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":715,"flow_packet_id":1,"flow_last_seen":287681,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287681,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4NKkAAIAR\/wkKAAIPTK6uRXAJU24AJNZmbNQxAu47+rD\/EwHlEKr4AwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4576,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":716,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287681,"flow_last_seen":287681,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287681,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.71.72.88","src_port":28681,"dst_port":58808,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4576,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":716,"flow_packet_id":1,"flow_last_seen":287681,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287681,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4il8AAIARgKcKAAIP20dIWHAJ5bgAJPUILL4xAuIMEpr\/LC3e4VtWAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4577,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":717,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287682,"flow_last_seen":287682,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287682,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.249.190.8","src_port":28681,"dst_port":25198,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4577,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":717,"flow_packet_id":1,"flow_last_seen":287682,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287682,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4bo8AAIARnxUKAAIPYvm+CHAJYm4AJEgeInkxArhOVjH\/k0WJ44hfAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4578,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":718,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287682,"flow_last_seen":287682,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287682,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"79.191.58.38","src_port":28681,"dst_port":48157,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4578,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":718,"flow_packet_id":1,"flow_last_seen":287682,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287682,"pkt":"UlQAEjUCCAAn5uVZCABFAAA404QAAIAR0TwKAAIPT786JnAJvB0AJIJ\/CokxAqH+MEX\/XGnRyq+rAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4579,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":719,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287682,"flow_last_seen":287682,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287682,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.102.208.175","src_port":28681,"dst_port":9167,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4579,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":719,"flow_packet_id":1,"flow_last_seen":287682,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287682,"pkt":"UlQAEjUCCAAn5uVZCABFAAA46GkAAIARmyYKAAIP2mbQr3AJI88AJCsVvS4xAnMqGwv\/P0F1axmTAwABAAUAAADDglFLQA=="} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4580,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":386,"flow_packet_id":2,"flow_last_seen":287682,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287682,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4jh8AAIARQIEKAAIPVawKWnAJnOIAJHZ3KKExAq\/poX\/\/aiJXlgDfAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4581,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":720,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287683,"flow_last_seen":287683,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287683,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.11.85","src_port":28681,"dst_port":10722,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4581,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":720,"flow_packet_id":1,"flow_last_seen":287683,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287683,"pkt":"UlQAEjUCCAAn5uVZCABFAAA49nQAAIARUYcKAAIP21ULVXAJKeIAJEyvFh8xApbjy7j\/JnywBV8tAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4582,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":721,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287683,"flow_last_seen":287683,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287683,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.26.178.132","src_port":28681,"dst_port":10053,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4582,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":721,"flow_packet_id":1,"flow_last_seen":287683,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287683,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ck8AAIARvbgKAAIPTBqyhHAJJ0UAJNhCYJYxAlKftbD\/Jdh0aoXbAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4583,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":722,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287683,"flow_last_seen":287683,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287683,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.203.72.224","src_port":28681,"dst_port":9897,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4583,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":722,"flow_packet_id":1,"flow_last_seen":287683,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287683,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4dj0AAIAR870KAAIPe8tI4HAJJqkAJC6YtzkxAvEZ08X\/fTkR\/pe3AwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4584,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":723,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287683,"flow_last_seen":287683,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287683,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.32.245.121","src_port":28681,"dst_port":12333,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4584,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":723,"flow_packet_id":1,"flow_last_seen":287683,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287683,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4WbwAAIARClAKAAIP1SD1eXAJMC0AJAJHu+IxAt+uv7z\/fU+645f5AwABAAUAAADDglFLQA=="} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4586,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_packet_id":3,"flow_last_seen":287694,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":287694,"pkt":"CAAn5uVZUlQAEjUCCABFAABKC0oAAEAR5eBi0BqaCgACDxOCcAkANh+fvRQxAnW20t7\/omLlUBNqAwEBABcAAACCE2LQGpojAQAAvrUWAMOCUUtESUIx6Q=="} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4588,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":574,"flow_packet_id":2,"flow_last_seen":287697,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287697,"pkt":"CAAn5uVZUlQAEjUCCABFAABJC0wAAEARACbfEYQSCgACD1uicAkANYOUXLYxArzGF4H\/cFjUFKBTAwEBABYAAACiW98RhBJuAAAA+KYpBMOCVVBDACAf"} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4590,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":724,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287697,"flow_last_seen":287697,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287697,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.39.219.223","src_port":28681,"dst_port":13482,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4590,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":724,"flow_packet_id":1,"flow_last_seen":287697,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287697,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4fjoAAIARJWUKAAIPryfb33AJNKoAJGCPZIgxAtw1\/j7\/z1ljnrwtAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4591,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":725,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287697,"flow_last_seen":287697,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287697,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.65.217.224","src_port":28681,"dst_port":9070,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4591,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":725,"flow_packet_id":1,"flow_last_seen":287697,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287697,"pkt":"UlQAEjUCCAAn5uVZCABFAAA49BkAAIARX2sKAAIPAUHZ4HAJI24AJPJ5kYMxAnYkkBj\/TvE8aNeiAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4592,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":726,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287698,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.91.30.216","src_port":28681,"dst_port":61635,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4592,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":726,"flow_packet_id":1,"flow_last_seen":287698,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287698,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4yhcAAIARalsKAAIP21se2HAJ8MMAJMH32bMxAt8CrX7\/ymE20gc+AwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4593,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":727,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287698,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.171.82.65","src_port":28681,"dst_port":50072,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4593,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":727,"flow_packet_id":1,"flow_last_seen":287698,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287698,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4p9QAAIARMuYKAAIPAatSQXAJw5gAJKW11bMxAmSO2bj\/tgTkRF1qAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4594,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":728,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287698,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"101.136.187.253","src_port":28681,"dst_port":10914,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4594,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":728,"flow_packet_id":1,"flow_last_seen":287698,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287698,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4mV4AAIARc8IKAAIPZYi7\/XAJKqIAJD0St9oxArdPGtf\/VlCSQwjeAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4595,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":729,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287698,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.10.134.44","src_port":28681,"dst_port":19739,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4595,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":729,"flow_packet_id":1,"flow_last_seen":287698,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287698,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ZC0AAIAR1EIKAAIPcAqGLHAJTRsAJJDarSMxAgXqy93\/yzHaLW\/SAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4596,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":730,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287698,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.47.227.91","src_port":28681,"dst_port":54463,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4596,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":730,"flow_packet_id":1,"flow_last_seen":287698,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287698,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4CF8AAIAR0LwKAAIPci\/jW3AJ1L8AJE\/LcoQxAif9QuX\/MNJuuxCgAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4597,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":731,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287699,"flow_last_seen":287699,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287699,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.217.188.105","src_port":28681,"dst_port":62849,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4597,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":731,"flow_packet_id":1,"flow_last_seen":287699,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287699,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4cW8AAIARg\/QKAAIPfNm8aXAJ9YEAJE22HvQxArJUpAv\/je1HKYh8AwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4598,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":732,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287699,"flow_last_seen":287699,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287699,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.163","src_port":28681,"dst_port":6564,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4598,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":732,"flow_packet_id":1,"flow_last_seen":287699,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287699,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4sKsAAIARXR0KAAIPMjruo3AJGaQAJBn3AN4xAu\/9Tyz\/UQmnP7OnAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4599,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":733,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287699,"flow_last_seen":287699,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287699,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.168.34.105","src_port":28681,"dst_port":39908,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4599,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":733,"flow_packet_id":1,"flow_last_seen":287699,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287699,"pkt":"UlQAEjUCCAAn5uVZCABFAAA43DoAAIAR2loKAAIPVagiaXAJm+QAJCVnzWIxAurTz3b\/jMgMFonlAwABAAUAAADDglFLQA=="} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4603,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":624,"flow_packet_id":2,"flow_last_seen":287710,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287710,"pkt":"CAAn5uVZUlQAEjUCCABFAABJC08AAEARlyDS0flUCgACD2CvcAkANRSZkc0xAgfCDEv\/dAkm3EAmAwEBABYAAACvYNLR+VRLAAAAAAAIAMOCVVBDAQAD"} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4604,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":628,"flow_packet_id":2,"flow_last_seen":287713,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":287713,"pkt":"CAAn5uVZUlQAEjUCCABFAABKC1AAAEAROFFJPuG1CgACD7b7cAkANm7tbm8xAp1WIi7\/RMwucvQ\/AwEBABcAAAD7tkk+4bUAAAAACAAAAMOCUUtEVqGE6g=="} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4605,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":628,"flow_packet_id":3,"flow_last_seen":287714,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287714,"pkt":"UlQAEjUCCAAn5uVZCABFAABUI3cAAIAR4B8KAAIPST7htXAJtvsAQElGXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRFahhOoDU0NQQAFaQIJQUkA="} +00485{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4606,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":639,"flow_packet_id":2,"flow_last_seen":287719,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287719,"pkt":"CAAn5uVZUlQAEjUCCABFAABJC1EAAEARuce2m\/LhCgACDzrccAkANeaqpecxAl4nEaL\/XuFfzd0wAwEBABYAAADcOrab8uEcAAAAAAAAAcOCVVBDAQAE"} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4607,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":523,"flow_packet_id":2,"flow_last_seen":287724,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287724,"pkt":"CAAn5uVZUlQAEjUCCABFAABJC1IAAEAR1tkBoorICgACD13ScAkANTmMUgcxArifvu7\/9NP8y9zRAwEBABYAAADSXQGiishZAAAA3zQPA8OCVVBDACAf"} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4609,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":733,"flow_packet_id":2,"flow_last_seen":287743,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":287743,"pkt":"CAAn5uVZUlQAEjUCCABFAABKC1MAAEAR6zBVqCJpCgACD5vkcAkANohuzWIxAurTz3b\/jMgMFonlAwEBABcAAADkm1WoImkAAAAACAAAAMOCUUtEgaxsrQ=="} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4610,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":733,"flow_packet_id":3,"flow_last_seen":287743,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287743,"pkt":"UlQAEjUCCAAn5uVZCABFAABU3DsAAIAR2j0KAAIPVagiaXAJm+QAQARyXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRIGsbK0DU0NQQAFaQIJQUkA="} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4611,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":609,"flow_packet_id":2,"flow_last_seen":287749,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287749,"pkt":"CAAn5uVZUlQAEjUCCABFAABJC1QAAEARUqkBow72CgACD1ulcAkANZ9fdK8xAreqPWv\/EJ97nSTRAwEBABYAAAClWwGjDvYpAAAAAAAAAsOCVVBDAQAE"} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4612,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":617,"flow_packet_id":2,"flow_last_seen":287752,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":287752,"pkt":"CAAn5uVZUlQAEjUCCABFAABKC1UAAEAR3tbc0KeYCgACD3ekcAkANpviRhcxAoroF\/T\/2C63HF1NAwEBABcAAACkd9zQp5gAAAAACAAAAMOCUUtEOyVNzA=="} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4614,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":617,"flow_packet_id":3,"flow_last_seen":287753,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287753,"pkt":"UlQAEjUCCAAn5uVZCABFAABUWlkAAIART8gKAAIP3NCnmHAJd6QAQIHCXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRDslTcwDU0NQQAFaQIJQUkA="} +00486{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4615,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":656,"flow_packet_id":2,"flow_last_seen":287769,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287769,"pkt":"CAAn5uVZUlQAEjUCCABFAABJC1cAAEARdzt37XQWCgACDwoGcAkANadyg8sxAsjmL\/\/\/+W9wv4kSAwEBABYAAAAGCnftdBbcAAAAAAAAEMOCVVBDAQQD"} +00485{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4616,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":608,"flow_packet_id":2,"flow_last_seen":287781,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287781,"pkt":"CAAn5uVZUlQAEjUCCABFAABJC1gAAEAR0+xv8R9gCgACDxLOcAkANZMlnaAxAhfRa6T\/WluxI8gnAwEBABYAAADOEm\/xH2BnCAAAAAAAEMOCVVBDAQAE"} +00491{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4619,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":643,"flow_packet_id":2,"flow_last_seen":287794,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":287794,"pkt":"CAAn5uVZUlQAEjUCCABFAABKC1sAAEAR+JfcJ456CgACDxjKcAkANiF8qTExAl7uzN\/\/AnzFwRD\/AwEBABcAAADKGNwnjnoAAAAACAAAAMOCUUtE0hQ\/4A=="} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4620,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":643,"flow_packet_id":3,"flow_last_seen":287795,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287795,"pkt":"UlQAEjUCCAAn5uVZCABFAABUhocAAIARPWEKAAIP3CeOenAJGMoAQHFgXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRNIUP+ADU0NQQAFaQIJQUkA="} +00486{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4621,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":631,"flow_packet_id":2,"flow_last_seen":287805,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287805,"pkt":"CAAn5uVZUlQAEjUCCABFAABJC1wAAEAR3Up2qA9HCgACDw9bcAkANZQUOqQxAgODGv\/\/0lHd\/JWpAwEBABYAAABbD3aoD0cFAAAAAABAAMOCVVBDAQIE"} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4624,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":649,"flow_packet_id":2,"flow_last_seen":287824,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287824,"pkt":"CAAn5uVZUlQAEjUCCABFAABJC14AAEARJn+02ofeCgACDxHEcAkANRpD770xArTLEH7\/jQHeFbZ6AwEBABYAAADEEbTah94BAAAAAAAIAMOCVVBDAQAD"} +00513{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4625,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":630,"flow_packet_id":2,"flow_last_seen":287828,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"thread_ts_msec":287828,"pkt":"CAAn5uVZUlQAEjUCCABFAABZC18AAEARVHkOyP\/lCgACD7KOcAkARUDJPjAxAsAfMFX\/sUsJJdxUAwEBACYAAACOsg7I\/+X9DQAAAAAAAsMCRFVDgFEBAlZDRVBIRVg0glVQQwH\/AQ=="} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4626,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":663,"flow_packet_id":2,"flow_last_seen":287836,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":287836,"pkt":"CAAn5uVZUlQAEjUCCABFAABKC2AAAEARjVNgO3WmCgACD4GocAkANlmWHGwxAndrsFf\/qZ9mRK3XAwEBABcAAACogWA7daYAAAAACAAAAMOCUUtE5xKITA=="} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":699,"flow_packet_id":2,"flow_last_seen":287836,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":287836,"pkt":"CAAn5uVZUlQAEjUCCABFAABKC2EAAEARQXNGUdtvCgACD0sKcAkANtR2qYYxAsVQDcz\/Gcp7W8SLAwEBABcAAAAKS0ZR228YAAAAAAAgAMOCUUtEttJRfQ=="} +00501{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4628,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":663,"flow_packet_id":3,"flow_last_seen":287836,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287836,"pkt":"UlQAEjUCCAAn5uVZCABFAABUf2wAAIAR2TwKAAIPYDt1pnAJgagAQD\/YXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLROcSiEwDU0NQQAFaQIJQUkA="} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4629,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":699,"flow_packet_id":3,"flow_last_seen":287837,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":287837,"pkt":"UlQAEjUCCAAn5uVZCABFAABUp6sAAIARZR4KAAIPRlHbb3AJSwoAQJGmXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRLbSUX0DU0NQQAFaQIJQUkA="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4631,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":734,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287858,"flow_last_seen":287858,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287858,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.199.148.6","src_port":28681,"dst_port":4338,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4631,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":734,"flow_packet_id":1,"flow_last_seen":287858,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287858,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4IM0AAIARFgwKAAIPY8eUBnAJEPIAJJGfOCQxAqP7Lrf\/q906\/hAEAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4632,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":735,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287858,"flow_last_seen":287858,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287858,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.91.201","src_port":28681,"dst_port":4297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4632,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":735,"flow_packet_id":1,"flow_last_seen":287858,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287858,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4vEQAAIARpJwKAAIPcfxbyXAJEMkAJBAp6zExAtGkGaL\/5ZGP+oczAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4633,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":736,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287859,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":52420,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4633,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":736,"flow_packet_id":1,"flow_last_seen":287859,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287859,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4e5AAAIAR7YYKAAIPLR+YcHAJzMQAJKJfVtcxAindq57\/MsOtd0XpAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4634,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":737,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287859,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.166.252.163","src_port":28681,"dst_port":14391,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4634,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":737,"flow_packet_id":1,"flow_last_seen":287859,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287859,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4HL0AAIARnp8KAAIPdqb8o3AJODcAJBZgw6gxAmwwk+z\/TNdCP\/boAwABAAUAAADDglFLQA=="} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4635,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":738,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287859,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"174.115.127.251","src_port":28681,"dst_port":23897,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4635,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":738,"flow_packet_id":1,"flow_last_seen":287859,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287859,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4WXYAAIARpsEKAAIPrnN\/+3AJXVkAJJtzLLAxAhXpWZb\/RT35A4OAAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4636,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":739,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287859,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3256,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4636,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":739,"flow_packet_id":1,"flow_last_seen":287859,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287859,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Zd8AAIARkUcKAAIPtpuA5HAJDLgAJIDhvawxAtNkM\/j\/vkFyHdmbAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4637,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":740,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287859,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":19814,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4637,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":740,"flow_packet_id":1,"flow_last_seen":287859,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287859,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4530AAIAR\/EMKAAIPaJziSHAJTWYAJEcACpAxAo4dKor\/0+7C5xMMAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4638,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":741,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287859,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.25.47","src_port":28681,"dst_port":21293,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4638,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":741,"flow_packet_id":1,"flow_last_seen":287859,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287859,"pkt":"UlQAEjUCCAAn5uVZCABFAAA41yYAAIARGWQKAAIPJO0ZL3AJUy0AJOT3CgkxAgJpuqL\/Uph6CAqnAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4639,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":742,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287859,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":4364,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4639,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":742,"flow_packet_id":1,"flow_last_seen":287859,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287859,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ZeAAAIARkUYKAAIPtpuA5HAJEQwAJCY\/biMxAu3V\/2X\/PjO8vAfLAwABAAUAAADDglFLQA=="} +00485{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4640,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":722,"flow_packet_id":2,"flow_last_seen":287869,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287869,"pkt":"CAAn5uVZUlQAEjUCCABFAABJC2MAAEARnod7y0jgCgACDyapcAkANS3gtzkxAvEZ08X\/fTkR\/pe3AwEBABYAAACpJnvLSOBwAAAAQgM+BcOCVVBDACAf"} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4641,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":743,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287869,"flow_last_seen":287869,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287869,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":28681,"dst_port":36780,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4641,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":743,"flow_packet_id":1,"flow_last_seen":287869,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287869,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4StQAAIARbLAKAAIPwqO0fnAJj6wAJBJ9y10xAg2dZz3\/DsujCfdWAwABAAUAAADDglFLQA=="} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4643,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":720,"flow_packet_id":2,"flow_last_seen":287944,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":287944,"pkt":"CAAn5uVZUlQAEjUCCABFAABJC2UAAEARfIbbVQtVCgACDynicAkANVKMFh8xApbjy7j\/JnywBV8tAwEBABYAAADiKdtVC1UAAAAAAAAAAMOCVVBDACAf"} +00839{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4645,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":499,"flow_packet_id":2,"flow_last_seen":287954,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":348,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":348,"pkt_l4_len":314,"thread_ts_msec":287954,"pkt":"CAAn5uVZUlQAEjUCCABFAAFOC2cAAEAREDcBoVBSCgACDyHQcAkBOgsOR05EAf4dAQF4nOspZwx09GAJCT7CpZrkwOHCuDAg6IKiIgOQuX7rnC\/2Csog5vbNUQU1atogpq3DRtNF0fwg5ul7fKtUoo+BmCrvF0kbye8DMbWSihsWRe8AMW+tfZZk4wUWvR3KHfpI8wCY6WYg3iavBrZimzr3RiOw6K0l6i\/LA0+AmEVqnEHz4w6DmOXfJnvcEQSrLf\/O9uijqjpYgcS2phthYItPTbe3PiErCGLe6Vd6mO6nArbCXafSzmI7xGVXJ30LAbvhTmfW2kzdvWBHMtnJfJZQABumPsv1gRAD2G93ND9OFWMCa3vJfN\/AiBHELCj\/lPdJDiqqdalD9DiDA1swxJFABkQlsgjE20AGxHseLEGOOowMDAyx+o9MDZkYUqSOfHrpx1nADwDgXX0q"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4647,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":744,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287977,"flow_last_seen":287977,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":287977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"27.94.154.53","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4647,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":744,"flow_packet_id":1,"flow_last_seen":287977,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":287977,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4algAAIARDrsKAAIPG16aNXAJGMoAJMWMmUcxAseQ1uX\/V\/F+iK4\/AwABAAUAAADDglFLQA=="} +00490{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4659,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":744,"flow_packet_id":2,"flow_last_seen":288180,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":288180,"pkt":"CAAn5uVZUlQAEjUCCABFAABKC3IAAEARrY8bXpo1CgACDxjKcAkANu+qmUcxAseQ1uX\/V\/F+iK4\/AwEBABcAAADKGBtemjUqAAAAAAAgAMOCUUtExc9iDg=="} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4660,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":744,"flow_packet_id":3,"flow_last_seen":288181,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":288181,"pkt":"UlQAEjUCCAAn5uVZCABFAABUalkAAIARDp4KAAIPG16aNXAJGMoAQBCGXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRMXPYg4DU0NQQAFaQIJQUkA="} +00862{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4661,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":505,"flow_packet_id":2,"flow_last_seen":288223,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":362,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":362,"pkt_l4_len":328,"thread_ts_msec":288223,"pkt":"CAAn5uVZUlQAEjUCCABFAAFcC3MAAEAR+fEqAj4cCgACDxjzcAkBSCfaR05EAehYAQF4nOtpYgx09GAJCT7OpZrkwOGixWQn81lCgQHIVHl\/ddK3kH0gZpEaZ9D8uMMg5vqtc77YKyiDmOXfJnvcEVQDMW+761TaWWwHM0O5Qx9pHgAx7\/QrPUz3UwExT9\/jW6USfQzEvLVE\/WV54Amwgs6stZm6e8HmblPn3mgE0dZadXNR9HEQUyupuGFR9A4Q0\/aO5sepYkxg50hsa7oRBjbsTtvyoD1i+yHuXSRtJA92b\/XZujRPkaNgR\/L1v10UzQBibt8cVVCjpg02zGGj6aJofrBh6rNcHwgxgpinpttbn5AVBDEZFwYEXVBUBDELyj\/lfZIDW6zykvm+gREjhKl1qUMU6Au2YIhaIAMSIEAGxItABsTRQAZEpwdLkKMOIwMDQ6z+I1NDJoYUqSOfXvpxFvADANu7hIw="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4664,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":745,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":288355,"flow_last_seen":288355,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":288355,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":48250,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4664,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":745,"flow_packet_id":1,"flow_last_seen":288355,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":288355,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ptwAAIAR2SwKAAIPpIQKGXAJvHoAJCauo68xAuqK3ib\/VZWObCGFAwABAAUAAADDglFLQA=="} +00529{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4666,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":746,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":288409,"flow_last_seen":288409,"flow_idle_time":120000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":288409,"l3_proto":"ip4","src_ip":"164.132.10.25","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3} +00501{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4666,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":746,"flow_packet_id":1,"flow_last_seen":288409,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":288409,"pkt":"CAAn5uVZUlQAEjUCCABFwABUC3cAAH8BdMakhAoZCgACDwMDt94AAAAARQAAOKbcAAB\/EdosCgACD6SEChlwCbx6ACQmrqOvMQLqit4m\/1WVjmwhhQMAAQAFAAAAw4JRS0A="} +00607{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4666,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":746,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":288409,"flow_last_seen":288409,"flow_idle_time":120000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":288409,"l3_proto":"ip4","src_ip":"164.132.10.25","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":5.020679} +00852{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4671,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":517,"flow_packet_id":2,"flow_last_seen":288490,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":356,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":356,"pkt_l4_len":322,"thread_ts_msec":288490,"pkt":"CAAn5uVZUlQAEjUCCABFAAFWC3sAAEARmwMk76IbCgACDx8ycAkBQkS1R05EAVjxAQF4nOspZwx09GAJCT7CpZrkwOGi8n6RtJH8bgYgs0hiW9ONsGMg5p3WqpuLoo8zgBVcnfQtZB+Iedtdp9LOYjtYQWfW2kzdvWBtapxB8+MOg5haScUNi6J3gJi3lqi\/LA88AdYWyh36SPMAiLl+mzr3RiMwU+Wl1qUOUbCCO23Lg\/aI7Qcxq8\/WpXmKHAWr3Trni72CMtgENwPxNnk1ELP8O9ujj6rqYCZf\/9tF0Qxg5rfJHncEwQps72h+nCrGBHYOk53MZwkFEHP75qiCGjVtsAKHjaaLovnBTlef5fpAiBHEPDXd3vqErCCIybgwIOiCojzEkcz3DYyACtiCIaJABiSYgIw7\/UoP0\/2ADIhDgAyI9zxYghx1GBkYGGL1H5kaMjGkSB359NKPs4AfAD6Dfz4="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4683,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":747,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":289961,"flow_last_seen":289961,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":289961,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.126.102","src_port":28681,"dst_port":5193,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4683,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":747,"flow_packet_id":1,"flow_last_seen":289961,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":289961,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4bogAAIARxeoKAAIPe81+ZnAJFEkAJPn9btcxAoLvbJD\/ZQI2cb+qAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4684,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":748,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":289962,"flow_last_seen":289962,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":289962,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.163","src_port":28681,"dst_port":6599,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4684,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":748,"flow_packet_id":1,"flow_last_seen":289962,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":289962,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4sKwAAIARXRwKAAIPMjruo3AJGccAJDyJx1gxAsRrZ4n\/2PSkvDNpAwABAAUAAADDglFLQA=="} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4690,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":747,"flow_packet_id":2,"flow_last_seen":290166,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":290166,"pkt":"CAAn5uVZUlQAEjUCCABFAABJC4gAAEARaNp7zX5mCgACDxRJcAkANUCbbtcxAoLvbJD\/ZQI2cb+qAwEBABYAAABJFHvNfmYEAAAArUsUAMOCVVBDACAf"} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4701,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":569,"flow_packet_id":2,"flow_last_seen":291154,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":291154,"pkt":"CAAn5uVZUlQAEjUCCABFAABKC5AAAEARIKNJWfkICgACD8XZcAkANp0565kxAgUhZoj\/+H2oSNwcAwEBABcAAADZxUlZ+Qi8AAAAAAAgAMOCUUtE05ynKA=="} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4702,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":569,"flow_packet_id":3,"flow_last_seen":291154,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":291154,"pkt":"UlQAEjUCCAAn5uVZCABFAABUghEAAIARahcKAAIPSVn5CHAJxdkAQIPAXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRNOcpygDU0NQQAFaQIJQUkA="} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4717,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":335,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":115369,"flow_last_seen":287650,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":407,"flow_avg_l4_payload_len":50,"midstream":0,"thread_ts_msec":292578,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":28681,"dst_port":37058,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00568{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4717,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_state":"info","flow_packets_processed":11,"flow_first_seen":116628,"flow_last_seen":287381,"flow_idle_time":180000,"flow_min_l4_payload_len":56,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3123,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":292578,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":6888,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00583{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":338,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":123912,"flow_last_seen":124065,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":808,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.198.205.196","src_port":28681,"dst_port":20778,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00568{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":338,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":123912,"flow_last_seen":124065,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":808,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.198.205.196","src_port":28681,"dst_port":20778,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":350,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129345,"flow_last_seen":129345,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.250.253.99","src_port":28681,"dst_port":11819,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":350,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129345,"flow_last_seen":129345,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.250.253.99","src_port":28681,"dst_port":11819,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":343,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.212.91.155","src_port":28681,"dst_port":5195,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":343,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124090,"flow_last_seen":124090,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.212.91.155","src_port":28681,"dst_port":5195,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":348,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.197.97.94","src_port":28681,"dst_port":1360,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":348,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.197.97.94","src_port":28681,"dst_port":1360,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":346,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":129174,"flow_last_seen":129344,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":808,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.226.85.105","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":346,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":129174,"flow_last_seen":129344,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":808,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.226.85.105","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":96049,"flow_last_seen":129345,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.28.53.225","src_port":28681,"dst_port":44859,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":327,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":96049,"flow_last_seen":129345,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.28.53.225","src_port":28681,"dst_port":44859,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":337,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.116.64.132","src_port":28681,"dst_port":51227,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":337,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":123912,"flow_last_seen":123912,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.116.64.132","src_port":28681,"dst_port":51227,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":347,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.10.169.10","src_port":28681,"dst_port":12799,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":347,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":129174,"flow_last_seen":129174,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.10.169.10","src_port":28681,"dst_port":12799,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":96049,"flow_last_seen":129345,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.1.231.138","src_port":28681,"dst_port":56558,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":326,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":96049,"flow_last_seen":129345,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.1.231.138","src_port":28681,"dst_port":56558,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":341,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124066,"flow_last_seen":124066,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.129.233.60","src_port":28681,"dst_port":19990,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":341,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":124066,"flow_last_seen":124066,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.129.233.60","src_port":28681,"dst_port":19990,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":124066,"flow_last_seen":287321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":836,"flow_avg_l4_payload_len":278,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49732,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":124090,"flow_last_seen":287421,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":269,"flow_avg_l4_payload_len":53,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"207.38.163.228","src_port":28681,"dst_port":6778,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":124090,"flow_last_seen":287890,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":269,"flow_avg_l4_payload_len":53,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.208.26.154","src_port":28681,"dst_port":4994,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4821,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":339,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":123912,"flow_last_seen":287321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":109,"flow_avg_l4_payload_len":54,"midstream":0,"thread_ts_msec":302977,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":54130,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4904,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":161,"flow_packet_id":3,"flow_last_seen":311749,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":311749,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0tpYAAIARiEUKAAIP1XgaVnAJdPoAIL2TR05EED\/KAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4909,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":3,"flow_last_seen":311750,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":311750,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0dUEAAIARISUKAAIPsKPnoHAJGMoAIHFJR05EED\/PAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4911,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":3,"flow_last_seen":311750,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":311750,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0SbsAAIARjAIKAAIPdqbiRnAJGMoAILCeR05EED\/RAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4913,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":3,"flow_last_seen":311751,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":311751,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0f7AAAIAR17gKAAIPd+BfYXAJtRQAIJX9R05EED\/TAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4917,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":485,"flow_packet_id":2,"flow_last_seen":311751,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":311751,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0fvkAAIAR6twKAAIPmgMq0XAJGMoAIESxR05EED\/XAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4918,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":3,"flow_last_seen":311751,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":311751,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0uoIAAIARu5cKAAIPXFhcOHAJUhEAIBetR05EED\/YAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4924,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":3,"flow_last_seen":311752,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":311752,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0tBQAAIAREWIKAAIPUTIYAnAJRdIAIHNCR05EED\/eAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4940,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":486,"flow_packet_id":2,"flow_last_seen":312955,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312955,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0rswAAIAR+c4KAAIPWEQty3AJGMoAIINuR05EED\/fAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4941,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":176,"flow_packet_id":3,"flow_last_seen":312955,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312955,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0nFIAAIARxPAKAAIPKWOkBHAJGMoAIDwVR05EED\/gAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4942,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":184,"flow_packet_id":3,"flow_last_seen":312955,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312955,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09AwAAIARpNkKAAIPVu8+1XAJGMoAIHO3R05EED\/hAQFUC1FLUlAGUk5BXS\/iNQlw"} +00458{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4945,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":180,"flow_packet_id":3,"flow_last_seen":312955,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312955,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0amkAAIARaXYKAAIPQoMYSHAJd\/cAIE+AR05EED\/kAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4946,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":3,"flow_last_seen":312955,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312955,"pkt":"UlQAEjUCCAAn5uVZCABFAAA01LYAAIARp3sKAAIPXINV9XAJe\/8AIPPJR05EED\/lAQFUC1FLUlAGUk5BXS\/iNQlw"} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4948,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":749,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":312956,"flow_last_seen":312956,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":312956,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.8.59.80","src_port":28681,"dst_port":35192,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4948,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":749,"flow_packet_id":1,"flow_last_seen":312956,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312956,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0aoYAAIARLMwKAAIPXAg7UHAJiXgAIAFvR05EED\/nAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4950,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":167,"flow_packet_id":3,"flow_last_seen":312956,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312956,"pkt":"UlQAEjUCCAAn5uVZCABFAAA08GcAAIARdXUKAAIPXR1rsHAJT4sAIAnlR05EED\/pAQFUC1FLUlAGUk5BXS\/iNQlw"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4952,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":750,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":312956,"flow_last_seen":312956,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":312956,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.159.27.22","src_port":28681,"dst_port":17563,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4952,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":750,"flow_packet_id":1,"flow_last_seen":312956,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312956,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0JvEAAIARngQKAAIPTp8bFnAJRJsAIHPrR05EED\/rAQFUC1FLUlAGUk5BXS\/iNQlw"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4953,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":751,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":312956,"flow_last_seen":312956,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":312956,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"67.193.8.52","src_port":28681,"dst_port":38584,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4953,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":751,"flow_packet_id":1,"flow_last_seen":312956,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312956,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0mmwAAIARSEkKAAIPQ8EINHAJlrgAID+NR05EED\/sAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4955,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":3,"flow_last_seen":312957,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312957,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0djgAAIARTnoKAAIPVYoUbnAJGMoAIJ92R05EED\/uAQFUC1FLUlAGUk5BXS\/iNQlw"} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4958,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":752,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":312957,"flow_last_seen":312957,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":312957,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.115.218.152","src_port":28681,"dst_port":5900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4958,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":752,"flow_packet_id":1,"flow_last_seen":312957,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312957,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0D1AAAIARtk4KAAIPjnPamHAJFwwAIKIdR05EED\/xAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4959,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":3,"flow_last_seen":312957,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312957,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05pQAAIARsCAKAAIPTudJDnAJGMoAIHF1R05EED\/yAQFUC1FLUlAGUk5BXS\/iNQlw"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4960,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":753,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":312961,"flow_last_seen":312961,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":312961,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.84.140.96","src_port":28681,"dst_port":14400,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4960,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":753,"flow_packet_id":1,"flow_last_seen":312961,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":312961,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0s80AAIARSSgKAAIPpVSMYHAJOEAAILg+R05EED\/zAQFUC1FLUlAGUk5BXS\/iNQlw"} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":329,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":101122,"flow_last_seen":134428,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.117.249.98","src_port":28681,"dst_port":6815,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":329,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":101122,"flow_last_seen":134428,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.117.249.98","src_port":28681,"dst_port":6815,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":328,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":101122,"flow_last_seen":134428,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.105.27","src_port":28681,"dst_port":19260,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":328,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":101122,"flow_last_seen":134428,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":162,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.105.27","src_port":28681,"dst_port":19260,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":354,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":132833,"flow_last_seen":132833,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.236.247.120","src_port":28681,"dst_port":1032,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":354,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":132833,"flow_last_seen":132833,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.236.247.120","src_port":28681,"dst_port":1032,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":95754,"flow_last_seen":139756,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.217.84.16","src_port":28681,"dst_port":20223,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":315,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":95754,"flow_last_seen":139756,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.217.84.16","src_port":28681,"dst_port":20223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":353,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":132831,"flow_last_seen":132831,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.181.151.217","src_port":28681,"dst_port":25282,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":353,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":132831,"flow_last_seen":132831,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.181.151.217","src_port":28681,"dst_port":25282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":358,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139669,"flow_last_seen":139669,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.224.174.174","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":358,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139669,"flow_last_seen":139669,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.224.174.174","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":357,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.35.85.238","src_port":28681,"dst_port":32173,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":357,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":139506,"flow_last_seen":139506,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":81,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.35.85.238","src_port":28681,"dst_port":32173,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":90,"flow_state":"info","flow_packets_processed":11,"flow_first_seen":71204,"flow_last_seen":193763,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.62.225.181","src_port":50245,"dst_port":46843,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":90,"flow_state":"info","flow_packets_processed":11,"flow_first_seen":71204,"flow_last_seen":193763,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.62.225.181","src_port":50245,"dst_port":46843,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00583{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":95784,"flow_last_seen":139896,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.183.183.110","src_port":28681,"dst_port":59920,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00568{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":318,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":95784,"flow_last_seen":139896,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.183.183.110","src_port":28681,"dst_port":59920,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":95715,"flow_last_seen":139730,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2424,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.188.98","src_port":28681,"dst_port":62851,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":311,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":95715,"flow_last_seen":139730,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2424,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.188.98","src_port":28681,"dst_port":62851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00583{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":300,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":90809,"flow_last_seen":139723,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1817,"flow_avg_l4_payload_len":227,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00568{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":300,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":90809,"flow_last_seen":139723,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1817,"flow_avg_l4_payload_len":227,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":95923,"flow_last_seen":139892,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.250.179.237","src_port":28681,"dst_port":20848,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":324,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":95923,"flow_last_seen":139892,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.250.179.237","src_port":28681,"dst_port":20848,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":164,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131671,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.197.219.85","src_port":28681,"dst_port":26234,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":164,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131671,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.197.219.85","src_port":28681,"dst_port":26234,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":165,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131670,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.75.43.182","src_port":28681,"dst_port":43502,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":165,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131670,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.75.43.182","src_port":28681,"dst_port":43502,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":188,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":131669,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.134.107.32","src_port":28681,"dst_port":38836,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":188,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":131669,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.134.107.32","src_port":28681,"dst_port":38836,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":177,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82061,"flow_last_seen":132833,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.157.183.106","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":177,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82061,"flow_last_seen":132833,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.157.183.106","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":182,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":131672,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.3.103.37","src_port":28681,"dst_port":35589,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":182,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82062,"flow_last_seen":131672,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.3.103.37","src_port":28681,"dst_port":35589,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":351,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":131668,"flow_last_seen":131668,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"187.37.87.189","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":351,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":131668,"flow_last_seen":131668,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"187.37.87.189","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":163,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131673,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.126.160.158","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":163,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":82059,"flow_last_seen":131673,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.126.160.158","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":352,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":131671,"flow_last_seen":251736,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.191.49.159","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":139506,"flow_last_seen":177166,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1954,"flow_avg_l4_payload_len":325,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"63.228.175.169","src_port":28681,"dst_port":1936,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":4964,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":139506,"flow_last_seen":168554,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":313025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.118.53.212","src_port":28681,"dst_port":29998,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5033,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":528,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4TFkAAIARXF4KAAIPdqgPR3AJ5EoAJEU1rxgxAkijNFD\/98wlZJR4AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5034,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":529,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4bmsAAIARqKcKAAIPdPGionAJ4kkAJCDgNOsxArkJ75n\/2X37nQtxAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5035,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":530,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4R1AAAIARd9IKAAIPdqf43HAJ56gAJBG+sRMxAjM8jgr\/OCOtVAIyAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5036,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":531,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4sEgAAIARGPQKAAIP2meLAnAJySkAJO7P1wwxAkC6JLj\/TunihRi8AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5037,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":532,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4y5oAAIAR2JEKAAIPchsYX3AJKbUAJGnG7ZMxAk627wP\/vivVIlXtAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5038,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":533,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Yf4AAIAR7oYKAAIPJOW5PHAJGvIAJNST+ZQxAkO6wk3\/ma72+FgQAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5039,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":534,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4d9EAAIAR7jYKAAIPcfxWonAJ1KQAJAhGKi8xArw9UyH\/tKz0amyOAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5040,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":535,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4y5sAAIAR2JAKAAIPchsYX3AJKZ8AJD4fYlUxAhXuHcD\/nuO6wJdYAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5041,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":536,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA472sAAIAR6fIKAAIPdqfeoHAJ2zkAJMr5DuYxAkfZrpr\/se18qCjuAwABAAUAAADDglFLQA=="} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5042,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":537,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4KVwAAIARYboKAAIP2qTI63AJB\/IAJMdmqeAxAooxZ\/n\/mq1PvE4MAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5043,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":538,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4KcoAAIARXgUKAAIPfNop\/XAJOAMAJHioLG4xAmNxh7T\/I1o87rXNAwABAAUAAADDglFLQA=="} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5044,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":539,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4TFAAAIAR21oKAAIPdw6P7XAJHVYAJCSnGhExArmGzX\/\/\/JZuTrG1AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5045,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":540,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA40EcAAIARbk0KAAIPJOzLJXAJy6MAJNlLJtYxAk2FiLv\/M4E3WaoYAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5046,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":541,"flow_packet_id":2,"flow_last_seen":320290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320290,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4y5wAAIAR2I8KAAIPchsYX3AJK4UAJMLpZoQxAn2942v\/DlcRMna7AwABAAUAAADDglFLQA=="} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5047,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":542,"flow_packet_id":2,"flow_last_seen":320291,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320291,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4sEkAAIARGPMKAAIP2meLAnAJydsAJGHLWnMxAuN1Q6H\/5\/AJwp+\/AwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5048,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":543,"flow_packet_id":2,"flow_last_seen":320291,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320291,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4HigAAIAR\/xoKAAIPciefPHAJ3kAAJLYhjTExAl5wERX\/G1g2U143AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5049,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":544,"flow_packet_id":2,"flow_last_seen":320291,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320291,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4aA4AAIAROb0KAAIPb7gdI3AJd3YAJJvdtwgxAsQVMM7\/oEMTV12eAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5050,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":545,"flow_packet_id":2,"flow_last_seen":320291,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320291,"pkt":"UlQAEjUCCAAn5uVZCABFAAA48boAAIARKW0KAAIPdDGfTXAJ2msAJHDFVm0xAvaYf2r\/MFtIdZOJAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5051,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":546,"flow_packet_id":2,"flow_last_seen":320291,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320291,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4pCIAAIAR7AsKAAIPJo536nAJwssAJEiflb8xApVXJK3\/K3HjJnbzAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5052,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":547,"flow_packet_id":2,"flow_last_seen":320291,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320291,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4AsgAAIAR5hgKAAIP1eVv4HAJqTQAJJx8JA0xAolzvgn\/XGR1y1leAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5053,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":551,"flow_packet_id":2,"flow_last_seen":320291,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320291,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4y1EAAIARhVYKAAIPXBiB5nAJOa4AJEG3q4QxAndUZHL\/3BhfQEJLAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5054,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":552,"flow_packet_id":2,"flow_last_seen":320291,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320291,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4LSMAAIARIE4KAAIP2voGO3AJ6mwAJPNP13sxAu2zNJH\/IMKl\/7MKAwABAAUAAADDglFLQA=="} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5055,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":553,"flow_packet_id":2,"flow_last_seen":320291,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320291,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ZeEAAIARkUUKAAIPtpuA5HAJDLsAJBY\/7TExArJpj5b\/\/A5oKBzEAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5056,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":554,"flow_packet_id":2,"flow_last_seen":320291,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320291,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4dj4AAIAR87wKAAIPe8tI4HAJ2RkAJGbpfq8xAqZmc5L\/TCSigedBAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5057,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":555,"flow_packet_id":2,"flow_last_seen":320291,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320291,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4FYUAAIARgjcKAAIPfNoaEHAJT6MAJCID3\/gxArbi8p3\/2niO+7l+AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5058,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":556,"flow_packet_id":2,"flow_last_seen":320292,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320292,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4facAAIARyJEKAAIPO2itBXAJwnsAJNF+TGcxAops6Tj\/Y6JiUfJUAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5059,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":557,"flow_packet_id":2,"flow_last_seen":320292,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320292,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4cDwAAIAR4CgKAAIPPd6gY3AJz6sAJKXzr7oxAk\/Bq37\/cO0GddojAwABAAUAAADDglFLQA=="} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5060,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":558,"flow_packet_id":2,"flow_last_seen":320292,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320292,"pkt":"UlQAEjUCCAAn5uVZCABFAAA41kcAAIARs\/MKAAIPcGk0AnAJGUIAJGdtDlQxAveqBxH\/Php+\/UU7AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5061,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":559,"flow_packet_id":2,"flow_last_seen":320292,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320292,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4d9IAAIAR7jUKAAIPcfxWonAJ1ygAJCpuresxAnPaYK7\/lNiShFvbAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5062,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":560,"flow_packet_id":2,"flow_last_seen":320292,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320292,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4TFoAAIARXF0KAAIPdqgPR3AJ0nsAJJ4vhU0xAq1rZb7\/U0S1ohIPAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5063,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":561,"flow_packet_id":2,"flow_last_seen":320292,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320292,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4GZ8AAIARKZkKAAIPPe6tgHAJ4HoAJD6HjZMxAkm78\/b\/1pyBkh6AAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5064,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":562,"flow_packet_id":2,"flow_last_seen":320292,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320292,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4CAEAAIARw78KAAIPcHfybnAJ6ecAJJt6ZMkxArsJiWn\/2NtEIIr3AwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5065,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":664,"flow_packet_id":2,"flow_last_seen":320293,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320293,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4sK0AAIARXRsKAAIPMjruo3AJGcIAJO3IbAsxAnYtXYL\/8bz\/pBe7AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5066,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":696,"flow_packet_id":2,"flow_last_seen":320293,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":320293,"pkt":"UlQAEjUCCAAn5uVZCABFAAA419wAAIARwSYKAAIPTL1I5nAJH+EAJBtk6eoxAtFG13r\/NLEu9DR8AwABAAUAAADDglFLQA=="} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":89967,"flow_last_seen":152618,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":333448,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.203.218.92","src_port":28681,"dst_port":56962,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":251,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":89967,"flow_last_seen":152618,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":333448,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.203.218.92","src_port":28681,"dst_port":56962,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":89966,"flow_last_seen":152619,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":333448,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.218","src_port":28681,"dst_port":6909,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5204,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":249,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":89966,"flow_last_seen":152619,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":333448,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.88.117.218","src_port":28681,"dst_port":6909,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":95216,"flow_last_seen":162802,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.201.208.57","src_port":28681,"dst_port":38617,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":307,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":95216,"flow_last_seen":162802,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.201.208.57","src_port":28681,"dst_port":38617,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90072,"flow_last_seen":163183,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.26.216.95","src_port":28681,"dst_port":13889,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":258,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90072,"flow_last_seen":163183,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.26.216.95","src_port":28681,"dst_port":13889,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":359,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":160009,"flow_last_seen":163034,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":51685,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90039,"flow_last_seen":163151,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":50297,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":256,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90039,"flow_last_seen":163151,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":50297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00583{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":139506,"flow_last_seen":168554,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.118.53.212","src_port":28681,"dst_port":29998,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00568{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":355,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":139506,"flow_last_seen":168554,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1616,"flow_avg_l4_payload_len":404,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.118.53.212","src_port":28681,"dst_port":29998,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":101122,"flow_last_seen":168840,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2737,"flow_avg_l4_payload_len":342,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.64.44.11","src_port":28681,"dst_port":1352,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":330,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":101122,"flow_last_seen":168840,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2737,"flow_avg_l4_payload_len":342,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.64.44.11","src_port":28681,"dst_port":1352,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90004,"flow_last_seen":163118,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.140.120.41","src_port":28681,"dst_port":47739,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":252,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90004,"flow_last_seen":163118,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":81,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"72.140.120.41","src_port":28681,"dst_port":47739,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":168555,"flow_last_seen":287464,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2374,"flow_avg_l4_payload_len":237,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":28681,"dst_port":9915,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5304,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":168594,"flow_last_seen":176963,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1959,"flow_avg_l4_payload_len":326,"midstream":0,"thread_ts_msec":343454,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.192.210.182","src_port":28681,"dst_port":6754,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00500{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5372,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":383,"flow_packet_id":3,"flow_last_seen":350801,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":350801,"pkt":"UlQAEjUCCAAn5uVZCABFAABUUWcAAIARlZ8KAAIPVEfzPHAJhsIAQN+fXS\/iNTECAGQaxPLpTglwD4ABACEAAAD5AHBpbmtmbG95ZADDAlFLRO45aqEDU0NQQAFaQIJQUkA="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5381,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":573,"flow_packet_id":2,"flow_last_seen":350982,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":350982,"pkt":"UlQAEjUCCAAn5uVZCABFAAA49UMAAIARRGEKAAIPR++tEnAJWx8AJJ\/UjSsxAo9FSZH\/5RaddLKjAwABAAUAAADDglFLQA=="} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5386,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":573,"flow_packet_id":3,"flow_last_seen":351110,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":351110,"pkt":"CAAn5uVZUlQAEjUCCABFAABKDVAAAEARbENH760SCgACD1sfcAkANlLBjSsxAo9FSZH\/5RaddLKjAwEBABcAAAAfW0fvrRIAAAAACAAAAMOCUUtEmW5VTg=="} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":89829,"flow_last_seen":174528,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3570,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.84.178.16","src_port":28681,"dst_port":60262,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":247,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":89829,"flow_last_seen":174528,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3570,"flow_avg_l4_payload_len":357,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"181.84.178.16","src_port":28681,"dst_port":60262,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":366,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":180000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.8.55.158","src_port":28681,"dst_port":51140,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":366,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":180000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.8.55.158","src_port":28681,"dst_port":51140,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00583{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_state":"info","flow_packets_processed":12,"flow_first_seen":95264,"flow_last_seen":176255,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.220.186.140","src_port":28681,"dst_port":27641,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00568{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":309,"flow_state":"info","flow_packets_processed":12,"flow_first_seen":95264,"flow_last_seen":176255,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.220.186.140","src_port":28681,"dst_port":27641,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":365,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":180000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.23.24.213","src_port":28681,"dst_port":18561,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":365,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174322,"flow_last_seen":174322,"flow_idle_time":180000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.23.24.213","src_port":28681,"dst_port":18561,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_state":"info","flow_packets_processed":12,"flow_first_seen":95443,"flow_last_seen":176562,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.240.69.199","src_port":28681,"dst_port":6348,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":310,"flow_state":"info","flow_packets_processed":12,"flow_first_seen":95443,"flow_last_seen":176562,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4383,"flow_avg_l4_payload_len":365,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.240.69.199","src_port":28681,"dst_port":6348,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":242,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":88941,"flow_last_seen":179376,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":511,"flow_avg_l4_payload_len":63,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":28681,"dst_port":52367,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":242,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":88941,"flow_last_seen":179376,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":511,"flow_avg_l4_payload_len":63,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":28681,"dst_port":52367,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":95264,"flow_last_seen":179735,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":40137,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":308,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":95264,"flow_last_seen":179735,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":40137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":368,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174343,"flow_last_seen":174343,"flow_idle_time":180000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":28681,"dst_port":36728,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":368,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":174343,"flow_last_seen":174343,"flow_idle_time":180000,"flow_min_l4_payload_len":86,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":86,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.147.52.21","src_port":28681,"dst_port":36728,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":363,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":168840,"flow_last_seen":174342,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":83,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":38297,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":363,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":168840,"flow_last_seen":174342,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":83,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.205.91.45","src_port":28681,"dst_port":38297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00583{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":168594,"flow_last_seen":176963,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1959,"flow_avg_l4_payload_len":326,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.192.210.182","src_port":28681,"dst_port":6754,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00568{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":362,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":168594,"flow_last_seen":176963,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1959,"flow_avg_l4_payload_len":326,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.192.210.182","src_port":28681,"dst_port":6754,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":139506,"flow_last_seen":177166,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1954,"flow_avg_l4_payload_len":325,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"63.228.175.169","src_port":28681,"dst_port":1936,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":356,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":139506,"flow_last_seen":177166,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1954,"flow_avg_l4_payload_len":325,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"63.228.175.169","src_port":28681,"dst_port":1936,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00581{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":301,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90845,"flow_last_seen":174321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1001,"flow_avg_l4_payload_len":166,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":28681,"dst_port":11852,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00566{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":301,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90845,"flow_last_seen":174321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1001,"flow_avg_l4_payload_len":166,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":28681,"dst_port":11852,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00583{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":243,"flow_state":"info","flow_packets_processed":19,"flow_first_seen":89016,"flow_last_seen":176659,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4777,"flow_avg_l4_payload_len":251,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00568{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":243,"flow_state":"info","flow_packets_processed":19,"flow_first_seen":89016,"flow_last_seen":176659,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4777,"flow_avg_l4_payload_len":251,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":360,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":168428,"flow_last_seen":174303,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":83,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"198.58.218.12","src_port":28681,"dst_port":47912,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":360,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":168428,"flow_last_seen":174303,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":83,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"198.58.218.12","src_port":28681,"dst_port":47912,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90138,"flow_last_seen":174723,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.217.176.52","src_port":28681,"dst_port":7446,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":263,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90138,"flow_last_seen":174723,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.217.176.52","src_port":28681,"dst_port":7446,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90183,"flow_last_seen":174679,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":28681,"dst_port":11603,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":264,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90183,"flow_last_seen":174679,"flow_idle_time":180000,"flow_min_l4_payload_len":81,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":82,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":28681,"dst_port":11603,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":174303,"flow_last_seen":287509,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1210,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":28681,"dst_port":10825,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":5408,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":174342,"flow_last_seen":287510,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":841,"flow_avg_l4_payload_len":280,"midstream":0,"thread_ts_msec":353404,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":28681,"dst_port":49956,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5426,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":754,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":355387,"flow_last_seen":355387,"flow_idle_time":180000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":355387,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.125.218.84","src_port":28681,"dst_port":17561,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00476{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5426,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":754,"flow_packet_id":1,"flow_last_seen":355387,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"thread_ts_msec":355387,"pkt":"UlQAEjUCCAAn5uVZCABFAABDeM0AAIARhvwKAAIPVH3aVHAJRJkAL52kWv4xAksIMkL\/WuRk66hXAwABABAAAADDA1NDUEECglZDRUdUS0di"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5591,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":185,"flow_packet_id":3,"flow_last_seen":371838,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":371838,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0taEAAIARR0oKAAIPbYTEOnAJGMoAINecR05EEEABAQFUC1FLUlAGUk5BXS\/iNQlw"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5594,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":755,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":371838,"flow_last_seen":371838,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":371838,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.134.107.32","src_port":28681,"dst_port":38836,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5594,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":755,"flow_packet_id":1,"flow_last_seen":371838,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":371838,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05JUAAIARi24KAAIPU4ZrIHAJl7QAIMvHR05EEEAEAQFUC1FLUlAGUk5BXS\/iNQlw"} +00458{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5595,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":191,"flow_packet_id":3,"flow_last_seen":371839,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":371839,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0RwUAAIARmdUKAAIPvpmPNnAJ\/\/8AINRRR05EEEAFAQFUC1FLUlAGUk5BXS\/iNQlw"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5615,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":756,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":373494,"flow_last_seen":373494,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":373494,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.100.68.255","src_port":28681,"dst_port":12838,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5615,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":756,"flow_packet_id":1,"flow_last_seen":373494,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":373494,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0M5cAAIARjLAKAAIPKWRE\/3AJMiYAIIGXR05EEEAGAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5622,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":486,"flow_packet_id":3,"flow_last_seen":373494,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":373494,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0rs0AAIAR+c0KAAIPWEQty3AJGMoAIINCR05EEEALAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5631,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":749,"flow_packet_id":2,"flow_last_seen":373496,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":373496,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0aocAAIARLMsKAAIPXAg7UHAJiXgAIAFDR05EEEATAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5635,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":750,"flow_packet_id":2,"flow_last_seen":373497,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":373497,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0JvIAAIARngMKAAIPTp8bFnAJRJsAIHO\/R05EEEAXAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5636,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":751,"flow_packet_id":2,"flow_last_seen":373497,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":373497,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0mm0AAIARSEgKAAIPQ8EINHAJlrgAID9hR05EEEAYAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5639,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":752,"flow_packet_id":2,"flow_last_seen":373498,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":373498,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0D1EAAIARtk0KAAIPjnPamHAJFwwAIKHzR05EEEAbAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5640,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":485,"flow_packet_id":3,"flow_last_seen":373498,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":373498,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0fvoAAIAR6tsKAAIPmgMq0XAJGMoAIERsR05EEEAcAQFUC1FLUlAGUk5BXS\/iNQlw"} +00781{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5643,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":16487,"flow_last_seen":192636,"flow_idle_time":180000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":603,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":373498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5643,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":136,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":72852,"flow_last_seen":192908,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":373498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.236.247.120","src_port":28681,"dst_port":16047,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5643,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":136,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":72852,"flow_last_seen":192908,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":373498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.236.247.120","src_port":28681,"dst_port":16047,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5643,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":173,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82060,"flow_last_seen":192907,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":373498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"121.99.222.36","src_port":28681,"dst_port":44988,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5643,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":173,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82060,"flow_last_seen":192907,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":373498,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"121.99.222.36","src_port":28681,"dst_port":44988,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5717,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":400,"flow_packet_id":2,"flow_last_seen":381404,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":381404,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0860AAIARiigKAAIPgS0vp3AJGMoAIFhpR05EEEAfAQFUC1FLUlAGUk5BXS\/iNQlw"} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5835,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":369,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":219447,"flow_last_seen":219447,"flow_idle_time":180000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":394117,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.187.171.240","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5835,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":369,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":219447,"flow_last_seen":219447,"flow_idle_time":180000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":394117,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.187.171.240","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5882,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":757,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":399168,"flow_last_seen":399168,"flow_idle_time":180000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":399168,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00468{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5882,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":757,"flow_packet_id":1,"flow_last_seen":399168,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":399168,"pkt":"UlQAEjUCCAAn5uVZCABFAAA854sAAIAR\/DEKAAIPaJziSHAJ0AoAKHNuYiULNAANuxoAAAAAAAAAADEBAAkAAABHVEtHCQABAAA="} +00757{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":5882,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":757,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":399168,"flow_last_seen":399168,"flow_idle_time":180000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":399168,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00479{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5889,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":757,"flow_packet_id":2,"flow_last_seen":399265,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"thread_ts_msec":399265,"pkt":"CAAn5uVZUlQAEjUCCABFAABEDoMAAEARFTNonOJICgACD9AKcAkAMN2JYiULNAANuxpiJQs1AA5dgzEBABEAAABHVEtHCgABAABiJQs1AA5ddw=="} +00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5901,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":400018,"flow_last_seen":400018,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":400018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50213,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5901,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_packet_id":1,"flow_last_seen":400018,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":400018,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LcAAAER3GIKAAIP7\/\/\/+sQlB2wAtikJTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":5901,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":400018,"flow_last_seen":400018,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":400018,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50213,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5915,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":759,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":400872,"flow_last_seen":400872,"flow_idle_time":180000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":400872,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00468{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5915,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":759,"flow_packet_id":1,"flow_last_seen":400872,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":400872,"pkt":"UlQAEjUCCAAn5uVZCABFAAA8Bs8AAIAREesKAAIPaO6s+nAJW\/wAKKTOYiULNgAJMscAAAAAAAAAADEBAAkAAABHVEtHCQABAAA="} +00758{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":5915,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":759,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":400872,"flow_last_seen":400872,"flow_idle_time":180000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":400872,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00479{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5917,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":759,"flow_packet_id":2,"flow_last_seen":400901,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"thread_ts_msec":400901,"pkt":"CAAn5uVZUlQAEjUCCABFAABEDpQAAEARSh5o7qz6CgACD1v8cAkAMAJCYiULNgAJMsdiJQs2AAlj5TEBABEAAABHVEtHCgABAABiJQs2AAljxQ=="} +00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5919,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_packet_id":2,"flow_last_seen":401028,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":401028,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LgAAAER3GEKAAIP7\/\/\/+sQlB2wAtikJTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5928,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_packet_id":3,"flow_last_seen":402032,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":402032,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LkAAAER3GAKAAIP7\/\/\/+sQlB2wAtikJTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5953,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":371,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229238,"flow_last_seen":229238,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":404327,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.131.202.24","src_port":28681,"dst_port":44748,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5953,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":371,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229238,"flow_last_seen":229238,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":404327,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.131.202.24","src_port":28681,"dst_port":44748,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5953,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":370,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229238,"flow_last_seen":229238,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":404327,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.172.56.198","src_port":28681,"dst_port":11984,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5953,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":370,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229238,"flow_last_seen":229238,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":404327,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.172.56.198","src_port":28681,"dst_port":11984,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5953,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":374,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229240,"flow_last_seen":229240,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":404327,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"62.35.190.5","src_port":28681,"dst_port":18604,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5953,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":374,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229240,"flow_last_seen":229240,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":404327,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"62.35.190.5","src_port":28681,"dst_port":18604,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5953,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":372,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229239,"flow_last_seen":229239,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":404327,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.179.185.126","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5953,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":372,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229239,"flow_last_seen":229239,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":404327,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.179.185.126","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00627{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5953,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":746,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":288409,"flow_last_seen":288409,"flow_idle_time":120000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":404327,"l3_proto":"ip4","src_ip":"164.132.10.25","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":5953,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":373,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229239,"flow_last_seen":229239,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":404327,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.122.233.15","src_port":28681,"dst_port":11488,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5953,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":373,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":229239,"flow_last_seen":229239,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":404327,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.122.233.15","src_port":28681,"dst_port":11488,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":398,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243620,"flow_last_seen":243620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"62.102.148.166","src_port":28681,"dst_port":31332,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":398,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243620,"flow_last_seen":243620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"62.102.148.166","src_port":28681,"dst_port":31332,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":392,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.0.69.215","src_port":28681,"dst_port":12608,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":392,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.0.69.215","src_port":28681,"dst_port":12608,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":389,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.215.183.71","src_port":28681,"dst_port":31310,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":389,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.215.183.71","src_port":28681,"dst_port":31310,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":385,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243618,"flow_last_seen":243618,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.223.143.31","src_port":28681,"dst_port":47978,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":385,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243618,"flow_last_seen":243618,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.223.143.31","src_port":28681,"dst_port":47978,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":399,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243620,"flow_last_seen":243620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.39.219.223","src_port":28681,"dst_port":31728,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":399,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243620,"flow_last_seen":243620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.39.219.223","src_port":28681,"dst_port":31728,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":395,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"191.114.88.39","src_port":28681,"dst_port":18751,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":395,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"191.114.88.39","src_port":28681,"dst_port":18751,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":387,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243618,"flow_last_seen":243618,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.135.8.7","src_port":28681,"dst_port":1219,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":387,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243618,"flow_last_seen":243618,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.135.8.7","src_port":28681,"dst_port":1219,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":390,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"144.134.132.206","src_port":28681,"dst_port":16401,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":390,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"144.134.132.206","src_port":28681,"dst_port":16401,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":391,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"161.81.38.67","src_port":28681,"dst_port":9539,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":391,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243619,"flow_last_seen":243619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"161.81.38.67","src_port":28681,"dst_port":9539,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":397,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243620,"flow_last_seen":243620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":24634,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":397,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243620,"flow_last_seen":243620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":24634,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":396,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243620,"flow_last_seen":243620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.59.24","src_port":28681,"dst_port":28755,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":396,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":243620,"flow_last_seen":243620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.59.24","src_port":28681,"dst_port":28755,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":377,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243616,"flow_last_seen":287511,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.200.236.13","src_port":28681,"dst_port":12082,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":394,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243619,"flow_last_seen":287621,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.84.134.136","src_port":28681,"dst_port":21407,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":381,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":287598,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.58.211.52","src_port":28681,"dst_port":3806,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":386,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243618,"flow_last_seen":287682,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.172.10.90","src_port":28681,"dst_port":40162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":384,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243617,"flow_last_seen":288007,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.64.6.175","src_port":28681,"dst_port":4743,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":378,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":287785,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.241.204.61","src_port":28681,"dst_port":43366,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":375,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243615,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.182.136.42","src_port":28681,"dst_port":27873,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":388,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243618,"flow_last_seen":287524,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"121.7.145.36","src_port":28681,"dst_port":33905,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":376,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243615,"flow_last_seen":287944,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":203,"flow_avg_l4_payload_len":50,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"156.57.42.2","src_port":28681,"dst_port":33476,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":380,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":287697,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.86.49.195","src_port":28681,"dst_port":12019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":383,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":243617,"flow_last_seen":365474,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":299,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.71.243.60","src_port":28681,"dst_port":34498,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":393,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243619,"flow_last_seen":287426,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.115.158.103","src_port":28681,"dst_port":5110,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":382,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243617,"flow_last_seen":287618,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.175.11.126","src_port":28681,"dst_port":40958,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6149,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":379,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":288106,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":424016,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.140.63.147","src_port":28681,"dst_port":29545,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00559{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6215,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":760,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":431178,"flow_last_seen":431178,"flow_idle_time":180000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":431178,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00704{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6215,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":760,"flow_packet_id":1,"flow_last_seen":431178,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":243,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":243,"pkt_l4_len":209,"thread_ts_msec":431178,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAADlHP4AAIARA\/0KAAIPCgAC\/wCKAIoA0frqEQKcMAoAAg8AigC7AAAgRU5GREVGRUVFSEVGRkhFSkVPREJEQUNBQ0FDQUNBQ0EAIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUJOAP9TTUIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQAAIQAAAAAAAAAAAOgDAAAAAAAAAAAhAFYAAwABAAAAAgAyAFxNQUlMU0xPVFxCUk9XU0UAAQAAUwcATVNFREdFV0lOMTAAAAAAAAoAAxAAAA8BVaoA"} +00744{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6215,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":760,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":431178,"flow_last_seen":431178,"flow_idle_time":180000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":431178,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6223,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":761,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":431829,"flow_last_seen":431829,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":431829,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.132.75.56","src_port":28681,"dst_port":56009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6223,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":761,"flow_packet_id":1,"flow_last_seen":431829,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":431829,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0QZQAAIAR3lkKAAIPw4RLOHAJ2skAIDh8R05EEEAkAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6230,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":751,"flow_packet_id":3,"flow_last_seen":431830,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":431830,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0mm4AAIARSEcKAAIPQ8EINHAJlrgAID9OR05EEEArAQFUC1FLUlAGUk5BXS\/iNQlw"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6232,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":762,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":431830,"flow_last_seen":431830,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":431830,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.75.43.182","src_port":28681,"dst_port":43502,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6232,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":762,"flow_packet_id":1,"flow_last_seen":431830,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":431830,"pkt":"UlQAEjUCCAAn5uVZCABFAAA06P8AAIARw6kKAAIPVksrtnAJqe4AIPYJR05EEEAtAQFUC1FLUlAGUk5BXS\/iNQlw"} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6266,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":763,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":433135,"flow_last_seen":433135,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":433135,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.170.209.214","src_port":28681,"dst_port":46210,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6266,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":763,"flow_packet_id":1,"flow_last_seen":433135,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":433135,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0ANMAAIARBlcKAAIPVarR1nAJtIIAIEXoR05EEEA7AQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6267,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":503,"flow_packet_id":2,"flow_last_seen":433135,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":433135,"pkt":"UlQAEjUCCAAn5uVZCABFAAA022oAAIARFCUKAAIPStL0SHAJGMoAIMoFR05EEEA8AQFUC1FLUlAGUk5BXS\/iNQlw"} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6270,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":764,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":433136,"flow_last_seen":433136,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":433136,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"208.92.106.151","src_port":28681,"dst_port":32476,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6270,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":764,"flow_packet_id":1,"flow_last_seen":433136,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":433136,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0dXUAAIARfkEKAAIP0Fxql3AJftwAIGgXR05EEEA\/AQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6274,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":756,"flow_packet_id":2,"flow_last_seen":433136,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":433136,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0M5gAAIARjK8KAAIPKWRE\/3AJMiYAIIFaR05EEEBDAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6278,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":752,"flow_packet_id":3,"flow_last_seen":433137,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":433137,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0D1IAAIARtkwKAAIPjnPamHAJFwwAIKHHR05EEEBHAQFUC1FLUlAGUk5BXS\/iNQlw"} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":433,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.255.145.191","src_port":28681,"dst_port":47264,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":433,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.255.145.191","src_port":28681,"dst_port":47264,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":404,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.234.216.251","src_port":28681,"dst_port":17845,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":404,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.234.216.251","src_port":28681,"dst_port":17845,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":426,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.71.44.121","src_port":28681,"dst_port":14398,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":426,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.71.44.121","src_port":28681,"dst_port":14398,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":411,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.143.28.64","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":411,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.143.28.64","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":408,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.103.2.245","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":408,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.103.2.245","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":424,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.15.216.216","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":424,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.15.216.216","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":422,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.123.35.219","src_port":28681,"dst_port":42211,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":422,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.123.35.219","src_port":28681,"dst_port":42211,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":439,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.135.15.86","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":439,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.135.15.86","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":481,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251802,"flow_last_seen":251802,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.120.219.74","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":481,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251802,"flow_last_seen":251802,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.120.219.74","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":435,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.24.146.101","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":435,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.24.146.101","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":465,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251768,"flow_last_seen":251768,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"2.28.39.18","src_port":28681,"dst_port":15672,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":465,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251768,"flow_last_seen":251768,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"2.28.39.18","src_port":28681,"dst_port":15672,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":306,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":93714,"flow_last_seen":253026,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.249.63.200","src_port":28681,"dst_port":22582,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":306,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":93714,"flow_last_seen":253026,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.249.63.200","src_port":28681,"dst_port":22582,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00581{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":421,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251741,"flow_last_seen":253031,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":319,"flow_tot_l4_payload_len":396,"flow_avg_l4_payload_len":198,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.182.39.11","src_port":28681,"dst_port":12977,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00566{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":421,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251741,"flow_last_seen":253031,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":319,"flow_tot_l4_payload_len":396,"flow_avg_l4_payload_len":198,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.182.39.11","src_port":28681,"dst_port":12977,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":416,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.139.61.103","src_port":28681,"dst_port":24096,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":416,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.139.61.103","src_port":28681,"dst_port":24096,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00583{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":304,"flow_state":"info","flow_packets_processed":18,"flow_first_seen":90880,"flow_last_seen":251799,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5105,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.32.126.214","src_port":28681,"dst_port":59596,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00568{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":304,"flow_state":"info","flow_packets_processed":18,"flow_first_seen":90880,"flow_last_seen":251799,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5105,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.32.126.214","src_port":28681,"dst_port":59596,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":413,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.65.188.29","src_port":28681,"dst_port":24676,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":413,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.65.188.29","src_port":28681,"dst_port":24676,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":412,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.177.52.73","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":412,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.177.52.73","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":418,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.129.149.103","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":418,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.129.149.103","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":468,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251769,"flow_last_seen":251769,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.214.12.247","src_port":28681,"dst_port":44001,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":468,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251769,"flow_last_seen":251769,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.214.12.247","src_port":28681,"dst_port":44001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":466,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251768,"flow_last_seen":251768,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"70.119.248.5","src_port":28681,"dst_port":49929,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":466,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251768,"flow_last_seen":251768,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"70.119.248.5","src_port":28681,"dst_port":49929,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":428,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.162.97.8","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":428,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.162.97.8","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":425,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"145.82.53.165","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":425,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"145.82.53.165","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":401,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251735,"flow_last_seen":251735,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.178.192.76","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":401,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251735,"flow_last_seen":251735,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.178.192.76","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00629{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":484,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":253024,"flow_last_seen":253024,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"107.4.56.177","src_port":28681,"dst_port":10000,"l4_proto":"udp","ndpi": {"confidence": {"1":"Match by port"},"proto":"CiscoVPN","breed":"Acceptable","category":"VPN"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":484,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":253024,"flow_last_seen":253024,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"107.4.56.177","src_port":28681,"dst_port":10000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":406,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.27.3.68","src_port":28681,"dst_port":57380,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":406,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.27.3.68","src_port":28681,"dst_port":57380,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":467,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251769,"flow_last_seen":252632,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":327,"flow_tot_l4_payload_len":404,"flow_avg_l4_payload_len":202,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.64.177.53","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":467,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251769,"flow_last_seen":252632,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":327,"flow_tot_l4_payload_len":404,"flow_avg_l4_payload_len":202,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.64.177.53","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":431,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.124.71.246","src_port":28681,"dst_port":49035,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":431,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.124.71.246","src_port":28681,"dst_port":49035,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":303,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90871,"flow_last_seen":251762,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1247,"flow_avg_l4_payload_len":207,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":28681,"dst_port":30566,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":303,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90871,"flow_last_seen":251762,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1247,"flow_avg_l4_payload_len":207,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":28681,"dst_port":30566,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":483,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251946,"flow_last_seen":251946,"flow_idle_time":180000,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":45,"flow_avg_l4_payload_len":45,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","src_port":1026,"dst_port":28681,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":483,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251946,"flow_last_seen":251946,"flow_idle_time":180000,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":45,"flow_avg_l4_payload_len":45,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.2","dst_ip":"10.0.2.15","src_port":1026,"dst_port":28681,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":402,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251738,"flow_last_seen":251738,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.219.202.2","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":402,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251738,"flow_last_seen":251738,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.219.202.2","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":420,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.227.127.34","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":420,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.227.127.34","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":417,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.187.236.179","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":417,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.187.236.179","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":125,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":72849,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.92.178.182","src_port":28681,"dst_port":57302,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":125,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":72849,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.92.178.182","src_port":28681,"dst_port":57302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":427,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.249.13.30","src_port":28681,"dst_port":15138,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":427,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.249.13.30","src_port":28681,"dst_port":15138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":405,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.155.31.118","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":405,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.155.31.118","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":213,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":83518,"flow_last_seen":253026,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"5.180.62.37","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":213,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":83518,"flow_last_seen":253026,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"5.180.62.37","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":415,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.247.160.96","src_port":28681,"dst_port":17817,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":415,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.247.160.96","src_port":28681,"dst_port":17817,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":410,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.28.130.131","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":410,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.28.130.131","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":423,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251742,"flow_last_seen":252853,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":322,"flow_tot_l4_payload_len":399,"flow_avg_l4_payload_len":199,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.247.6.226","src_port":28681,"dst_port":9713,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":423,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251742,"flow_last_seen":252853,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":322,"flow_tot_l4_payload_len":399,"flow_avg_l4_payload_len":199,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.247.6.226","src_port":28681,"dst_port":9713,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":438,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.86.190.163","src_port":28681,"dst_port":14142,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":438,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.86.190.163","src_port":28681,"dst_port":14142,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":403,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"197.244.171.132","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":403,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"197.244.171.132","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":429,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.215.213","src_port":28681,"dst_port":23576,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":429,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.215.213","src_port":28681,"dst_port":23576,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":436,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.68.179.137","src_port":28681,"dst_port":6406,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":436,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.68.179.137","src_port":28681,"dst_port":6406,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":414,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251741,"flow_last_seen":252054,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":309,"flow_tot_l4_payload_len":386,"flow_avg_l4_payload_len":193,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.181.156.244","src_port":28681,"dst_port":8255,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":414,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251741,"flow_last_seen":252054,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":309,"flow_tot_l4_payload_len":386,"flow_avg_l4_payload_len":193,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.181.156.244","src_port":28681,"dst_port":8255,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":409,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.194.53.68","src_port":28681,"dst_port":33770,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":409,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251740,"flow_last_seen":251740,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.194.53.68","src_port":28681,"dst_port":33770,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":482,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251802,"flow_last_seen":251802,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.193.23.172","src_port":28681,"dst_port":42227,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":482,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251802,"flow_last_seen":251802,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.193.23.172","src_port":28681,"dst_port":42227,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":108,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":71539,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.242.110","src_port":28681,"dst_port":7922,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":108,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":71539,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.242.110","src_port":28681,"dst_port":7922,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":407,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.181.151.217","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":407,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251739,"flow_last_seen":251739,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.181.151.217","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":440,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.165.170.112","src_port":28681,"dst_port":37087,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":440,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.165.170.112","src_port":28681,"dst_port":37087,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":437,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"31.38.163.2","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":437,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"31.38.163.2","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":113,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":71540,"flow_last_seen":253024,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"105.101.132.146","src_port":28681,"dst_port":57746,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":113,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":71540,"flow_last_seen":253024,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"105.101.132.146","src_port":28681,"dst_port":57746,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":419,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.193.236.8","src_port":28681,"dst_port":46557,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":419,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251741,"flow_last_seen":251741,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.193.236.8","src_port":28681,"dst_port":46557,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":432,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.6.118.53","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":432,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251743,"flow_last_seen":251743,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.6.118.53","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":434,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251743,"flow_last_seen":252481,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":304,"flow_tot_l4_payload_len":381,"flow_avg_l4_payload_len":190,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.24.182.130","src_port":28681,"dst_port":22232,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":434,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251743,"flow_last_seen":252481,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":304,"flow_tot_l4_payload_len":381,"flow_avg_l4_payload_len":190,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.24.182.130","src_port":28681,"dst_port":22232,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":430,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.8.95.165","src_port":28681,"dst_port":40763,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":430,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":251742,"flow_last_seen":251742,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.8.95.165","src_port":28681,"dst_port":40763,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":441,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251763,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.199.108","src_port":28681,"dst_port":56040,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00568{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":450,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251765,"flow_last_seen":287535,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.206.254","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":134,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72852,"flow_last_seen":431829,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.231.73.14","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":128,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":72850,"flow_last_seen":433136,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.141.219.27","src_port":28681,"dst_port":37580,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":114,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":71540,"flow_last_seen":431831,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.23.75.69","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00560{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":88,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70230,"flow_last_seen":311752,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.50.24.2","src_port":28681,"dst_port":17874,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":479,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.13.148","src_port":28681,"dst_port":51896,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":474,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":45880,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":477,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":45640,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":444,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251764,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.117.100.78","src_port":28681,"dst_port":9010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":478,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.235.85.44","src_port":28681,"dst_port":64914,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":449,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251765,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":28681,"dst_port":8826,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":461,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.27.193.124","src_port":28681,"dst_port":50555,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":472,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":45744,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":471,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":43457,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":476,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.18.172.208","src_port":28681,"dst_port":63172,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":118,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":71541,"flow_last_seen":431829,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"5.180.62.100","src_port":28681,"dst_port":46385,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":117,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":71540,"flow_last_seen":431829,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.120.243.143","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":443,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251763,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.14.31","src_port":28681,"dst_port":54754,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":98,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":71536,"flow_last_seen":351075,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":194,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.222.14.170","src_port":28681,"dst_port":23332,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":111,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":71540,"flow_last_seen":371836,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.65.141.157","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":139,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":72853,"flow_last_seen":431830,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.226.142","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":141,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":72853,"flow_last_seen":431830,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"172.97.199.14","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":446,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251764,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.70.199.107","src_port":28681,"dst_port":60475,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":470,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251799,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":46790,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":447,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251764,"flow_last_seen":287495,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.199.10.60","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":451,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251765,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.35.66.21","src_port":28681,"dst_port":22234,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":126,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":72849,"flow_last_seen":433134,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.69.159.133","src_port":28681,"dst_port":28000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":456,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.241.112.255","src_port":28681,"dst_port":14766,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":85,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":70230,"flow_last_seen":433135,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.138.20.110","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":455,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.153.206.183","src_port":28681,"dst_port":16919,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":453,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.127.26.138","src_port":28681,"dst_port":3083,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":460,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"210.194.116.78","src_port":28681,"dst_port":8342,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":454,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.121.156","src_port":28681,"dst_port":23183,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":135,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":72852,"flow_last_seen":431831,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.250.99.158","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":469,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251799,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":47184,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":116,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":71540,"flow_last_seen":431829,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.44.190.145","src_port":28681,"dst_port":10170,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":485,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":253025,"flow_last_seen":433136,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"154.3.42.209","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":133,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":72852,"flow_last_seen":431831,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.175.220.161","src_port":28681,"dst_port":15721,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":124,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72848,"flow_last_seen":311749,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"170.254.19.6","src_port":28681,"dst_port":24180,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":458,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.165.228.167","src_port":28681,"dst_port":12201,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":486,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":253025,"flow_last_seen":433135,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.68.45.203","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":130,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":72851,"flow_last_seen":433135,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.224.95.97","src_port":28681,"dst_port":46356,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":129,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":72850,"flow_last_seen":371838,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.138.50.179","src_port":28681,"dst_port":29411,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":457,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.247.240.113","src_port":28681,"dst_port":13867,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":137,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":72853,"flow_last_seen":431831,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.65.70.197","src_port":28681,"dst_port":21693,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":109,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":71539,"flow_last_seen":431828,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.169.2.153","src_port":28681,"dst_port":52414,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":140,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":72853,"flow_last_seen":431829,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.197.111.186","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":400,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251734,"flow_last_seen":381404,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"129.45.47.167","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":463,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251768,"flow_last_seen":287699,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.7.155.210","src_port":28681,"dst_port":28365,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":452,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251765,"flow_last_seen":287440,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.227.193.37","src_port":28681,"dst_port":27481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00568{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":448,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251764,"flow_last_seen":287579,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":28681,"dst_port":15677,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":459,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.89.84.59","src_port":28681,"dst_port":11603,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":445,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251764,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.165.153.100","src_port":28681,"dst_port":4509,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":464,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251768,"flow_last_seen":287532,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"101.128.66.8","src_port":28681,"dst_port":34512,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":480,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.74.26","src_port":28681,"dst_port":65498,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":87,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":70230,"flow_last_seen":373496,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.131.85.245","src_port":28681,"dst_port":31743,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":462,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":47808,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":475,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":28681,"dst_port":63978,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":473,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":28681,"dst_port":33564,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":442,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251763,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.204.130.55","src_port":28681,"dst_port":29545,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6288,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":138,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":72853,"flow_last_seen":431831,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":434149,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"167.114.170.156","src_port":28681,"dst_port":23844,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00581{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":488,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":264769,"flow_last_seen":265025,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":301,"flow_tot_l4_payload_len":378,"flow_avg_l4_payload_len":189,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.90.112","src_port":28681,"dst_port":9852,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00566{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":488,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":264769,"flow_last_seen":265025,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":301,"flow_tot_l4_payload_len":378,"flow_avg_l4_payload_len":189,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.90.112","src_port":28681,"dst_port":9852,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":490,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":264770,"flow_last_seen":264770,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.3.215.132","src_port":28681,"dst_port":20356,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":490,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":264770,"flow_last_seen":264770,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.3.215.132","src_port":28681,"dst_port":20356,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":489,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":264770,"flow_last_seen":264770,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"108.44.45.25","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":489,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":264770,"flow_last_seen":264770,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"108.44.45.25","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":487,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":264769,"flow_last_seen":264769,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.78.134.188","src_port":28681,"dst_port":49046,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":487,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":264769,"flow_last_seen":264769,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.78.134.188","src_port":28681,"dst_port":49046,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":491,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":264771,"flow_last_seen":265818,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":303,"flow_tot_l4_payload_len":380,"flow_avg_l4_payload_len":190,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.42.210","src_port":28681,"dst_port":5512,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":491,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":264771,"flow_last_seen":265818,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":303,"flow_tot_l4_payload_len":380,"flow_avg_l4_payload_len":190,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.42.210","src_port":28681,"dst_port":5512,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":492,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":264771,"flow_last_seen":264771,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"172.94.41.71","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":492,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":264771,"flow_last_seen":264771,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"172.94.41.71","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":166,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82059,"flow_last_seen":433137,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.59.253.186","src_port":28681,"dst_port":15555,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":183,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82062,"flow_last_seen":431831,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.172.15.182","src_port":28681,"dst_port":37829,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":184,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82062,"flow_last_seen":431829,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.239.62.213","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":195,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82063,"flow_last_seen":373495,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"177.231.151.16","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":219,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":83520,"flow_last_seen":431830,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.30.86.144","src_port":28681,"dst_port":53821,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90184,"flow_last_seen":288014,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3860,"flow_avg_l4_payload_len":275,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":1194,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":191,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82063,"flow_last_seen":371839,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.153.143.54","src_port":28681,"dst_port":65535,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":172,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82060,"flow_last_seen":373496,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.69.142.133","src_port":28681,"dst_port":15471,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90073,"flow_last_seen":287523,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3852,"flow_avg_l4_payload_len":275,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":187,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82062,"flow_last_seen":433134,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.88.92.56","src_port":28681,"dst_port":21009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":190,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82063,"flow_last_seen":431830,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.195.227","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_state":"info","flow_packets_processed":16,"flow_first_seen":89966,"flow_last_seen":287418,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4798,"flow_avg_l4_payload_len":299,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":26253,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":180,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82061,"flow_last_seen":433137,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.131.24.72","src_port":28681,"dst_port":30711,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90039,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":28681,"dst_port":36368,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":156,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82057,"flow_last_seen":433136,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.244.228.86","src_port":28681,"dst_port":10131,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00561{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":176,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82061,"flow_last_seen":373494,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.99.164.4","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00568{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_state":"info","flow_packets_processed":11,"flow_first_seen":89829,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3598,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":28681,"dst_port":35481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":157,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82058,"flow_last_seen":371836,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.227.162.150","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":209,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82066,"flow_last_seen":431830,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.179.98.234","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00568{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":95784,"flow_last_seen":287572,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2838,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.236.205.7","src_port":28681,"dst_port":34794,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90138,"flow_last_seen":287634,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4009,"flow_avg_l4_payload_len":286,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":28681,"dst_port":21301,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":159,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82058,"flow_last_seen":311750,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.163.231.160","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":95716,"flow_last_seen":287440,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2001,"flow_avg_l4_payload_len":250,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00568{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":95893,"flow_last_seen":287579,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2031,"flow_avg_l4_payload_len":253,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":55302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_state":"info","flow_packets_processed":18,"flow_first_seen":90039,"flow_last_seen":287415,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5624,"flow_avg_l4_payload_len":312,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":30577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":167,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82059,"flow_last_seen":373496,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.29.107.176","src_port":28681,"dst_port":20363,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":171,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82060,"flow_last_seen":373497,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"196.217.132.111","src_port":28681,"dst_port":25394,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":160,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82058,"flow_last_seen":431829,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.150.49.35","src_port":28681,"dst_port":32448,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":89829,"flow_last_seen":287526,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":12012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":185,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82062,"flow_last_seen":371838,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.196.58","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":161,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82058,"flow_last_seen":311749,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.120.26.86","src_port":28681,"dst_port":29946,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":175,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82060,"flow_last_seen":433136,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"115.69.62.99","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_state":"info","flow_packets_processed":18,"flow_first_seen":90005,"flow_last_seen":287678,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5605,"flow_avg_l4_payload_len":311,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":28681,"dst_port":61616,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":200,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82064,"flow_last_seen":373495,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"138.199.16.123","src_port":28681,"dst_port":52993,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":95784,"flow_last_seen":287857,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2839,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":63637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90138,"flow_last_seen":287483,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3990,"flow_avg_l4_payload_len":285,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":28681,"dst_port":46010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":158,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82058,"flow_last_seen":431830,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":444674,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.166.226.70","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_state":"info","flow_packets_processed":11,"flow_first_seen":101162,"flow_last_seen":287624,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3598,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":26851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_state":"info","flow_packets_processed":16,"flow_first_seen":90005,"flow_last_seen":287355,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4793,"flow_avg_l4_payload_len":299,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":28681,"dst_port":24562,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00568{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":101837,"flow_last_seen":289958,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":120,"flow_tot_l4_payload_len":482,"flow_avg_l4_payload_len":68,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_state":"info","flow_packets_processed":17,"flow_first_seen":90072,"flow_last_seen":320293,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5333,"flow_avg_l4_payload_len":313,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":28681,"dst_port":43508,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00569{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90864,"flow_last_seen":287337,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1242,"flow_avg_l4_payload_len":207,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":53489,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6445,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":95716,"flow_last_seen":426518,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":359,"flow_avg_l4_payload_len":51,"midstream":0,"thread_ts_msec":454778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.167.201.53","src_port":28681,"dst_port":47282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":577,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287425,"flow_last_seen":287425,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.148.100.237","src_port":28681,"dst_port":23459,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":577,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287425,"flow_last_seen":287425,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.148.100.237","src_port":28681,"dst_port":23459,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":586,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287428,"flow_last_seen":287428,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.124.66.33","src_port":28681,"dst_port":13060,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":586,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287428,"flow_last_seen":287428,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.124.66.33","src_port":28681,"dst_port":13060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":619,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287484,"flow_last_seen":287484,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.172.184.48","src_port":28681,"dst_port":13281,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":619,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287484,"flow_last_seen":287484,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.172.184.48","src_port":28681,"dst_port":13281,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":377,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243616,"flow_last_seen":287511,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.200.236.13","src_port":28681,"dst_port":12082,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":377,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243616,"flow_last_seen":287511,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.200.236.13","src_port":28681,"dst_port":12082,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":526,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287321,"flow_last_seen":287321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.234.197.93","src_port":28681,"dst_port":1483,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":526,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287321,"flow_last_seen":287321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.234.197.93","src_port":28681,"dst_port":1483,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":509,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287313,"flow_last_seen":287313,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.142.109.190","src_port":28681,"dst_port":41370,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":509,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287313,"flow_last_seen":287313,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.142.109.190","src_port":28681,"dst_port":41370,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":670,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287589,"flow_last_seen":287589,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.200.235","src_port":28681,"dst_port":2846,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":670,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287589,"flow_last_seen":287589,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.200.235","src_port":28681,"dst_port":2846,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":610,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287444,"flow_last_seen":287444,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":28681,"dst_port":59016,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":610,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287444,"flow_last_seen":287444,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":28681,"dst_port":59016,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":691,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.18.212.223","src_port":28681,"dst_port":50637,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":691,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.18.212.223","src_port":28681,"dst_port":50637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":441,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251763,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.199.108","src_port":28681,"dst_port":56040,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":441,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251763,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.199.108","src_port":28681,"dst_port":56040,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00751{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":701,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287650,"flow_last_seen":287650,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.206.27.26","src_port":28681,"dst_port":6578,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"2":"Match by IP"},"proto":"Tor","breed":"Potentially Dangerous","category":"VPN"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":701,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287650,"flow_last_seen":287650,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.206.27.26","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":511,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.47.223.27","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":511,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.47.223.27","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00583{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_state":"info","flow_packets_processed":11,"flow_first_seen":101162,"flow_last_seen":287624,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3598,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":26851,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00568{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":331,"flow_state":"info","flow_packets_processed":11,"flow_first_seen":101162,"flow_last_seen":287624,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3598,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":26851,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":168555,"flow_last_seen":287464,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2374,"flow_avg_l4_payload_len":237,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":28681,"dst_port":9915,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":361,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":168555,"flow_last_seen":287464,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2374,"flow_avg_l4_payload_len":237,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.129.196.84","src_port":28681,"dst_port":9915,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00581{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":450,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251765,"flow_last_seen":287535,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.206.254","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00566{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":450,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251765,"flow_last_seen":287535,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.206.254","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":496,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287309,"flow_last_seen":287309,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.173.230.98","src_port":28681,"dst_port":19004,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":496,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287309,"flow_last_seen":287309,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.173.230.98","src_port":28681,"dst_port":19004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":592,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287429,"flow_last_seen":287624,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.36.249.91","src_port":28681,"dst_port":7190,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":592,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287429,"flow_last_seen":287624,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.36.249.91","src_port":28681,"dst_port":7190,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":702,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287651,"flow_last_seen":287651,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.190.184","src_port":28681,"dst_port":64163,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":702,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287651,"flow_last_seen":287651,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.190.184","src_port":28681,"dst_port":64163,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":495,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287308,"flow_last_seen":287308,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.247.89.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":495,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287308,"flow_last_seen":287308,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.247.89.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":493,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":280014,"flow_last_seen":283055,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":57552,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":479,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.13.148","src_port":28681,"dst_port":51896,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":479,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.13.148","src_port":28681,"dst_port":51896,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":603,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.36.249.91","src_port":28681,"dst_port":64577,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":603,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.36.249.91","src_port":28681,"dst_port":64577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":394,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243619,"flow_last_seen":287621,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.84.134.136","src_port":28681,"dst_port":21407,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":394,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243619,"flow_last_seen":287621,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.84.134.136","src_port":28681,"dst_port":21407,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_state":"info","flow_packets_processed":16,"flow_first_seen":90005,"flow_last_seen":287355,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4793,"flow_avg_l4_payload_len":299,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":28681,"dst_port":24562,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":254,"flow_state":"info","flow_packets_processed":16,"flow_first_seen":90005,"flow_last_seen":287355,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4793,"flow_avg_l4_payload_len":299,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.120.73.215","src_port":28681,"dst_port":24562,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":741,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.25.47","src_port":28681,"dst_port":21293,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":741,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.25.47","src_port":28681,"dst_port":21293,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":647,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287511,"flow_last_seen":287511,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.10.152","src_port":28681,"dst_port":21293,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":647,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287511,"flow_last_seen":287511,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.10.152","src_port":28681,"dst_port":21293,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":622,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287485,"flow_last_seen":287485,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3227,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":622,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287485,"flow_last_seen":287485,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3227,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":516,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287315,"flow_last_seen":287315,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.246.147.72","src_port":28681,"dst_port":4572,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":516,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287315,"flow_last_seen":287315,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.246.147.72","src_port":28681,"dst_port":4572,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":734,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287858,"flow_last_seen":287858,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.199.148.6","src_port":28681,"dst_port":4338,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":734,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287858,"flow_last_seen":287858,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.199.148.6","src_port":28681,"dst_port":4338,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":597,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287441,"flow_last_seen":287441,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":28681,"dst_port":52274,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":597,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287441,"flow_last_seen":287441,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":28681,"dst_port":52274,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":676,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287600,"flow_last_seen":287600,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.118.77","src_port":28681,"dst_port":62191,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":676,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287600,"flow_last_seen":287600,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.118.77","src_port":28681,"dst_port":62191,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":124066,"flow_last_seen":287321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":836,"flow_avg_l4_payload_len":278,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49732,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":340,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":124066,"flow_last_seen":287321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":836,"flow_avg_l4_payload_len":278,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49732,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":739,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3256,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":739,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3256,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":629,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287496,"flow_last_seen":287579,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.65.87.24","src_port":28681,"dst_port":16201,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":629,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287496,"flow_last_seen":287579,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.65.87.24","src_port":28681,"dst_port":16201,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00581{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":617,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287469,"flow_last_seen":288019,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.208.167.152","src_port":28681,"dst_port":30628,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00566{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":617,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287469,"flow_last_seen":288019,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.208.167.152","src_port":28681,"dst_port":30628,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":596,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287441,"flow_last_seen":287441,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.18.212.223","src_port":28681,"dst_port":58954,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":596,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287441,"flow_last_seen":287441,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.18.212.223","src_port":28681,"dst_port":58954,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":474,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":45880,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":474,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":45880,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":714,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287681,"flow_last_seen":287681,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":51379,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":714,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287681,"flow_last_seen":287681,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":51379,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":593,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287430,"flow_last_seen":287430,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":28681,"dst_port":9747,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":593,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287430,"flow_last_seen":287430,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":28681,"dst_port":9747,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":571,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287423,"flow_last_seen":287423,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.40.163.123","src_port":28681,"dst_port":55341,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":571,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287423,"flow_last_seen":287423,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.40.163.123","src_port":28681,"dst_port":55341,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":524,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.193.171.146","src_port":28681,"dst_port":65362,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":524,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.193.171.146","src_port":28681,"dst_port":65362,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":643,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287499,"flow_last_seen":288088,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.39.142.122","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":643,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287499,"flow_last_seen":288088,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.39.142.122","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":477,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":45640,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":477,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":45640,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":444,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251764,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.117.100.78","src_port":28681,"dst_port":9010,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":444,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251764,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.117.100.78","src_port":28681,"dst_port":9010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":572,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287423,"flow_last_seen":287657,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.153.21.93","src_port":28681,"dst_port":36696,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":572,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287423,"flow_last_seen":287657,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.153.21.93","src_port":28681,"dst_port":36696,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":478,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.235.85.44","src_port":28681,"dst_port":64914,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":478,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.235.85.44","src_port":28681,"dst_port":64914,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":449,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251765,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":28681,"dst_port":8826,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":449,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251765,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":28681,"dst_port":8826,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":650,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287512,"flow_last_seen":287512,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.117.100.78","src_port":28681,"dst_port":56128,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":650,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287512,"flow_last_seen":287512,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.117.100.78","src_port":28681,"dst_port":56128,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":461,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.27.193.124","src_port":28681,"dst_port":50555,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":461,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.27.193.124","src_port":28681,"dst_port":50555,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":520,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287320,"flow_last_seen":287546,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3339,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":520,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287320,"flow_last_seen":287546,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3339,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":335,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":115369,"flow_last_seen":287650,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":407,"flow_avg_l4_payload_len":50,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":28681,"dst_port":37058,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":335,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":115369,"flow_last_seen":287650,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":407,"flow_avg_l4_payload_len":50,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":28681,"dst_port":37058,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":636,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.48.23","src_port":28681,"dst_port":2556,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":636,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.48.23","src_port":28681,"dst_port":2556,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00581{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":101837,"flow_last_seen":289958,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":120,"flow_tot_l4_payload_len":482,"flow_avg_l4_payload_len":68,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00566{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":332,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":101837,"flow_last_seen":289958,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":120,"flow_tot_l4_payload_len":482,"flow_avg_l4_payload_len":68,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":637,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.193.171.146","src_port":28681,"dst_port":53143,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":637,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.193.171.146","src_port":28681,"dst_port":53143,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":638,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.194.73","src_port":28681,"dst_port":1995,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":638,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.194.73","src_port":28681,"dst_port":1995,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":677,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287600,"flow_last_seen":287600,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.64.208.110","src_port":28681,"dst_port":55550,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":677,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287600,"flow_last_seen":287600,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.64.208.110","src_port":28681,"dst_port":55550,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":723,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287683,"flow_last_seen":287683,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.32.245.121","src_port":28681,"dst_port":12333,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":723,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287683,"flow_last_seen":287683,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.32.245.121","src_port":28681,"dst_port":12333,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":578,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287425,"flow_last_seen":287425,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.205.243.44","src_port":28681,"dst_port":46006,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":578,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287425,"flow_last_seen":287425,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.205.243.44","src_port":28681,"dst_port":46006,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":738,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"174.115.127.251","src_port":28681,"dst_port":23897,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":738,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"174.115.127.251","src_port":28681,"dst_port":23897,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":584,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287427,"flow_last_seen":287522,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.193.171.146","src_port":28681,"dst_port":18360,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":584,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287427,"flow_last_seen":287522,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.193.171.146","src_port":28681,"dst_port":18360,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":472,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":45744,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":472,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":45744,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":471,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":43457,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":471,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":43457,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":745,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":288355,"flow_last_seen":288355,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":48250,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":745,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":288355,"flow_last_seen":288355,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":48250,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":708,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287653,"flow_last_seen":287653,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.14.31","src_port":28681,"dst_port":64871,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":708,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287653,"flow_last_seen":287653,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.14.31","src_port":28681,"dst_port":64871,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":501,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287310,"flow_last_seen":287310,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.160.214.137","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":501,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287310,"flow_last_seen":287310,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.160.214.137","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":476,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.18.172.208","src_port":28681,"dst_port":63172,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":476,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.18.172.208","src_port":28681,"dst_port":63172,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":381,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":287598,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.58.211.52","src_port":28681,"dst_port":3806,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":381,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":287598,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.58.211.52","src_port":28681,"dst_port":3806,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":684,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287621,"flow_last_seen":287621,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":54459,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":684,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287621,"flow_last_seen":287621,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":54459,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":386,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243618,"flow_last_seen":287682,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.172.10.90","src_port":28681,"dst_port":40162,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":386,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243618,"flow_last_seen":287682,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.172.10.90","src_port":28681,"dst_port":40162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":124090,"flow_last_seen":287421,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":269,"flow_avg_l4_payload_len":53,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"207.38.163.228","src_port":28681,"dst_port":6778,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":344,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":124090,"flow_last_seen":287421,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":269,"flow_avg_l4_payload_len":53,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"207.38.163.228","src_port":28681,"dst_port":6778,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":506,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287312,"flow_last_seen":287312,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"136.32.84.139","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":506,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287312,"flow_last_seen":287312,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"136.32.84.139","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":620,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287485,"flow_last_seen":287485,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.163.14.246","src_port":28681,"dst_port":1630,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":620,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287485,"flow_last_seen":287485,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.163.14.246","src_port":28681,"dst_port":1630,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":606,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287443,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":56070,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":606,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287443,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":28681,"dst_port":56070,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":692,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287624,"flow_last_seen":287624,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.93.150.146","src_port":28681,"dst_port":62507,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":692,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287624,"flow_last_seen":287624,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.93.150.146","src_port":28681,"dst_port":62507,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00634{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90184,"flow_last_seen":288014,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3860,"flow_avg_l4_payload_len":275,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":1194,"l4_proto":"udp","ndpi": {"confidence": {"1":"Match by port"},"proto":"OpenVPN","breed":"Acceptable","category":"VPN"}} +00568{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":265,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90184,"flow_last_seen":288014,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3860,"flow_avg_l4_payload_len":275,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":1194,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":621,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287485,"flow_last_seen":287485,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":53516,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":621,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287485,"flow_last_seen":287485,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":53516,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":668,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287588,"flow_last_seen":287588,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.18.211.177","src_port":28681,"dst_port":18085,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":668,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287588,"flow_last_seen":287588,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.18.211.177","src_port":28681,"dst_port":18085,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":721,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287683,"flow_last_seen":287683,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.26.178.132","src_port":28681,"dst_port":10053,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":721,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287683,"flow_last_seen":287683,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.26.178.132","src_port":28681,"dst_port":10053,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":443,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251763,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.14.31","src_port":28681,"dst_port":54754,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":443,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251763,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"183.179.14.31","src_port":28681,"dst_port":54754,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":698,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287649,"flow_last_seen":287649,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.199.10.60","src_port":28681,"dst_port":53906,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":698,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287649,"flow_last_seen":287649,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.199.10.60","src_port":28681,"dst_port":53906,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":623,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287486,"flow_last_seen":287486,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.234.18.166","src_port":28681,"dst_port":61319,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":623,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287486,"flow_last_seen":287486,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.234.18.166","src_port":28681,"dst_port":61319,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":715,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287681,"flow_last_seen":287681,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.174.174.69","src_port":28681,"dst_port":21358,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":715,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287681,"flow_last_seen":287681,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.174.174.69","src_port":28681,"dst_port":21358,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":615,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287467,"flow_last_seen":287467,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.118.77","src_port":28681,"dst_port":60482,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":615,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287467,"flow_last_seen":287467,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.118.77","src_port":28681,"dst_port":60482,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":607,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287443,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":28681,"dst_port":42288,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":607,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287443,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":28681,"dst_port":42288,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":740,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":19814,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":740,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":19814,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":587,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287428,"flow_last_seen":287428,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.134.154.158","src_port":28681,"dst_port":54130,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":587,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287428,"flow_last_seen":287428,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.134.154.158","src_port":28681,"dst_port":54130,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":550,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287342,"flow_last_seen":288307,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.238.145.82","src_port":28681,"dst_port":33527,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":550,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287342,"flow_last_seen":288307,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.238.145.82","src_port":28681,"dst_port":33527,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":689,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.36.234.196","src_port":28681,"dst_port":11629,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":689,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.36.234.196","src_port":28681,"dst_port":11629,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90073,"flow_last_seen":287523,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3852,"flow_avg_l4_payload_len":275,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":28681,"dst_port":6578,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":260,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90073,"flow_last_seen":287523,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3852,"flow_avg_l4_payload_len":275,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"46.128.114.107","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":671,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287599,"flow_last_seen":287599,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":28681,"dst_port":52669,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":671,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287599,"flow_last_seen":287599,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":28681,"dst_port":52669,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":598,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.172.184.48","src_port":28681,"dst_port":1512,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":598,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.172.184.48","src_port":28681,"dst_port":1512,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":686,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287622,"flow_last_seen":287622,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.241.31.96","src_port":28681,"dst_port":8349,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":686,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287622,"flow_last_seen":287622,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.241.31.96","src_port":28681,"dst_port":8349,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":722,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287683,"flow_last_seen":287869,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.203.72.224","src_port":28681,"dst_port":9897,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":722,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287683,"flow_last_seen":287869,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.203.72.224","src_port":28681,"dst_port":9897,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00581{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_state":"info","flow_packets_processed":11,"flow_first_seen":116628,"flow_last_seen":287381,"flow_idle_time":180000,"flow_min_l4_payload_len":56,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3123,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":6888,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00566{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":336,"flow_state":"info","flow_packets_processed":11,"flow_first_seen":116628,"flow_last_seen":287381,"flow_idle_time":180000,"flow_min_l4_payload_len":56,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3123,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":28681,"dst_port":6888,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":632,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.231.59.187","src_port":28681,"dst_port":62234,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":632,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.231.59.187","src_port":28681,"dst_port":62234,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":591,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":53707,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":591,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":53707,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":594,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287441,"flow_last_seen":287441,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":28681,"dst_port":7375,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":594,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287441,"flow_last_seen":287441,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":28681,"dst_port":7375,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":614,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287467,"flow_last_seen":287467,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.247.152.218","src_port":28681,"dst_port":51920,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":614,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287467,"flow_last_seen":287467,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.247.152.218","src_port":28681,"dst_port":51920,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":618,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287484,"flow_last_seen":287484,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":28681,"dst_port":7380,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":618,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287484,"flow_last_seen":287484,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":28681,"dst_port":7380,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":508,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287312,"flow_last_seen":287312,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.144.99.73","src_port":28681,"dst_port":10745,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":508,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287312,"flow_last_seen":287312,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.144.99.73","src_port":28681,"dst_port":10745,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":582,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287427,"flow_last_seen":287642,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.83.5","src_port":28681,"dst_port":10624,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":582,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287427,"flow_last_seen":287642,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.83.5","src_port":28681,"dst_port":10624,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":513,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.196.216.12","src_port":28681,"dst_port":58910,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":513,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.196.216.12","src_port":28681,"dst_port":58910,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":568,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287385,"flow_last_seen":287385,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.118.77","src_port":28681,"dst_port":56562,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":568,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287385,"flow_last_seen":287385,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.118.77","src_port":28681,"dst_port":56562,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":446,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251764,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.70.199.107","src_port":28681,"dst_port":60475,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":446,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251764,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.70.199.107","src_port":28681,"dst_port":60475,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":470,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251799,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":46790,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":470,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251799,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":46790,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":624,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287486,"flow_last_seen":287710,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"210.209.249.84","src_port":28681,"dst_port":24751,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":624,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287486,"flow_last_seen":287710,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"210.209.249.84","src_port":28681,"dst_port":24751,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":630,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287496,"flow_last_seen":287828,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":61,"flow_tot_l4_payload_len":89,"flow_avg_l4_payload_len":44,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":28681,"dst_port":45710,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":630,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287496,"flow_last_seen":287828,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":61,"flow_tot_l4_payload_len":89,"flow_avg_l4_payload_len":44,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":28681,"dst_port":45710,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":693,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287624,"flow_last_seen":287624,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.110.153.177","src_port":28681,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":693,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287624,"flow_last_seen":287624,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.110.153.177","src_port":28681,"dst_port":40022,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":604,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287443,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.202.31.113","src_port":28681,"dst_port":53291,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":604,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287443,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.202.31.113","src_port":28681,"dst_port":53291,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":719,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287682,"flow_last_seen":287682,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.102.208.175","src_port":28681,"dst_port":9167,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":719,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287682,"flow_last_seen":287682,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.102.208.175","src_port":28681,"dst_port":9167,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":447,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251764,"flow_last_seen":287495,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.199.10.60","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":447,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251764,"flow_last_seen":287495,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.199.10.60","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":451,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251765,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.35.66.21","src_port":28681,"dst_port":22234,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":451,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251765,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.35.66.21","src_port":28681,"dst_port":22234,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":600,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.64.156.63","src_port":28681,"dst_port":60092,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":600,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.64.156.63","src_port":28681,"dst_port":60092,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_state":"info","flow_packets_processed":16,"flow_first_seen":89966,"flow_last_seen":287418,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4798,"flow_avg_l4_payload_len":299,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":26253,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":250,"flow_state":"info","flow_packets_processed":16,"flow_first_seen":89966,"flow_last_seen":287418,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4798,"flow_avg_l4_payload_len":299,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":26253,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":646,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287511,"flow_last_seen":287511,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":28681,"dst_port":49803,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":646,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287511,"flow_last_seen":287511,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":28681,"dst_port":49803,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":662,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287526,"flow_last_seen":287526,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.127.1.235","src_port":28681,"dst_port":37814,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":662,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287526,"flow_last_seen":287526,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.127.1.235","src_port":28681,"dst_port":37814,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":499,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287310,"flow_last_seen":287954,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":306,"flow_tot_l4_payload_len":383,"flow_avg_l4_payload_len":191,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.161.80.82","src_port":28681,"dst_port":8656,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":499,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287310,"flow_last_seen":287954,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":306,"flow_tot_l4_payload_len":383,"flow_avg_l4_payload_len":191,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.161.80.82","src_port":28681,"dst_port":8656,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":627,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287496,"flow_last_seen":287496,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":28681,"dst_port":49815,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":627,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287496,"flow_last_seen":287496,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":28681,"dst_port":49815,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":384,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243617,"flow_last_seen":288007,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.64.6.175","src_port":28681,"dst_port":4743,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":384,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243617,"flow_last_seen":288007,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.64.6.175","src_port":28681,"dst_port":4743,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":378,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":287785,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.241.204.61","src_port":28681,"dst_port":43366,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":378,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":287785,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.241.204.61","src_port":28681,"dst_port":43366,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":704,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287651,"flow_last_seen":287651,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.40.67.191","src_port":28681,"dst_port":14971,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":704,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287651,"flow_last_seen":287651,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.40.67.191","src_port":28681,"dst_port":14971,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":657,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287525,"flow_last_seen":287525,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":54914,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":657,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287525,"flow_last_seen":287525,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":54914,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":728,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"101.136.187.253","src_port":28681,"dst_port":10914,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":728,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"101.136.187.253","src_port":28681,"dst_port":10914,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":456,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.241.112.255","src_port":28681,"dst_port":14766,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":456,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.241.112.255","src_port":28681,"dst_port":14766,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":521,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.250.32","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":521,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.250.32","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":505,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287312,"flow_last_seen":288223,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":320,"flow_tot_l4_payload_len":397,"flow_avg_l4_payload_len":198,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.2.62.28","src_port":28681,"dst_port":6387,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":505,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287312,"flow_last_seen":288223,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":320,"flow_tot_l4_payload_len":397,"flow_avg_l4_payload_len":198,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.2.62.28","src_port":28681,"dst_port":6387,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":494,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287308,"flow_last_seen":287308,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.210.81.59","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":494,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287308,"flow_last_seen":287308,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.210.81.59","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":375,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243615,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.182.136.42","src_port":28681,"dst_port":27873,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":375,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243615,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.182.136.42","src_port":28681,"dst_port":27873,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":455,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.153.206.183","src_port":28681,"dst_port":16919,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":455,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.153.206.183","src_port":28681,"dst_port":16919,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":453,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.127.26.138","src_port":28681,"dst_port":3083,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":453,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.127.26.138","src_port":28681,"dst_port":3083,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":498,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287310,"flow_last_seen":287310,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"8.44.149.207","src_port":28681,"dst_port":30551,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":498,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287310,"flow_last_seen":287310,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"8.44.149.207","src_port":28681,"dst_port":30551,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90039,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":28681,"dst_port":36368,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":257,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":90039,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":28681,"dst_port":36368,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":705,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287652,"flow_last_seen":287652,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.192.83.59","src_port":28681,"dst_port":33513,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":705,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287652,"flow_last_seen":287652,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.192.83.59","src_port":28681,"dst_port":33513,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":642,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287499,"flow_last_seen":287499,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.199.103","src_port":28681,"dst_port":2625,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":642,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287499,"flow_last_seen":287499,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.233.199.103","src_port":28681,"dst_port":2625,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":460,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"210.194.116.78","src_port":28681,"dst_port":8342,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":460,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"210.194.116.78","src_port":28681,"dst_port":8342,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":718,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287682,"flow_last_seen":287682,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"79.191.58.38","src_port":28681,"dst_port":48157,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":718,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287682,"flow_last_seen":287682,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"79.191.58.38","src_port":28681,"dst_port":48157,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":743,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287869,"flow_last_seen":287869,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":28681,"dst_port":36780,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":743,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287869,"flow_last_seen":287869,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":28681,"dst_port":36780,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":454,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.121.156","src_port":28681,"dst_port":23183,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":454,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.121.156","src_port":28681,"dst_port":23183,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":675,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287600,"flow_last_seen":287600,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.1.236","src_port":28681,"dst_port":9369,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":675,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287600,"flow_last_seen":287600,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.1.236","src_port":28681,"dst_port":9369,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":673,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287599,"flow_last_seen":287599,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.83.5","src_port":28681,"dst_port":4765,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":673,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287599,"flow_last_seen":287599,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.83.5","src_port":28681,"dst_port":4765,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":682,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287620,"flow_last_seen":287620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.220.41.241","src_port":28681,"dst_port":53072,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":682,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287620,"flow_last_seen":287620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.220.41.241","src_port":28681,"dst_port":53072,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":641,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.36.249.91","src_port":28681,"dst_port":65430,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":641,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.36.249.91","src_port":28681,"dst_port":65430,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":683,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287621,"flow_last_seen":287621,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":50896,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":683,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287621,"flow_last_seen":287621,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.220.198.244","src_port":28681,"dst_port":50896,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":680,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287620,"flow_last_seen":287620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.83.132","src_port":28681,"dst_port":57131,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":680,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287620,"flow_last_seen":287620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.83.132","src_port":28681,"dst_port":57131,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":695,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287625,"flow_last_seen":287625,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":6514,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":695,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287625,"flow_last_seen":287625,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":6514,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":469,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251799,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":47184,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":469,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251799,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":47184,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00583{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":95893,"flow_last_seen":287340,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1914,"flow_avg_l4_payload_len":239,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":21995,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00568{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":321,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":95893,"flow_last_seen":287340,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1914,"flow_avg_l4_payload_len":239,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":21995,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":666,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287588,"flow_last_seen":287588,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.36.106.134","src_port":28681,"dst_port":3927,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":666,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287588,"flow_last_seen":287588,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.36.106.134","src_port":28681,"dst_port":3927,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":661,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287526,"flow_last_seen":287526,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":6527,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":661,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287526,"flow_last_seen":287526,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":6527,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":616,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287468,"flow_last_seen":287468,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.195.236.249","src_port":28681,"dst_port":18557,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":616,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287468,"flow_last_seen":287468,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.195.236.249","src_port":28681,"dst_port":18557,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":717,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287682,"flow_last_seen":287682,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.249.190.8","src_port":28681,"dst_port":25198,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":717,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287682,"flow_last_seen":287682,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.249.190.8","src_port":28681,"dst_port":25198,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":732,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287699,"flow_last_seen":287699,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.163","src_port":28681,"dst_port":6564,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":732,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287699,"flow_last_seen":287699,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.163","src_port":28681,"dst_port":6564,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":124090,"flow_last_seen":287890,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":269,"flow_avg_l4_payload_len":53,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.208.26.154","src_port":28681,"dst_port":4994,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":342,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":124090,"flow_last_seen":287890,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":269,"flow_avg_l4_payload_len":53,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.208.26.154","src_port":28681,"dst_port":4994,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":388,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243618,"flow_last_seen":287524,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"121.7.145.36","src_port":28681,"dst_port":33905,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":388,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243618,"flow_last_seen":287524,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"121.7.145.36","src_port":28681,"dst_port":33905,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":736,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":52420,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":736,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.31.152.112","src_port":28681,"dst_port":52420,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":748,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":289962,"flow_last_seen":289962,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.163","src_port":28681,"dst_port":6599,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":748,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":289962,"flow_last_seen":289962,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.163","src_port":28681,"dst_port":6599,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":635,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.179.18.242","src_port":28681,"dst_port":47329,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":635,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.179.18.242","src_port":28681,"dst_port":47329,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00581{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_state":"info","flow_packets_processed":11,"flow_first_seen":89829,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3598,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":28681,"dst_port":35481,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00566{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":246,"flow_state":"info","flow_packets_processed":11,"flow_first_seen":89829,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3598,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.65.68.194","src_port":28681,"dst_port":35481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":527,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287321,"flow_last_seen":287321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.72.149.140","src_port":28681,"dst_port":37848,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":527,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287321,"flow_last_seen":287321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.72.149.140","src_port":28681,"dst_port":37848,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":644,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287510,"flow_last_seen":287583,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"31.20.248.147","src_port":28681,"dst_port":30706,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":644,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287510,"flow_last_seen":287583,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"31.20.248.147","src_port":28681,"dst_port":30706,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":712,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287654,"flow_last_seen":287654,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.129.86.65","src_port":28681,"dst_port":49723,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":712,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287654,"flow_last_seen":287654,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.129.86.65","src_port":28681,"dst_port":49723,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":563,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287383,"flow_last_seen":287383,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.105.52.2","src_port":28681,"dst_port":6831,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":563,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287383,"flow_last_seen":287383,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.105.52.2","src_port":28681,"dst_port":6831,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":504,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287311,"flow_last_seen":287311,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.203.45.107","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":504,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287311,"flow_last_seen":287311,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.203.45.107","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":640,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":28681,"dst_port":7849,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":640,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287498,"flow_last_seen":287498,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":28681,"dst_port":7849,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":730,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.47.227.91","src_port":28681,"dst_port":54463,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":730,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.47.227.91","src_port":28681,"dst_port":54463,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":733,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287699,"flow_last_seen":287783,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.168.34.105","src_port":28681,"dst_port":39908,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":733,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287699,"flow_last_seen":287783,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.168.34.105","src_port":28681,"dst_port":39908,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":634,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.174.18.115","src_port":28681,"dst_port":50679,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":634,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.174.18.115","src_port":28681,"dst_port":50679,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":608,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287444,"flow_last_seen":287781,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.241.31.96","src_port":28681,"dst_port":4814,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":608,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287444,"flow_last_seen":287781,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.241.31.96","src_port":28681,"dst_port":4814,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00581{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":95784,"flow_last_seen":287572,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2838,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.236.205.7","src_port":28681,"dst_port":34794,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00566{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":317,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":95784,"flow_last_seen":287572,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2838,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.236.205.7","src_port":28681,"dst_port":34794,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":706,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287652,"flow_last_seen":287652,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":28681,"dst_port":8658,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":706,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287652,"flow_last_seen":287652,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":28681,"dst_port":8658,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":699,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287649,"flow_last_seen":287958,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"70.81.219.111","src_port":28681,"dst_port":19210,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":699,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287649,"flow_last_seen":287958,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"70.81.219.111","src_port":28681,"dst_port":19210,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":595,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287441,"flow_last_seen":287441,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.182.21.156","src_port":28681,"dst_port":13732,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":595,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287441,"flow_last_seen":287441,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.182.21.156","src_port":28681,"dst_port":13732,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":724,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287697,"flow_last_seen":287697,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.39.219.223","src_port":28681,"dst_port":13482,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":724,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287697,"flow_last_seen":287697,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"175.39.219.223","src_port":28681,"dst_port":13482,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":376,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243615,"flow_last_seen":287944,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":203,"flow_avg_l4_payload_len":50,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"156.57.42.2","src_port":28681,"dst_port":33476,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":376,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243615,"flow_last_seen":287944,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":73,"flow_tot_l4_payload_len":203,"flow_avg_l4_payload_len":50,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"156.57.42.2","src_port":28681,"dst_port":33476,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":674,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287599,"flow_last_seen":287599,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"125.59.215.249","src_port":28681,"dst_port":14571,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":674,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287599,"flow_last_seen":287599,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"125.59.215.249","src_port":28681,"dst_port":14571,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":612,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287466,"flow_last_seen":287466,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":59384,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":612,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287466,"flow_last_seen":287466,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":59384,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":725,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287697,"flow_last_seen":287697,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.65.217.224","src_port":28681,"dst_port":9070,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":725,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287697,"flow_last_seen":287697,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.65.217.224","src_port":28681,"dst_port":9070,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90138,"flow_last_seen":287634,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4009,"flow_avg_l4_payload_len":286,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":28681,"dst_port":21301,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":261,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90138,"flow_last_seen":287634,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":4009,"flow_avg_l4_payload_len":286,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"60.241.48.194","src_port":28681,"dst_port":21301,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":667,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287588,"flow_last_seen":287588,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"159.196.95.223","src_port":28681,"dst_port":2003,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":667,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287588,"flow_last_seen":287588,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"159.196.95.223","src_port":28681,"dst_port":2003,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":645,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287510,"flow_last_seen":287510,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.22.22.94","src_port":28681,"dst_port":34245,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":645,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287510,"flow_last_seen":287510,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"173.22.22.94","src_port":28681,"dst_port":34245,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":649,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287511,"flow_last_seen":287824,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.218.135.222","src_port":28681,"dst_port":4548,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":649,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287511,"flow_last_seen":287824,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.218.135.222","src_port":28681,"dst_port":4548,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":95716,"flow_last_seen":287440,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2001,"flow_avg_l4_payload_len":250,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":313,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":95716,"flow_last_seen":287440,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2001,"flow_avg_l4_payload_len":250,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.99.176.20","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":579,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287426,"flow_last_seen":287647,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.170.108","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":579,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287426,"flow_last_seen":287647,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.170.108","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":678,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287619,"flow_last_seen":287619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.83.5","src_port":28681,"dst_port":9128,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":678,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287619,"flow_last_seen":287619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.83.5","src_port":28681,"dst_port":9128,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":707,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287652,"flow_last_seen":287652,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.200.235","src_port":28681,"dst_port":1968,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":707,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287652,"flow_last_seen":287652,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.200.235","src_port":28681,"dst_port":1968,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":655,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287524,"flow_last_seen":287524,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.118.116.198","src_port":28681,"dst_port":44616,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":655,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287524,"flow_last_seen":287524,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.118.116.198","src_port":28681,"dst_port":44616,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":726,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.91.30.216","src_port":28681,"dst_port":61635,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":726,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.91.30.216","src_port":28681,"dst_port":61635,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00581{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":95893,"flow_last_seen":287579,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2031,"flow_avg_l4_payload_len":253,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":55302,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00566{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":319,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":95893,"flow_last_seen":287579,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2031,"flow_avg_l4_payload_len":253,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":55302,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90864,"flow_last_seen":287337,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1242,"flow_avg_l4_payload_len":207,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":53489,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":302,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":90864,"flow_last_seen":287337,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1242,"flow_avg_l4_payload_len":207,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":53489,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":669,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287589,"flow_last_seen":287589,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":64731,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":669,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287589,"flow_last_seen":287589,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":64731,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_state":"info","flow_packets_processed":18,"flow_first_seen":90039,"flow_last_seen":287415,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5624,"flow_avg_l4_payload_len":312,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":30577,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":255,"flow_state":"info","flow_packets_processed":18,"flow_first_seen":90039,"flow_last_seen":287415,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5624,"flow_avg_l4_payload_len":312,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.61.221.246","src_port":28681,"dst_port":30577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":742,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":4364,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":742,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":4364,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":697,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287648,"flow_last_seen":287648,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":55050,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":697,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287648,"flow_last_seen":287648,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.165.203.190","src_port":28681,"dst_port":55050,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":585,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287428,"flow_last_seen":287428,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":35004,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":585,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287428,"flow_last_seen":287428,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"51.68.153.214","src_port":28681,"dst_port":35004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":502,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287311,"flow_last_seen":287311,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.156.58.211","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":502,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287311,"flow_last_seen":287311,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"47.156.58.211","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":507,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287312,"flow_last_seen":287312,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.4.204.220","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":507,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287312,"flow_last_seen":287312,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.4.204.220","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":687,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287622,"flow_last_seen":287622,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":28681,"dst_port":13965,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":687,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287622,"flow_last_seen":287622,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":28681,"dst_port":13965,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":663,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287532,"flow_last_seen":288223,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.59.117.166","src_port":28681,"dst_port":33192,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":663,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287532,"flow_last_seen":288223,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.59.117.166","src_port":28681,"dst_port":33192,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":602,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.203.72.224","src_port":28681,"dst_port":53658,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":602,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.203.72.224","src_port":28681,"dst_port":53658,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":589,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.250.32","src_port":28681,"dst_port":52647,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":589,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.250.32","src_port":28681,"dst_port":52647,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":654,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287524,"flow_last_seen":287524,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.12.1.136","src_port":28681,"dst_port":6348,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":654,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287524,"flow_last_seen":287524,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.12.1.136","src_port":28681,"dst_port":6348,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":458,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.165.228.167","src_port":28681,"dst_port":12201,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":458,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.165.228.167","src_port":28681,"dst_port":12201,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":525,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.250.32","src_port":28681,"dst_port":52660,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":525,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.250.32","src_port":28681,"dst_port":52660,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":611,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287466,"flow_last_seen":287466,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.10.174.159","src_port":28681,"dst_port":4841,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":611,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287466,"flow_last_seen":287466,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.10.174.159","src_port":28681,"dst_port":4841,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":89829,"flow_last_seen":287526,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":12012,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":248,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":89829,"flow_last_seen":287526,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":67,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":12012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":512,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"209.204.207.5","src_port":28681,"dst_port":49256,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":512,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"209.204.207.5","src_port":28681,"dst_port":49256,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":735,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287858,"flow_last_seen":287858,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.91.201","src_port":28681,"dst_port":4297,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":735,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287858,"flow_last_seen":287858,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.91.201","src_port":28681,"dst_port":4297,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":628,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287496,"flow_last_seen":288483,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.62.225.181","src_port":28681,"dst_port":46843,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":628,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287496,"flow_last_seen":288483,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.62.225.181","src_port":28681,"dst_port":46843,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":380,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":287697,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.86.49.195","src_port":28681,"dst_port":12019,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":380,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":287697,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.86.49.195","src_port":28681,"dst_port":12019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":703,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287651,"flow_last_seen":287651,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":10728,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":703,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287651,"flow_last_seen":287651,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":10728,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":651,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287523,"flow_last_seen":287523,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.47.227.91","src_port":28681,"dst_port":58856,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":651,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287523,"flow_last_seen":287523,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.47.227.91","src_port":28681,"dst_port":58856,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":581,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287426,"flow_last_seen":287426,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.115.108.10","src_port":28681,"dst_port":4641,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":581,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287426,"flow_last_seen":287426,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.115.108.10","src_port":28681,"dst_port":4641,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":613,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287466,"flow_last_seen":287466,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"106.104.88.139","src_port":28681,"dst_port":7423,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":613,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287466,"flow_last_seen":287466,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"106.104.88.139","src_port":28681,"dst_port":7423,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":583,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287427,"flow_last_seen":287427,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.75.180.80","src_port":28681,"dst_port":35361,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":583,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287427,"flow_last_seen":287427,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.75.180.80","src_port":28681,"dst_port":35361,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":672,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287599,"flow_last_seen":287599,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.218.135.222","src_port":28681,"dst_port":49867,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":672,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287599,"flow_last_seen":287599,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.218.135.222","src_port":28681,"dst_port":49867,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":574,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287424,"flow_last_seen":287697,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.17.132.18","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":574,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287424,"flow_last_seen":287697,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.17.132.18","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":679,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287619,"flow_last_seen":287619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"150.116.225.105","src_port":28681,"dst_port":51438,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":679,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287619,"flow_last_seen":287619,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"150.116.225.105","src_port":28681,"dst_port":51438,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":518,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287316,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"202.151.63.59","src_port":28681,"dst_port":7624,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":518,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287316,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"202.151.63.59","src_port":28681,"dst_port":7624,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":716,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287681,"flow_last_seen":287681,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.71.72.88","src_port":28681,"dst_port":58808,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":716,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287681,"flow_last_seen":287681,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.71.72.88","src_port":28681,"dst_port":58808,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":660,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287525,"flow_last_seen":287525,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":10791,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":660,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287525,"flow_last_seen":287525,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":10791,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":457,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.247.240.113","src_port":28681,"dst_port":13867,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":457,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251766,"flow_last_seen":287317,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.247.240.113","src_port":28681,"dst_port":13867,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":564,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287384,"flow_last_seen":287384,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":28681,"dst_port":53144,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":564,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287384,"flow_last_seen":287384,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":28681,"dst_port":53144,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":648,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287511,"flow_last_seen":287511,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.18.212.223","src_port":28681,"dst_port":58290,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":648,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287511,"flow_last_seen":287511,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.18.212.223","src_port":28681,"dst_port":58290,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":700,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287650,"flow_last_seen":287650,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.222.213.44","src_port":28681,"dst_port":26536,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":700,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287650,"flow_last_seen":287650,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.222.213.44","src_port":28681,"dst_port":26536,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":652,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287523,"flow_last_seen":287523,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.64.156.63","src_port":28681,"dst_port":65023,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":652,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287523,"flow_last_seen":287523,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.64.156.63","src_port":28681,"dst_port":65023,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":659,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287525,"flow_last_seen":287525,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":28681,"dst_port":8075,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":659,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287525,"flow_last_seen":287525,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":28681,"dst_port":8075,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":713,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287681,"flow_last_seen":287681,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":59978,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":713,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287681,"flow_last_seen":287681,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"185.187.74.173","src_port":28681,"dst_port":59978,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":658,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287525,"flow_last_seen":287525,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":28681,"dst_port":53195,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":658,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287525,"flow_last_seen":287525,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":28681,"dst_port":53195,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00584{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":174303,"flow_last_seen":287509,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1210,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":28681,"dst_port":10825,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00569{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":364,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":174303,"flow_last_seen":287509,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":1210,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"194.163.180.126","src_port":28681,"dst_port":10825,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":576,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287424,"flow_last_seen":287424,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":42925,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":576,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287424,"flow_last_seen":287424,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":42925,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":570,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287387,"flow_last_seen":287752,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":28681,"dst_port":8890,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":570,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287387,"flow_last_seen":287752,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":28681,"dst_port":8890,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":681,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287620,"flow_last_seen":287620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.227.198.100","src_port":28681,"dst_port":6910,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":681,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287620,"flow_last_seen":287620,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.227.198.100","src_port":28681,"dst_port":6910,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":500,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287310,"flow_last_seen":287310,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.143.34.225","src_port":28681,"dst_port":20071,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":500,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287310,"flow_last_seen":287310,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.143.34.225","src_port":28681,"dst_port":20071,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":566,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287385,"flow_last_seen":287385,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.176.62.40","src_port":28681,"dst_port":52755,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":566,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287385,"flow_last_seen":287385,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.176.62.40","src_port":28681,"dst_port":52755,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":514,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.114.40.175","src_port":28681,"dst_port":23552,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":514,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.114.40.175","src_port":28681,"dst_port":23552,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":599,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":59875,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":599,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":59875,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":517,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287315,"flow_last_seen":288490,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":314,"flow_tot_l4_payload_len":391,"flow_avg_l4_payload_len":195,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.239.162.27","src_port":28681,"dst_port":7986,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":517,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287315,"flow_last_seen":288490,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":314,"flow_tot_l4_payload_len":391,"flow_avg_l4_payload_len":195,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.239.162.27","src_port":28681,"dst_port":7986,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":519,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287316,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.48.23","src_port":28681,"dst_port":8070,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":519,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287316,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.48.23","src_port":28681,"dst_port":8070,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":601,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.200.161","src_port":28681,"dst_port":65274,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":601,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287442,"flow_last_seen":287442,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.200.161","src_port":28681,"dst_port":65274,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00583{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_state":"info","flow_packets_processed":18,"flow_first_seen":90005,"flow_last_seen":287678,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5605,"flow_avg_l4_payload_len":311,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":28681,"dst_port":61616,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00568{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":253,"flow_state":"info","flow_packets_processed":18,"flow_first_seen":90005,"flow_last_seen":287678,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5605,"flow_avg_l4_payload_len":311,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.37.255.130","src_port":28681,"dst_port":61616,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":639,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287498,"flow_last_seen":287719,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.242.225","src_port":28681,"dst_port":15068,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":639,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287498,"flow_last_seen":287719,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.242.225","src_port":28681,"dst_port":15068,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":463,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251768,"flow_last_seen":287699,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.7.155.210","src_port":28681,"dst_port":28365,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":463,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251768,"flow_last_seen":287699,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.7.155.210","src_port":28681,"dst_port":28365,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":727,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.171.82.65","src_port":28681,"dst_port":50072,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":727,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.171.82.65","src_port":28681,"dst_port":50072,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":452,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251765,"flow_last_seen":287440,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.227.193.37","src_port":28681,"dst_port":27481,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":452,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251765,"flow_last_seen":287440,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.227.193.37","src_port":28681,"dst_port":27481,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":609,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287444,"flow_last_seen":287749,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.163.14.246","src_port":28681,"dst_port":23461,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":609,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287444,"flow_last_seen":287749,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.163.14.246","src_port":28681,"dst_port":23461,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":737,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.166.252.163","src_port":28681,"dst_port":14391,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":737,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287859,"flow_last_seen":287859,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.166.252.163","src_port":28681,"dst_port":14391,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00581{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":448,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251764,"flow_last_seen":287579,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":28681,"dst_port":15677,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00566{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":448,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251764,"flow_last_seen":287579,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":28681,"dst_port":15677,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":549,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287342,"flow_last_seen":287495,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.211.151.48","src_port":28681,"dst_port":11105,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":549,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287342,"flow_last_seen":287495,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.211.151.48","src_port":28681,"dst_port":11105,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":459,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.89.84.59","src_port":28681,"dst_port":11603,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":459,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"100.89.84.59","src_port":28681,"dst_port":11603,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":626,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287487,"flow_last_seen":287487,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.206.254","src_port":28681,"dst_port":49737,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":626,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287487,"flow_last_seen":287487,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.206.254","src_port":28681,"dst_port":49737,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":580,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287426,"flow_last_seen":287426,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.119.55.28","src_port":28681,"dst_port":20347,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":580,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287426,"flow_last_seen":287426,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.119.55.28","src_port":28681,"dst_port":20347,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":339,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":123912,"flow_last_seen":287321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":109,"flow_avg_l4_payload_len":54,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":54130,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":339,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":123912,"flow_last_seen":287321,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":109,"flow_avg_l4_payload_len":54,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.123.54.234","src_port":28681,"dst_port":54130,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":625,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287486,"flow_last_seen":287486,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":28681,"dst_port":57492,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":625,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287486,"flow_last_seen":287486,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":28681,"dst_port":57492,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":567,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287385,"flow_last_seen":287385,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.176.62.40","src_port":28681,"dst_port":52889,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":567,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287385,"flow_last_seen":287385,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.176.62.40","src_port":28681,"dst_port":52889,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":685,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287621,"flow_last_seen":287621,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":54436,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":685,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287621,"flow_last_seen":287621,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":54436,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":744,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287977,"flow_last_seen":288382,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"27.94.154.53","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":744,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287977,"flow_last_seen":288382,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"27.94.154.53","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":95784,"flow_last_seen":287857,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2839,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":63637,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":316,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":95784,"flow_last_seen":287857,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":2839,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":28681,"dst_port":63637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":731,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287699,"flow_last_seen":287699,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.217.188.105","src_port":28681,"dst_port":62849,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":731,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287699,"flow_last_seen":287699,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.217.188.105","src_port":28681,"dst_port":62849,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":711,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287654,"flow_last_seen":287654,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.254.140.225","src_port":28681,"dst_port":63637,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":711,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287654,"flow_last_seen":287654,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.254.140.225","src_port":28681,"dst_port":63637,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":710,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287653,"flow_last_seen":287653,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.121.156","src_port":28681,"dst_port":3624,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":710,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287653,"flow_last_seen":287653,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.16.121.156","src_port":28681,"dst_port":3624,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":688,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":53454,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":688,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":28681,"dst_port":53454,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":445,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251764,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.165.153.100","src_port":28681,"dst_port":4509,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":445,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251764,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.165.153.100","src_port":28681,"dst_port":4509,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90138,"flow_last_seen":287483,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3990,"flow_avg_l4_payload_len":285,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":28681,"dst_port":46010,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":262,"flow_state":"info","flow_packets_processed":14,"flow_first_seen":90138,"flow_last_seen":287483,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":3990,"flow_avg_l4_payload_len":285,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.75.52.19","src_port":28681,"dst_port":46010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":510,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"79.94.85.113","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":510,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287314,"flow_last_seen":287314,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"79.94.85.113","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":653,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287523,"flow_last_seen":287523,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.139.21.182","src_port":28681,"dst_port":50110,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":653,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287523,"flow_last_seen":287523,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.139.21.182","src_port":28681,"dst_port":50110,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":497,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287309,"flow_last_seen":287309,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.100.76.123","src_port":28681,"dst_port":39628,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":497,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287309,"flow_last_seen":287309,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.100.76.123","src_port":28681,"dst_port":39628,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":393,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243619,"flow_last_seen":287426,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.115.158.103","src_port":28681,"dst_port":5110,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":393,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":243619,"flow_last_seen":287426,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"58.115.158.103","src_port":28681,"dst_port":5110,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":464,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251768,"flow_last_seen":287532,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"101.128.66.8","src_port":28681,"dst_port":34512,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":464,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":251768,"flow_last_seen":287532,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"101.128.66.8","src_port":28681,"dst_port":34512,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":515,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287315,"flow_last_seen":287315,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.137.106.173","src_port":28681,"dst_port":11625,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":515,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287315,"flow_last_seen":287315,"flow_idle_time":180000,"flow_min_l4_payload_len":77,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":77,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.137.106.173","src_port":28681,"dst_port":11625,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":522,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.247.152.218","src_port":28681,"dst_port":51153,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":522,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287320,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.247.152.218","src_port":28681,"dst_port":51153,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":480,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.74.26","src_port":28681,"dst_port":65498,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":480,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251801,"flow_last_seen":287320,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.74.26","src_port":28681,"dst_port":65498,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":382,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243617,"flow_last_seen":287618,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.175.11.126","src_port":28681,"dst_port":40958,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":382,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243617,"flow_last_seen":287618,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":48,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.175.11.126","src_port":28681,"dst_port":40958,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":590,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":28681,"dst_port":48380,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":590,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":28681,"dst_port":48380,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":462,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":47808,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":462,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251767,"flow_last_seen":287318,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"164.132.10.25","src_port":28681,"dst_port":47808,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00754{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":605,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287443,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.149.125.139","src_port":28681,"dst_port":6578,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"2":"Match by IP"},"proto":"Tor","breed":"Potentially Dangerous","category":"VPN"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":605,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287443,"flow_last_seen":287443,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"180.149.125.139","src_port":28681,"dst_port":6578,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":690,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.65.217.224","src_port":28681,"dst_port":3688,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":690,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287623,"flow_last_seen":287623,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.65.217.224","src_port":28681,"dst_port":3688,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":665,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287587,"flow_last_seen":287587,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.172.183.237","src_port":28681,"dst_port":4983,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":665,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287587,"flow_last_seen":287587,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.172.183.237","src_port":28681,"dst_port":4983,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":709,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287653,"flow_last_seen":287653,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.244.68.65","src_port":28681,"dst_port":51967,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":709,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287653,"flow_last_seen":287653,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.244.68.65","src_port":28681,"dst_port":51967,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":656,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287524,"flow_last_seen":287769,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":28681,"dst_port":2566,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":656,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287524,"flow_last_seen":287769,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":28681,"dst_port":2566,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":729,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.10.134.44","src_port":28681,"dst_port":19739,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":729,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287698,"flow_last_seen":287698,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.10.134.44","src_port":28681,"dst_port":19739,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":548,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287342,"flow_last_seen":287664,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.50.147.205","src_port":28681,"dst_port":17735,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":548,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287342,"flow_last_seen":287664,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.50.147.205","src_port":28681,"dst_port":17735,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":633,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.149.2.44","src_port":28681,"dst_port":20964,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":633,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287497,"flow_last_seen":287497,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.149.2.44","src_port":28681,"dst_port":20964,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":475,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":28681,"dst_port":63978,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":475,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":28681,"dst_port":63978,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":473,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":28681,"dst_port":33564,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":473,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251800,"flow_last_seen":287319,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.132.165.13","src_port":28681,"dst_port":33564,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":575,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287424,"flow_last_seen":287621,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.202.31.113","src_port":28681,"dst_port":19768,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":575,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287424,"flow_last_seen":287621,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.202.31.113","src_port":28681,"dst_port":19768,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":588,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.175.103","src_port":28681,"dst_port":4315,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":588,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287429,"flow_last_seen":287429,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.175.103","src_port":28681,"dst_port":4315,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":379,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":288106,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.140.63.147","src_port":28681,"dst_port":29545,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":379,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":243616,"flow_last_seen":288106,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.140.63.147","src_port":28681,"dst_port":29545,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":174342,"flow_last_seen":287510,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":841,"flow_avg_l4_payload_len":280,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":28681,"dst_port":49956,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":367,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":174342,"flow_last_seen":287510,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":841,"flow_avg_l4_payload_len":280,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"149.28.163.175","src_port":28681,"dst_port":49956,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":720,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287683,"flow_last_seen":287944,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.11.85","src_port":28681,"dst_port":10722,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":720,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287683,"flow_last_seen":287944,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.11.85","src_port":28681,"dst_port":10722,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":442,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251763,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.204.130.55","src_port":28681,"dst_port":29545,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":442,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251763,"flow_last_seen":287316,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"89.204.130.55","src_port":28681,"dst_port":29545,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":631,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287496,"flow_last_seen":287805,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":3931,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":631,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287496,"flow_last_seen":287805,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":3931,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":565,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287385,"flow_last_seen":287385,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.45.40.28","src_port":28681,"dst_port":2656,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":565,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287385,"flow_last_seen":287385,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.45.40.28","src_port":28681,"dst_port":2656,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":523,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287320,"flow_last_seen":287724,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.162.138.200","src_port":28681,"dst_port":24018,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":523,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287320,"flow_last_seen":287724,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.162.138.200","src_port":28681,"dst_port":24018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":694,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287625,"flow_last_seen":287625,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.215.130.156","src_port":28681,"dst_port":12405,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":694,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":287625,"flow_last_seen":287625,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.215.130.156","src_port":28681,"dst_port":12405,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":503,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287311,"flow_last_seen":433135,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.210.244.72","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6530,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":569,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287386,"flow_last_seen":294825,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":464672,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.89.249.8","src_port":28681,"dst_port":50649,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":747,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":289961,"flow_last_seen":290166,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.126.102","src_port":28681,"dst_port":5193,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":747,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":289961,"flow_last_seen":290166,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.126.102","src_port":28681,"dst_port":5193,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":569,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287386,"flow_last_seen":294825,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.89.249.8","src_port":28681,"dst_port":50649,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":569,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287386,"flow_last_seen":294825,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.89.249.8","src_port":28681,"dst_port":50649,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":544,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287341,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.184.29.35","src_port":28681,"dst_port":30582,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":533,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.229.185.60","src_port":28681,"dst_port":6898,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":553,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3259,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":546,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287341,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49867,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":531,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":51497,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":534,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":54436,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":562,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287357,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.242.110","src_port":28681,"dst_port":59879,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":542,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":51675,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":551,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287355,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.24.129.230","src_port":28681,"dst_port":14766,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":555,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":28681,"dst_port":20387,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":573,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":287424,"flow_last_seen":351110,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":34,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.239.173.18","src_port":28681,"dst_port":23327,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":538,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.41.253","src_port":28681,"dst_port":14339,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":536,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.167.222.160","src_port":28681,"dst_port":56121,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":558,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.105.52.2","src_port":28681,"dst_port":6466,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":556,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":28681,"dst_port":49787,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":560,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":53883,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":559,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":55080,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":529,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287338,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":28681,"dst_port":57929,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":539,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":28681,"dst_port":7510,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":545,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287341,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.49.159.77","src_port":28681,"dst_port":55915,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":664,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287573,"flow_last_seen":320293,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.163","src_port":28681,"dst_port":6594,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":554,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.203.72.224","src_port":28681,"dst_port":55577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":528,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287338,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":58442,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":537,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.200.235","src_port":28681,"dst_port":2034,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":535,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":10655,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":532,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":10677,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":696,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287635,"flow_last_seen":320293,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.189.72.230","src_port":28681,"dst_port":8161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":552,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.250.6.59","src_port":28681,"dst_port":60012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":543,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.39.159.60","src_port":28681,"dst_port":56896,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":557,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":28681,"dst_port":53163,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":561,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287357,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":28681,"dst_port":57466,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":541,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":11141,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":547,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287341,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":43316,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":530,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.167.248.220","src_port":28681,"dst_port":59304,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6627,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":540,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":474890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":28681,"dst_port":52131,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6740,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":765,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":487301,"flow_last_seen":487301,"flow_idle_time":180000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":487301,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6740,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":765,"flow_packet_id":1,"flow_last_seen":487301,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"thread_ts_msec":487301,"pkt":"UlQAEjUCCAAn5uVZCABFAAA5AskAAIAR5hYKAAIP1eVv4HAJEwwAJWwB0z8xAk+Gsu3\/0VASOMQWAwABAAYAAADDg0dVRUA="} +00803{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6769,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":765,"flow_packet_id":2,"flow_last_seen":490657,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":320,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":320,"pkt_l4_len":286,"thread_ts_msec":490657,"pkt":"CAAn5uVZUlQAEjUCCABFAAEyELoAAEARFy3V5W\/gCgACDxMMcAkBHg6l0z8xAk+Gsu3\/0VASOMQWAwEBAP8AAAAME9Xlb+AAAAAACAAAAMMCVkNFR1RLR2IDR1VFQQICVVBDAmoHAkRVQ4BRAQNUTFNAA0RIVEMAAAEDSVBQgnRH760SH1uvticLsTJMdzcce09JPuG1+7ZWgcRUuyYtQVcYST\/c7pFS94KcOSoCxIJ28cw9ZqkOyP\/lwpB7bj2pxS5hU7eUuiLKG8EGyhhJwOftzCVWmRVdWI9U05cwYStNOtM03g5ZSzQTurO5u0qt8dBUR\/M8woYfFPiT8ncyOu6VxxnfEYQSolvbVQpTXSJ89NMro1t6dWROMiMBQdngzUdEQl6ER0VwaTQColtBtufo0h6HSVBQX1RMU0MYQGA="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6770,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":766,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490658,"flow_last_seen":490658,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490658,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.119.55.28","src_port":28681,"dst_port":20347,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6770,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":766,"flow_packet_id":1,"flow_last_seen":490658,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490658,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4AqgAAIARqGsKAAIPTHc3HHAJT3sAJJyJkxsxAuxy8t\/\/N8rfWQ9\/AwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6771,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":767,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490658,"flow_last_seen":490658,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490658,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.65.87.24","src_port":28681,"dst_port":16201,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6771,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":767,"flow_packet_id":1,"flow_last_seen":490658,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490658,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4uwIAAIAR70oKAAIPLUFXGHAJP0kAJHPKPO4xAgeDkI\/\/iKmGa7BjAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6772,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":768,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490658,"flow_last_seen":490658,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490658,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":28681,"dst_port":37058,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6772,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":768,"flow_packet_id":1,"flow_last_seen":490658,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490658,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4tiwAAIARacwKAAIPDsj\/5XAJkMIAJG\/2XGQxAgSi0ID\/hbiT8iWZAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6773,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":769,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490659,"flow_last_seen":490659,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490659,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.110.61.169","src_port":28681,"dst_port":11973,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6773,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":769,"flow_packet_id":1,"flow_last_seen":490659,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490659,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Bw4AAIARboEKAAIPe249qXAJLsUAJMyhFvwxApCBvb\/\/iS1cCYw0AwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6774,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":770,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490659,"flow_last_seen":490659,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490659,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":28681,"dst_port":8890,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6774,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":770,"flow_packet_id":1,"flow_last_seen":490659,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490659,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4s\/MAAIARYcsKAAIPYVO3lHAJIroAJLxJIO4xAnNm5yn\/vkjYaSxfAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6775,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":771,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490659,"flow_last_seen":490659,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490659,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"202.27.193.6","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6775,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":771,"flow_packet_id":1,"flow_last_seen":490659,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490659,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4wkYAAIAR4T0KAAIPyhvBBnAJGMoAJAVXKJQxAlC054P\/L003fbawAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6776,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":772,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490659,"flow_last_seen":490659,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490659,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.192.231.237","src_port":28681,"dst_port":9676,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6776,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":772,"flow_packet_id":1,"flow_last_seen":490659,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490659,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4XBsAAIARoN0KAAIPScDn7XAJJcwAJAhm5XkxAvPP\/+H\/WLVx7VapAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6777,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":773,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490659,"flow_last_seen":490659,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490659,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.153.21.93","src_port":28681,"dst_port":36696,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6777,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":773,"flow_packet_id":1,"flow_last_seen":490659,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490659,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4mT8AAIARKXEKAAIPVpkVXXAJj1gAJN3VdCgxAouIwrH\/i75JTtDcAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6778,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":774,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490659,"flow_last_seen":490659,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490659,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":6599,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6778,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":774,"flow_packet_id":1,"flow_last_seen":490659,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490659,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4f\/EAAIARjeUKAAIPMjrulXAJGccAJMGN5+0xAg\/iY9D\/XxTINEDkAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6779,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":775,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490660,"flow_last_seen":490660,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490660,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.17.132.18","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6779,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":775,"flow_packet_id":1,"flow_last_seen":490660,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490660,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4SSsAAIARglcKAAIP3xGEEnAJW6IAJBZVg9sxAjy4c4P\/utzozFbSAwABAAUAAADDglFLQA=="} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6780,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":776,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490660,"flow_last_seen":490660,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490660,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.10.83","src_port":28681,"dst_port":8797,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6780,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":776,"flow_packet_id":1,"flow_last_seen":490660,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490660,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4AlwAAIARRqIKAAIP21UKU3AJIl0AJI2f4a4xAvPeu2H\/+3\/LiNFVAwABAAUAAADDglFLQA=="} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6781,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":777,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490660,"flow_last_seen":490660,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490660,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.244.211.43","src_port":28681,"dst_port":23459,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6781,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":777,"flow_packet_id":1,"flow_last_seen":490660,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490660,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ErAAAIARy9YKAAIPfPTTK3AJW6MAJBdFnQ0xAkNjQu3\/mND3MjabAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6782,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":778,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490660,"flow_last_seen":490660,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490660,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.117.100.78","src_port":28681,"dst_port":9010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6782,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":778,"flow_packet_id":1,"flow_last_seen":490660,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490660,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4UC0AAIAR\/7UKAAIPenVkTnAJIzIAJJfAIOIxAjgXOLb\/Sc2akeL6AwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6783,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":779,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490660,"flow_last_seen":490660,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490660,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.65.217.224","src_port":28681,"dst_port":18381,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6783,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":779,"flow_packet_id":1,"flow_last_seen":490660,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490660,"pkt":"UlQAEjUCCAAn5uVZCABFAAA49BoAAIARX2oKAAIPAUHZ4HAJR80AJLl\/QiMxAu+WvlP\/zwsdV8RVAwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6784,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":780,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490660,"flow_last_seen":490660,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490660,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.66.94.132","src_port":28681,"dst_port":17735,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6784,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":780,"flow_packet_id":1,"flow_last_seen":490660,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490660,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4c38AAIARGGEKAAIPREJehHAJRUcAJI6O64QxAroJco\/\/wR8CWq98AwABAAUAAADDglFLQA=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6785,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":781,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490660,"flow_last_seen":490660,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490660,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.105.52.2","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6785,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":781,"flow_packet_id":1,"flow_last_seen":490660,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490660,"pkt":"UlQAEjUCCAAn5uVZCABFAAA41kgAAIARs\/IKAAIPcGk0AnAJW6IAJB8kODExAiD\/PoD\/dZiXmj2bAwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6786,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":782,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490660,"flow_last_seen":490660,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":490660,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"65.182.231.232","src_port":28681,"dst_port":7890,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6786,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":782,"flow_packet_id":1,"flow_last_seen":490660,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":490660,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4UnIAAIARspUKAAIPQbbn6HAJHtIAJOUFOrMxAvZyDSb\/xulp1DlbAwABAAUAAADDglFLQA=="} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6787,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":773,"flow_packet_id":2,"flow_last_seen":490696,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":490696,"pkt":"CAAn5uVZUlQAEjUCCABFAABKELsAAEAR8eNWmRVdCgACD49YcAkANp4YdCgxAouIwrH\/i75JTtDcAwEBABcAAABYj1aZFV3zAAAAAAAgAMOCUUtEnq8Y\/A=="} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6788,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":767,"flow_packet_id":2,"flow_last_seen":490773,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":490773,"pkt":"CAAn5uVZUlQAEjUCCABFAABKELwAAEAR2X8tQVcYCgACDz9JcAkANlKWPO4xAgeDkI\/\/iKmGa7BjAwEBABcAAABJPy1BVxhtAAAAAAAgAMOCUUtEjwL3nA=="} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6789,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":777,"flow_packet_id":2,"flow_last_seen":490843,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":490843,"pkt":"CAAn5uVZUlQAEjUCCABFAABJEL0AAEARDbl89NMrCgACD1ujcAkANXX2nQ0xAkNjQu3\/mND3MjabAwEBABYAAACjW3z00ysBAAAAAAAAAMOCVVBDACAf"} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6790,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":770,"flow_packet_id":2,"flow_last_seen":490846,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":490846,"pkt":"CAAn5uVZUlQAEjUCCABFAABKEL4AAEARRO9hU7eUCgACDyK6cAkANgDJIO4xAnNm5yn\/vkjYaSxfAwEBABcAAAC6ImFTt5QAAAAACAAAAMOCUUtECWOmCA=="} +00485{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6791,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":781,"flow_packet_id":2,"flow_last_seen":490873,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":490873,"pkt":"CAAn5uVZUlQAEjUCCABFAABJEL8AAEARuWtwaTQCCgACD1uicAkANU8DODExAiD\/PoD\/dZiXmj2bAwEBABYAAACiW3BpNAIfAAAAAACAAMOCVVBDAQEB"} +00530{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":783,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490916,"flow_last_seen":490916,"flow_idle_time":120000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":490916,"l3_proto":"ip4","src_ip":"65.182.231.232","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3} +00501{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":783,"flow_packet_id":1,"flow_last_seen":490916,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"thread_ts_msec":490916,"pkt":"CAAn5uVZUlQAEjUCCABFwABUEMAAAH8B9HtBtufoCgACDwMDMuAAAAAARQAAOFJyAAB\/EbOVCgACD0G25+hwCR7SACTlBTqzMQL2cg0m\/8bpadQ5WwMAAQAFAAAAw4JRS0A="} +00608{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6792,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":783,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490916,"flow_last_seen":490916,"flow_idle_time":120000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":490916,"l3_proto":"ip4","src_ip":"65.182.231.232","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":4.984965} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6793,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":775,"flow_packet_id":2,"flow_last_seen":490939,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"thread_ts_msec":490939,"pkt":"CAAn5uVZUlQAEjUCCABFAABJEMEAAEAR+rDfEYQSCgACD1uicAkANcVlg9sxAjy4c4P\/utzozFbSAwEBABYAAACiW98RhBJuAAAA+KYpBMOCVVBDACAf"} +00490{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6794,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":768,"flow_packet_id":2,"flow_last_seen":490991,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"thread_ts_msec":490991,"pkt":"CAAn5uVZUlQAEjUCCABFAABKEMIAAEARTyUOyP\/lCgACD5DCcAkANpg9XGQxAgSi0ID\/hbiT8iWZAwEBABcAAADCkA7I\/+WyNgAAAAAgAMOCUUtEGERIlw=="} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6810,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":784,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":491496,"flow_last_seen":491496,"flow_idle_time":180000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":491496,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"23.19.141.110","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00476{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6810,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":784,"flow_packet_id":1,"flow_last_seen":491496,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"thread_ts_msec":491496,"pkt":"UlQAEjUCCAAn5uVZCABFAABDs+IAAIAR1jcKAAIPFxONbnAJGMoALyrmWs8xAo7JmxH\/hobQSo3SAwABABAAAADDA1NDUEECglZDRUdUS0di"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6814,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":503,"flow_packet_id":3,"flow_last_seen":491976,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":491976,"pkt":"UlQAEjUCCAAn5uVZCABFAAA022sAAIARFCQKAAIPStL0SHAJGMoAIMn5R05EEEBIAQFUC1FLUlAGUk5BXS\/iNQlw"} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6815,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":756,"flow_packet_id":3,"flow_last_seen":491977,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":491977,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0M5kAAIARjK4KAAIPKWRE\/3AJMiYAIIFUR05EEEBJAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6831,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":755,"flow_packet_id":2,"flow_last_seen":491980,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":491980,"pkt":"UlQAEjUCCAAn5uVZCABFAAA05JYAAIARi20KAAIPU4ZrIHAJl7QAIMtyR05EEEBZAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6860,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":749,"flow_packet_id":3,"flow_last_seen":493285,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":493285,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0aogAAIARLMoKAAIPXAg7UHAJiXgAIADyR05EEEBkAQFUC1FLUlAGUk5BXS\/iNQlw"} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6864,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":750,"flow_packet_id":3,"flow_last_seen":493286,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":493286,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0JvMAAIARngIKAAIPTp8bFnAJRJsAIHNuR05EEEBoAQFUC1FLUlAGUk5BXS\/iNQlw"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6865,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":785,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493286,"flow_last_seen":493286,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":493286,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.134.139.39","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6865,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":785,"flow_packet_id":1,"flow_last_seen":493286,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":493286,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0K1UAAIARx6cKAAIPsIaLJ3AJGMoAIM1FR05EEEBpAQFUC1FLUlAGUk5BXS\/iNQlw"} +00560{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6869,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":786,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493286,"flow_last_seen":493286,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":493286,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.38.9.82","src_port":28681,"dst_port":24223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6869,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":786,"flow_packet_id":1,"flow_last_seen":493286,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":493286,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0IoIAAIARkLAKAAIPciYJUnAJXp8AIEeiR05EEEBtAQFUC1FLUlAGUk5BXS\/iNQlw"} +00564{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6870,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":787,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493287,"flow_last_seen":493287,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":493287,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.133.122.217","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6870,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":787,"flow_packet_id":1,"flow_last_seen":493287,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":493287,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0xr0AAIAREI4KAAIP3IV62XAJW6IAIG63R05EEEBuAQFUC1FLUlAGUk5BXS\/iNQlw"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6871,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":788,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493287,"flow_last_seen":493287,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":493287,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.134.167.82","src_port":28681,"dst_port":5820,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6871,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":788,"flow_packet_id":1,"flow_last_seen":493287,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":493287,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0nSsAAIARDaYKAAIP3IanUnAJFrwAIIciR05EEEBvAQFUC1FLUlAGUk5BXS\/iNQlw"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6872,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":789,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493287,"flow_last_seen":493287,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":493287,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.98.115.128","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6872,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":789,"flow_packet_id":1,"flow_last_seen":493287,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":493287,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0RlkAAIARSm8KAAIPKmJzgHAJW6IAICgyR05EEEBwAQFUC1FLUlAGUk5BXS\/iNQlw"} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6873,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":790,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493288,"flow_last_seen":493288,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":493288,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.39.233","src_port":28681,"dst_port":20855,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6873,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":790,"flow_packet_id":1,"flow_last_seen":493288,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":493288,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0oV8AAIARir0KAAIP2qQn6XAJUXcAIM2wR05EEEBxAQFUC1FLUlAGUk5BXS\/iNQlw"} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6874,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":791,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493288,"flow_last_seen":493288,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":493288,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.11.85","src_port":28681,"dst_port":10722,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6874,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":791,"flow_packet_id":1,"flow_last_seen":493288,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":493288,"pkt":"UlQAEjUCCAAn5uVZCABFAAA09nUAAIARUYoKAAIP21ULVXAJKeIAIBEoR05EEEByAQFUC1FLUlAGUk5BXS\/iNQlw"} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6875,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":792,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493288,"flow_last_seen":493288,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":493288,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.239.213.146","src_port":28681,"dst_port":21750,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6875,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":792,"flow_packet_id":1,"flow_last_seen":493288,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":493288,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0MewAAIARAj0KAAIPJO\/VknAJVPYAINI7R05EEEBzAQFUC1FLUlAGUk5BXS\/iNQlw"} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6876,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":793,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493288,"flow_last_seen":493288,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":493288,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.126.102","src_port":28681,"dst_port":5193,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6876,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":793,"flow_packet_id":1,"flow_last_seen":493288,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":493288,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0bokAAIARxe0KAAIPe81+ZnAJFEkAIBM2R05EEEB0AQFUC1FLUlAGUk5BXS\/iNQlw"} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":88,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70230,"flow_last_seen":311752,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.50.24.2","src_port":28681,"dst_port":17874,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":88,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70230,"flow_last_seen":311752,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"81.50.24.2","src_port":28681,"dst_port":17874,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":159,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82058,"flow_last_seen":311750,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.163.231.160","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":159,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82058,"flow_last_seen":311750,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.163.231.160","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":753,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":312961,"flow_last_seen":312961,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.84.140.96","src_port":28681,"dst_port":14400,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":753,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":312961,"flow_last_seen":312961,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.84.140.96","src_port":28681,"dst_port":14400,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":124,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72848,"flow_last_seen":311749,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"170.254.19.6","src_port":28681,"dst_port":24180,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":124,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72848,"flow_last_seen":311749,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"170.254.19.6","src_port":28681,"dst_port":24180,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":161,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82058,"flow_last_seen":311749,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.120.26.86","src_port":28681,"dst_port":29946,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":161,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82058,"flow_last_seen":311749,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.120.26.86","src_port":28681,"dst_port":29946,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00563{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":751,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":312956,"flow_last_seen":493286,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"67.193.8.52","src_port":28681,"dst_port":38584,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":352,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":131671,"flow_last_seen":491977,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.191.49.159","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00562{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":749,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":312956,"flow_last_seen":493285,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.8.59.80","src_port":28681,"dst_port":35192,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00566{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":752,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":312957,"flow_last_seen":433137,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.115.218.152","src_port":28681,"dst_port":5900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":6898,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":750,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":312956,"flow_last_seen":493286,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":495445,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.159.27.22","src_port":28681,"dst_port":17563,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":544,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287341,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.184.29.35","src_port":28681,"dst_port":30582,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":544,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287341,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.184.29.35","src_port":28681,"dst_port":30582,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":533,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.229.185.60","src_port":28681,"dst_port":6898,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":533,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.229.185.60","src_port":28681,"dst_port":6898,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":553,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3259,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":553,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":28681,"dst_port":3259,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":546,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287341,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49867,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":546,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287341,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"38.142.119.234","src_port":28681,"dst_port":49867,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":531,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":51497,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":531,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":51497,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":534,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":54436,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":534,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":54436,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":562,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287357,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.242.110","src_port":28681,"dst_port":59879,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":562,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287357,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.119.242.110","src_port":28681,"dst_port":59879,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":542,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":51675,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":542,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.103.139.2","src_port":28681,"dst_port":51675,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":551,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287355,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.24.129.230","src_port":28681,"dst_port":14766,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":551,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287355,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.24.129.230","src_port":28681,"dst_port":14766,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":555,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":28681,"dst_port":20387,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":555,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":28681,"dst_port":20387,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00584{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_state":"info","flow_packets_processed":17,"flow_first_seen":90072,"flow_last_seen":320293,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5333,"flow_avg_l4_payload_len":313,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":28681,"dst_port":43508,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00569{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":259,"flow_state":"info","flow_packets_processed":17,"flow_first_seen":90072,"flow_last_seen":320293,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":727,"flow_tot_l4_payload_len":5333,"flow_avg_l4_payload_len":313,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"103.232.107.100","src_port":28681,"dst_port":43508,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":538,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.41.253","src_port":28681,"dst_port":14339,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":538,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.41.253","src_port":28681,"dst_port":14339,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":536,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.167.222.160","src_port":28681,"dst_port":56121,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":536,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.167.222.160","src_port":28681,"dst_port":56121,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":558,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.105.52.2","src_port":28681,"dst_port":6466,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":558,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.105.52.2","src_port":28681,"dst_port":6466,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":556,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":28681,"dst_port":49787,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":556,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":28681,"dst_port":49787,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":560,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":53883,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":560,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":53883,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":559,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":55080,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":559,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":28681,"dst_port":55080,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":529,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287338,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":28681,"dst_port":57929,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":529,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287338,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.241.162.162","src_port":28681,"dst_port":57929,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":539,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":28681,"dst_port":7510,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":539,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.14.143.237","src_port":28681,"dst_port":7510,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":545,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287341,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.49.159.77","src_port":28681,"dst_port":55915,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":545,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287341,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"116.49.159.77","src_port":28681,"dst_port":55915,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":664,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287573,"flow_last_seen":320293,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.163","src_port":28681,"dst_port":6594,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":664,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287573,"flow_last_seen":320293,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.163","src_port":28681,"dst_port":6594,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":554,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.203.72.224","src_port":28681,"dst_port":55577,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":554,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.203.72.224","src_port":28681,"dst_port":55577,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":528,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287338,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":58442,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":528,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287338,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.168.15.71","src_port":28681,"dst_port":58442,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":537,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.200.235","src_port":28681,"dst_port":2034,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":537,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.200.235","src_port":28681,"dst_port":2034,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":535,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":10655,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":535,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":10655,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":532,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":10677,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":532,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":10677,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":696,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287635,"flow_last_seen":320293,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.189.72.230","src_port":28681,"dst_port":8161,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":696,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287635,"flow_last_seen":320293,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.189.72.230","src_port":28681,"dst_port":8161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":552,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.250.6.59","src_port":28681,"dst_port":60012,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":552,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.250.6.59","src_port":28681,"dst_port":60012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":543,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.39.159.60","src_port":28681,"dst_port":56896,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":543,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.39.159.60","src_port":28681,"dst_port":56896,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":557,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":28681,"dst_port":53163,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":557,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287356,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.222.160.99","src_port":28681,"dst_port":53163,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":561,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287357,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":28681,"dst_port":57466,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":561,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287357,"flow_last_seen":320292,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"61.238.173.128","src_port":28681,"dst_port":57466,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":541,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":11141,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":541,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":28681,"dst_port":11141,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":547,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287341,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":43316,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":547,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287341,"flow_last_seen":320291,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":43316,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":530,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.167.248.220","src_port":28681,"dst_port":59304,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":530,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287339,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.167.248.220","src_port":28681,"dst_port":59304,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":540,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":28681,"dst_port":52131,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6990,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":540,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":287340,"flow_last_seen":320290,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":505793,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":28681,"dst_port":52131,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7120,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":794,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":520019,"flow_last_seen":520019,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":520019,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50214,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7120,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":794,"flow_packet_id":1,"flow_last_seen":520019,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":520019,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LsAAAER3F4KAAIP7\/\/\/+sQmB2wAtikITS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7120,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":794,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":520019,"flow_last_seen":520019,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":520019,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50214,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7131,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":794,"flow_packet_id":2,"flow_last_seen":521048,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":521048,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4LwAAAER3F0KAAIP7\/\/\/+sQmB2wAtikITS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00663{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7141,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":794,"flow_packet_id":3,"flow_last_seen":522076,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"thread_ts_msec":522076,"pkt":"AQBef\/\/6CAAn5uVZCABFAADK4L0AAAER3FwKAAIP7\/\/\/+sQmB2wAtikITS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KVVNFUi1BR0VOVDogTWljcm9zb2Z0IEVkZ2UvOTkuMC4xMTUwLjMwIFdpbmRvd3MNCg0K"} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7268,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":754,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":355387,"flow_last_seen":355387,"flow_idle_time":180000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":536329,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.125.218.84","src_port":28681,"dst_port":17561,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7268,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":754,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":355387,"flow_last_seen":355387,"flow_idle_time":180000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":536329,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.125.218.84","src_port":28681,"dst_port":17561,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7268,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":98,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":71536,"flow_last_seen":351075,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":194,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":536329,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.222.14.170","src_port":28681,"dst_port":23332,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7268,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":98,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":71536,"flow_last_seen":351075,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":194,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":536329,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"203.222.14.170","src_port":28681,"dst_port":23332,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7268,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":573,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":287424,"flow_last_seen":351110,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":34,"midstream":0,"thread_ts_msec":536329,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.239.173.18","src_port":28681,"dst_port":23327,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7268,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":573,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":287424,"flow_last_seen":351110,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":34,"midstream":0,"thread_ts_msec":536329,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"71.239.173.18","src_port":28681,"dst_port":23327,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":383,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":243617,"flow_last_seen":365474,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":299,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":545788,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.71.243.60","src_port":28681,"dst_port":34498,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7351,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":383,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":243617,"flow_last_seen":365474,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":299,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":545788,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.71.243.60","src_port":28681,"dst_port":34498,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7364,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":768,"flow_packet_id":3,"flow_last_seen":548240,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"thread_ts_msec":548240,"pkt":"UlQAEjUCCAAn5uVZCABFAAA5ti0AAIARacoKAAIPDsj\/5XAJkMIAJToVhUMxAqfmQqb\/HOa6fwGLAwABAAYAAADDg0dVRUA="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7366,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":772,"flow_packet_id":2,"flow_last_seen":551701,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":551701,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4XBwAAIARoNwKAAIPScDn7XAJJcwAJGCkrTAxAgWSHsf\/H7IG115yAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7367,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":774,"flow_packet_id":2,"flow_last_seen":551702,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":551702,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4f\/IAAIARjeQKAAIPMjrulXAJGccAJJQX7RsxAlRaYer\/KFqb61nNAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7368,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":776,"flow_packet_id":2,"flow_last_seen":551702,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":551702,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Al0AAIARRqEKAAIP21UKU3AJIl0AJINau\/4xAsJdzT7\/oegS63zaAwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7369,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":782,"flow_packet_id":2,"flow_last_seen":551702,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":551702,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4UnMAAIARspQKAAIPQbbn6HAJHtIAJK9Gq1wxAi+86pT\/xt95aYd+AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7370,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":777,"flow_packet_id":3,"flow_last_seen":551702,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":551702,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4ErEAAIARy9UKAAIPfPTTK3AJW6MAJMxl+zExApMqMST\/rFEVHsHdAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7371,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":780,"flow_packet_id":2,"flow_last_seen":551702,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":551702,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4c4AAAIARGGAKAAIPREJehHAJRUcAJDdA7\/0xAvmvRov\/2XnDvQj+AwABAAUAAADDglFLQA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7372,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":779,"flow_packet_id":2,"flow_last_seen":551702,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":551702,"pkt":"UlQAEjUCCAAn5uVZCABFAAA49BsAAIARX2kKAAIPAUHZ4HAJR80AJEnN+4ExAq2c3Ur\/e7id4u32AwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7375,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":769,"flow_packet_id":2,"flow_last_seen":551881,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":551881,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4Bw8AAIARboAKAAIPe249qXAJLsUAJDtyHGwxAoxEcN\/\/jCASw69kAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7376,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":781,"flow_packet_id":3,"flow_last_seen":551881,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":551881,"pkt":"UlQAEjUCCAAn5uVZCABFAAA41kkAAIARs\/EKAAIPcGk0AnAJW6IAJGutbKYxAvsfW2T\/qR3jmLqfAwABAAUAAADDglFLQA=="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7377,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":771,"flow_packet_id":2,"flow_last_seen":551881,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":551881,"pkt":"UlQAEjUCCAAn5uVZCABFAAA4wkcAAIAR4TwKAAIPyhvBBnAJGMoAJNQIMjYxApAyrJb\/C+nD\/mi2AwABAAUAAADDglFLQA=="} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7382,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":795,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":551890,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":551890,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.120.26.86","src_port":28681,"dst_port":29946,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7382,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":795,"flow_packet_id":1,"flow_last_seen":551890,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":551890,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0tpcAAIARiEQKAAIP1XgaVnAJdPoAILzmR05EEEB3AQFUC1FLUlAGUk5BXS\/iNQlw"} +00562{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7398,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":796,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":551892,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":551892,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.249.63.200","src_port":28681,"dst_port":22582,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7398,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":796,"flow_packet_id":1,"flow_last_seen":551892,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":551892,"pkt":"UlQAEjUCCAAn5uVZCABFAAA0J3oAAIARnW8KAAIPKfk\/yHAJWDYAIF+oR05EEECHAQFUC1FLUlAGUk5BXS\/iNQlw"} +00528{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7403,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":797,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":552011,"flow_last_seen":552011,"flow_idle_time":120000,"flow_min_l4_payload_len":60,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":60,"flow_avg_l4_payload_len":60,"midstream":0,"thread_ts_msec":552011,"l3_proto":"ip4","src_ip":"154.3.42.209","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3} +00497{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7403,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":797,"flow_packet_id":1,"flow_last_seen":552011,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":94,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":94,"pkt_l4_len":60,"thread_ts_msec":552011,"pkt":"CAAn5uVZUlQAEjUCCABFwABQEicAAH8BV+OaAyrRCgACDwMDzhEAAAAARQAANH78AAB\/EevZCgACD5oDKtFwCRjKACBD\/UdORBBAiwEBVAtRS1JQBlJOQV0v4jUJcA=="} +00606{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7403,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":797,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":552011,"flow_last_seen":552011,"flow_idle_time":120000,"flow_min_l4_payload_len":60,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":60,"flow_avg_l4_payload_len":60,"midstream":0,"thread_ts_msec":552011,"l3_proto":"ip4","src_ip":"154.3.42.209","dst_ip":"10.0.2.15","l4_proto":"icmp","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":5.209868} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":195,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82063,"flow_last_seen":373495,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":554967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"177.231.151.16","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":195,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82063,"flow_last_seen":373495,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":554967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"177.231.151.16","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":191,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82063,"flow_last_seen":371839,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":554967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.153.143.54","src_port":28681,"dst_port":65535,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":191,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":82063,"flow_last_seen":371839,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":554967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"190.153.143.54","src_port":28681,"dst_port":65535,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":200,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82064,"flow_last_seen":373495,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":554967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"138.199.16.123","src_port":28681,"dst_port":52993,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":200,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82064,"flow_last_seen":373495,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":554967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"138.199.16.123","src_port":28681,"dst_port":52993,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":7421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":755,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":371838,"flow_last_seen":491980,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":554967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.134.107.32","src_port":28681,"dst_port":38836,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00565{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":7421,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":756,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":373494,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":554967,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.100.68.255","src_port":28681,"dst_port":12838,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7429,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":400,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251734,"flow_last_seen":381404,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":568531,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"129.45.47.167","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7429,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":400,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":251734,"flow_last_seen":381404,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":568531,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"129.45.47.167","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00797{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7439,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":759,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":400872,"flow_last_seen":400901,"flow_idle_time":180000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":581778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":28681,"dst_port":23548,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7439,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":758,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":400018,"flow_last_seen":403044,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":581778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50213,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7439,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":757,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":399168,"flow_last_seen":399265,"flow_idle_time":180000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":581778,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":28681,"dst_port":53258,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7482,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":798,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":595449,"flow_last_seen":595449,"flow_idle_time":180000,"flow_min_l4_payload_len":137,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":137,"flow_avg_l4_payload_len":137,"midstream":0,"thread_ts_msec":595449,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00615{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7482,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":798,"flow_packet_id":1,"flow_last_seen":595449,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":179,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":179,"pkt_l4_len":145,"thread_ts_msec":595449,"pkt":"AQBef\/\/6CAAn5uVZCABFAACl4L8AAAQR2X8KAAIP7\/\/\/+vnaB2wAkQ9eTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClNUOiB1cm46c2NoZW1hcy11cG5wLW9yZzpkZXZpY2U6SW50ZXJuZXRHYXRld2F5RGV2aWNlOjENCk1hbjogInNzZHA6ZGlzY292ZXIiDQpNWDogMw0KDQo="} +00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7482,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":798,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":595449,"flow_last_seen":595449,"flow_idle_time":180000,"flow_min_l4_payload_len":137,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":137,"flow_avg_l4_payload_len":137,"midstream":0,"thread_ts_msec":595449,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00615{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7483,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":798,"flow_packet_id":2,"flow_last_seen":598465,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":179,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":179,"pkt_l4_len":145,"thread_ts_msec":598465,"pkt":"AQBef\/\/6CAAn5uVZCABFAACl4MAAAAQR2X4KAAIP7\/\/\/+vnaB2wAkQ9eTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClNUOiB1cm46c2NoZW1hcy11cG5wLW9yZzpkZXZpY2U6SW50ZXJuZXRHYXRld2F5RGV2aWNlOjENCk1hbjogInNzZHA6ZGlzY292ZXIiDQpNWDogMw0KDQo="} +00705{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7484,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":760,"flow_packet_id":2,"flow_last_seen":599325,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":243,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":243,"pkt_l4_len":209,"thread_ts_msec":599325,"pkt":"\/\/\/\/\/\/\/\/CAAn5uVZCABFAADlHP8AAIARA\/wKAAIPCgAC\/wCKAIoA0XlAEQKcMQoAAg8AigC7AAAgRU5GREVGRUVFSEVGRkhFSkVPREJEQUNBQ0FDQUNBQ0EAIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUJOAP9TTUIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQAAIQAAAAAAAAAAAOgDAAAAAAAAAAAhAFYAAwABAAAAAgAyAFxNQUlMU0xPVFxCUk9XU0UAAQCA\/AoATVNFREdFV0lOMTAAAAAAAAoAARAAAA8BVaoA"} +00575{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7485,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":799,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599415,"flow_last_seen":599415,"flow_idle_time":180000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":772,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599415,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +01485{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7485,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":799,"flow_packet_id":1,"flow_last_seen":599415,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":834,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":834,"pkt_l4_len":780,"thread_ts_msec":599415,"pkt":"MzMAAAAMCAAn5uVZht1gB0PFAwwRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dYOdgMMdjk8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvQnllPC93c2E6QWN0aW9uPjx3c2E6TWVzc2FnZUlEPnVybjp1dWlkOjk4Zjc0ZjcxLTZkZmMtNDYxMi05YzNjLTVjNTgwZWI4MzU5Njwvd3NhOk1lc3NhZ2VJRD48d3NkOkFwcFNlcXVlbmNlIEluc3RhbmNlSWQ9IjQ2IiBTZXF1ZW5jZUlkPSJ1cm46dXVpZDo3NjczODllMC1lZTlhLTRjMWMtYjkwMi0yMGNiODFkMjAzZTAiIE1lc3NhZ2VOdW1iZXI9IjUiPjwvd3NkOkFwcFNlcXVlbmNlPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOkJ5ZT48d3NhOkVuZHBvaW50UmVmZXJlbmNlPjx3c2E6QWRkcmVzcz51cm46dXVpZDo3NDdmM2Q5Ni02OGE3LTQzZjEtOGNiZS1lOGQ2ZGFkZDAzNTg8L3dzYTpBZGRyZXNzPjwvd3NhOkVuZHBvaW50UmVmZXJlbmNlPjwvd3NkOkJ5ZT48L3NvYXA6Qm9keT48L3NvYXA6RW52ZWxvcGU+"} +00633{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7485,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":799,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599415,"flow_last_seen":599415,"flow_idle_time":180000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":772,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599415,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} +00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7486,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":800,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599415,"flow_last_seen":599415,"flow_idle_time":180000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":772,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599415,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +01463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7486,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":800,"flow_packet_id":1,"flow_last_seen":599415,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":814,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":814,"pkt_l4_len":780,"thread_ts_msec":599415,"pkt":"AQBef\/\/6CAAn5uVZCABFAAMg4MEAAAER2gIKAAIP7\/\/\/+vnVDnYDDAYbPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5Ij48c29hcDpIZWFkZXI+PHdzYTpUbz51cm46c2NoZW1hcy14bWxzb2FwLW9yZzp3czoyMDA1OjA0OmRpc2NvdmVyeTwvd3NhOlRvPjx3c2E6QWN0aW9uPmh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5L0J5ZTwvd3NhOkFjdGlvbj48d3NhOk1lc3NhZ2VJRD51cm46dXVpZDo5OGY3NGY3MS02ZGZjLTQ2MTItOWMzYy01YzU4MGViODM1OTY8L3dzYTpNZXNzYWdlSUQ+PHdzZDpBcHBTZXF1ZW5jZSBJbnN0YW5jZUlkPSI0NiIgU2VxdWVuY2VJZD0idXJuOnV1aWQ6NzY3Mzg5ZTAtZWU5YS00YzFjLWI5MDItMjBjYjgxZDIwM2UwIiBNZXNzYWdlTnVtYmVyPSI1Ij48L3dzZDpBcHBTZXF1ZW5jZT48L3NvYXA6SGVhZGVyPjxzb2FwOkJvZHk+PHdzZDpCeWU+PHdzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NhOkFkZHJlc3M+dXJuOnV1aWQ6NzQ3ZjNkOTYtNjhhNy00M2YxLThjYmUtZThkNmRhZGQwMzU4PC93c2E6QWRkcmVzcz48L3dzYTpFbmRwb2ludFJlZmVyZW5jZT48L3dzZDpCeWU+PC9zb2FwOkJvZHk+PC9zb2FwOkVudmVsb3BlPg=="} +00625{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7486,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":800,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599415,"flow_last_seen":599415,"flow_idle_time":180000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":772,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599415,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} +00541{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7487,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":801,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599426,"flow_last_seen":599426,"flow_idle_time":120000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599426,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3} +00490{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7487,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":801,"flow_packet_id":1,"flow_last_seen":599426,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":62,"pkt_len":90,"pkt_l4_len":28,"thread_ts_msec":599426,"pkt":"MzMAAAAWCAAn5uVZht1gAAAAACQAAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAWOgAFAgAAAQCPAOKkAAAAAQMAAAD\/AgAAAAAAAAAAAAAAAAAM"} +00602{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7487,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":801,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":599426,"flow_last_seen":599426,"flow_idle_time":120000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599426,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}} +01485{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7488,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":799,"flow_packet_id":2,"flow_last_seen":599529,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":834,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":834,"pkt_l4_len":780,"thread_ts_msec":599529,"pkt":"MzMAAAAMCAAn5uVZht1gB0PFAwwRAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAM+dYOdgMMdjk8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvQnllPC93c2E6QWN0aW9uPjx3c2E6TWVzc2FnZUlEPnVybjp1dWlkOjk4Zjc0ZjcxLTZkZmMtNDYxMi05YzNjLTVjNTgwZWI4MzU5Njwvd3NhOk1lc3NhZ2VJRD48d3NkOkFwcFNlcXVlbmNlIEluc3RhbmNlSWQ9IjQ2IiBTZXF1ZW5jZUlkPSJ1cm46dXVpZDo3NjczODllMC1lZTlhLTRjMWMtYjkwMi0yMGNiODFkMjAzZTAiIE1lc3NhZ2VOdW1iZXI9IjUiPjwvd3NkOkFwcFNlcXVlbmNlPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOkJ5ZT48d3NhOkVuZHBvaW50UmVmZXJlbmNlPjx3c2E6QWRkcmVzcz51cm46dXVpZDo3NDdmM2Q5Ni02OGE3LTQzZjEtOGNiZS1lOGQ2ZGFkZDAzNTg8L3dzYTpBZGRyZXNzPjwvd3NhOkVuZHBvaW50UmVmZXJlbmNlPjwvd3NkOkJ5ZT48L3NvYXA6Qm9keT48L3NvYXA6RW52ZWxvcGU+"} +00490{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7489,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":801,"flow_packet_id":2,"flow_last_seen":599747,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":62,"pkt_len":90,"pkt_l4_len":28,"thread_ts_msec":599747,"pkt":"MzMAAAAWCAAn5uVZht1gAAAAACQAAf6AAAAAAAAAxQ1Rn5ak4Qj\/AgAAAAAAAAAAAAAAAAAWOgAFAgAAAQCPAOKkAAAAAQMAAAD\/AgAAAAAAAAAAAAAAAAAM"} +00567{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":7490,"source":"gnutella.pcap","alias":"nDPId-test","packets-captured":7490,"packets-processed":7468,"total-skipped-flows":0,"total-l4-data-len":3617715,"total-not-detected-flows":547,"total-guessed-flows":4,"total-detected-flows":98,"total-detection-updates":3,"total-updates":290,"current-active-flows":169,"total-active-flows":801,"total-idle-flows":632,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":3929,"global_ts_msec":600247} +00570{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":52,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":65062,"flow_last_seen":74093,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.17.124.40","src_port":50212,"dst_port":6776,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00555{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":52,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":65062,"flow_last_seen":74093,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.17.124.40","src_port":50212,"dst_port":6776,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":751,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":312956,"flow_last_seen":493286,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"67.193.8.52","src_port":28681,"dst_port":38584,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":751,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":312956,"flow_last_seen":493286,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"67.193.8.52","src_port":28681,"dst_port":38584,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":134,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72852,"flow_last_seen":431829,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.231.73.14","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":134,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":72852,"flow_last_seen":431829,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.231.73.14","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":128,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":72850,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.141.219.27","src_port":28681,"dst_port":37580,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":128,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":72850,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.141.219.27","src_port":28681,"dst_port":37580,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":166,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82059,"flow_last_seen":433137,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.59.253.186","src_port":28681,"dst_port":15555,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":166,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82059,"flow_last_seen":433137,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.59.253.186","src_port":28681,"dst_port":15555,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":777,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":490660,"flow_last_seen":551880,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.244.211.43","src_port":28681,"dst_port":23459,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":777,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":490660,"flow_last_seen":551880,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.244.211.43","src_port":28681,"dst_port":23459,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":184,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":82062,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.239.62.213","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":184,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":82062,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.239.62.213","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":183,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82062,"flow_last_seen":491979,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.172.15.182","src_port":28681,"dst_port":37829,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":183,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82062,"flow_last_seen":491979,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.172.15.182","src_port":28681,"dst_port":37829,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":114,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":71540,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.23.75.69","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":114,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":71540,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.23.75.69","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":245,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":89733,"flow_last_seen":98763,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.195.236.249","src_port":50289,"dst_port":18557,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":245,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":89733,"flow_last_seen":98763,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.195.236.249","src_port":50289,"dst_port":18557,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":800,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":599415,"flow_last_seen":599415,"flow_idle_time":180000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":772,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63957,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":776,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490660,"flow_last_seen":551702,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.10.83","src_port":28681,"dst_port":8797,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":776,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490660,"flow_last_seen":551702,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.10.83","src_port":28681,"dst_port":8797,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":227,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":85607,"flow_last_seen":94638,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.179.18.242","src_port":50273,"dst_port":47329,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":227,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":85607,"flow_last_seen":94638,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.179.18.242","src_port":50273,"dst_port":47329,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00799{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":276,"flow_state":"finished","flow_packets_processed":135,"flow_first_seen":90742,"flow_last_seen":593652,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":9771,"flow_avg_l4_payload_len":72,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":50300,"dst_port":11852,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":767,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490658,"flow_last_seen":490773,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":74,"flow_avg_l4_payload_len":37,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.65.87.24","src_port":28681,"dst_port":16201,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":767,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490658,"flow_last_seen":490773,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":74,"flow_avg_l4_payload_len":37,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"45.65.87.24","src_port":28681,"dst_port":16201,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":352,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":131671,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.191.49.159","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":352,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":131671,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.191.49.159","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":72,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":68110,"flow_last_seen":77138,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.68.138.207","src_port":50231,"dst_port":45079,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":72,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":68110,"flow_last_seen":77138,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.68.138.207","src_port":50231,"dst_port":45079,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":228,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":85607,"flow_last_seen":94638,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.174.18.115","src_port":50274,"dst_port":50679,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":228,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":85607,"flow_last_seen":94638,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.174.18.115","src_port":50274,"dst_port":50679,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":219,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":83520,"flow_last_seen":431830,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.30.86.144","src_port":28681,"dst_port":53821,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":219,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":83520,"flow_last_seen":431830,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.30.86.144","src_port":28681,"dst_port":53821,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":778,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490660,"flow_last_seen":490660,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.117.100.78","src_port":28681,"dst_port":9010,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":778,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490660,"flow_last_seen":490660,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.117.100.78","src_port":28681,"dst_port":9010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":773,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":490696,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":74,"flow_avg_l4_payload_len":37,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.153.21.93","src_port":28681,"dst_port":36696,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":773,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":490696,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":74,"flow_avg_l4_payload_len":37,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.153.21.93","src_port":28681,"dst_port":36696,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00617{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"finished","flow_packets_processed":12,"flow_first_seen":12513,"flow_last_seen":14765,"flow_idle_time":600000,"flow_min_l4_payload_len":16,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":200,"flow_avg_l4_payload_len":16,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"IGMP","breed":"Acceptable","category":"Network"}} +00802{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":238,"flow_state":"finished","flow_packets_processed":365,"flow_first_seen":88704,"flow_last_seen":593692,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":43484,"flow_avg_l4_payload_len":119,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.156.226.72","src_port":50284,"dst_port":53258,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":779,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490660,"flow_last_seen":551702,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.65.217.224","src_port":28681,"dst_port":18381,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":779,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490660,"flow_last_seen":551702,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.65.217.224","src_port":28681,"dst_port":18381,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":768,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":490658,"flow_last_seen":548572,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":181,"flow_avg_l4_payload_len":45,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":28681,"dst_port":37058,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":768,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":490658,"flow_last_seen":548572,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":181,"flow_avg_l4_payload_len":45,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"14.200.255.229","src_port":28681,"dst_port":37058,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00582{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":765,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":487301,"flow_last_seen":490657,"flow_idle_time":180000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":278,"flow_tot_l4_payload_len":307,"flow_avg_l4_payload_len":153,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00567{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":765,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":487301,"flow_last_seen":490657,"flow_idle_time":180000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":278,"flow_tot_l4_payload_len":307,"flow_avg_l4_payload_len":153,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":28681,"dst_port":4876,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":75,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":69142,"flow_last_seen":78169,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.189.28.17","src_port":50234,"dst_port":16269,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":75,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":69142,"flow_last_seen":78169,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.189.28.17","src_port":50234,"dst_port":16269,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":240,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":88705,"flow_last_seen":97732,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.118.116.198","src_port":50286,"dst_port":44616,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":240,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":88705,"flow_last_seen":97732,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"84.118.116.198","src_port":50286,"dst_port":44616,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00783{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":760,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":431178,"flow_last_seen":599325,"flow_idle_time":180000,"flow_min_l4_payload_len":201,"flow_max_l4_payload_len":201,"flow_tot_l4_payload_len":402,"flow_avg_l4_payload_len":201,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.2.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}} +00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":798,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":595449,"flow_last_seen":598465,"flow_idle_time":180000,"flow_min_l4_payload_len":137,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":274,"flow_avg_l4_payload_len":137,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":63962,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":118,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":71541,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"5.180.62.100","src_port":28681,"dst_port":46385,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":118,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":71541,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"5.180.62.100","src_port":28681,"dst_port":46385,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":74,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":69141,"flow_last_seen":78169,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.163.14.246","src_port":50233,"dst_port":12854,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":74,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":69141,"flow_last_seen":78169,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.163.14.246","src_port":50233,"dst_port":12854,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":152,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":75359,"flow_last_seen":84388,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.250.32","src_port":50265,"dst_port":52647,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":152,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":75359,"flow_last_seen":84388,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.250.32","src_port":50265,"dst_port":52647,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":796,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":551892,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.249.63.200","src_port":28681,"dst_port":22582,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":796,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":551892,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.249.63.200","src_port":28681,"dst_port":22582,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":787,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493287,"flow_last_seen":493287,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.133.122.217","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":787,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493287,"flow_last_seen":493287,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.133.122.217","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":233,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":86641,"flow_last_seen":95653,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.91.201","src_port":50279,"dst_port":4297,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":233,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":86641,"flow_last_seen":95653,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.91.201","src_port":50279,"dst_port":4297,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":117,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":71540,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.120.243.143","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":117,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":71540,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"200.120.243.143","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":793,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493288,"flow_last_seen":493288,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.126.102","src_port":28681,"dst_port":5193,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":793,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493288,"flow_last_seen":493288,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.205.126.102","src_port":28681,"dst_port":5193,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":172,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82060,"flow_last_seen":493285,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.69.142.133","src_port":28681,"dst_port":15471,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":172,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82060,"flow_last_seen":493285,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"87.69.142.133","src_port":28681,"dst_port":15471,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":749,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":312956,"flow_last_seen":493285,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.8.59.80","src_port":28681,"dst_port":35192,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":749,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":312956,"flow_last_seen":493285,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.8.59.80","src_port":28681,"dst_port":35192,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00641{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":801,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":599426,"flow_last_seen":599747,"flow_idle_time":120000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMPV6","breed":"Acceptable","category":"Network"}} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":123,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":72267,"flow_last_seen":81278,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.78.134.188","src_port":50254,"dst_port":49046,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":123,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":72267,"flow_last_seen":81278,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.78.134.188","src_port":50254,"dst_port":49046,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00673{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":799,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":599415,"flow_last_seen":599529,"flow_idle_time":180000,"flow_min_l4_payload_len":772,"flow_max_l4_payload_len":772,"flow_tot_l4_payload_len":1544,"flow_avg_l4_payload_len":772,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip6","src_ip":"fe80::c50d:519f:96a4:e108","dst_ip":"ff02::c","src_port":63958,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} +00917{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":333,"flow_state":"finished","flow_packets_processed":2356,"flow_first_seen":114930,"flow_last_seen":546895,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":2191780,"flow_avg_l4_payload_len":930,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.118.162.229","src_port":50327,"dst_port":46906,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":64,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":67094,"flow_last_seen":76122,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.167.248.220","src_port":50223,"dst_port":63108,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":64,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":67094,"flow_last_seen":76122,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.167.248.220","src_port":50223,"dst_port":63108,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":59,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66078,"flow_last_seen":75077,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.103.247.94","src_port":50218,"dst_port":59045,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":59,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66078,"flow_last_seen":75077,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.103.247.94","src_port":50218,"dst_port":59045,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":111,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":71540,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.65.141.157","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":111,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":71540,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.65.141.157","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":49,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":65061,"flow_last_seen":74093,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.206.254","src_port":50209,"dst_port":49587,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":49,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":65061,"flow_last_seen":74093,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.206.254","src_port":50209,"dst_port":49587,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":65,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":67094,"flow_last_seen":76122,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.125.63.97","src_port":50224,"dst_port":6346,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00555{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":65,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":67094,"flow_last_seen":76122,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.125.63.97","src_port":50224,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":187,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82062,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.88.92.56","src_port":28681,"dst_port":21009,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":187,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82062,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.88.92.56","src_port":28681,"dst_port":21009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":190,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":82063,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.195.227","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":190,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":82063,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.195.227","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":139,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":72853,"flow_last_seen":553213,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.226.142","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":139,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":72853,"flow_last_seen":553213,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"165.169.226.142","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":68,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":68108,"flow_last_seen":77122,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.246.157.94","src_port":50227,"dst_port":51175,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":68,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":68108,"flow_last_seen":77122,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"111.246.157.94","src_port":50227,"dst_port":51175,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":141,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":72853,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"172.97.199.14","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":141,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":72853,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"172.97.199.14","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":752,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":312957,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.115.218.152","src_port":28681,"dst_port":5900,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":752,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":312957,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"142.115.218.152","src_port":28681,"dst_port":5900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":126,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":72849,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.69.159.133","src_port":28681,"dst_port":28000,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":126,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":72849,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.69.159.133","src_port":28681,"dst_port":28000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":56,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66077,"flow_last_seen":75077,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.244.64.237","src_port":50215,"dst_port":4704,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":56,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66077,"flow_last_seen":75077,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.244.64.237","src_port":50215,"dst_port":4704,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":71,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":68110,"flow_last_seen":77122,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.3.103.37","src_port":50230,"dst_port":17296,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00555{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":71,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":68110,"flow_last_seen":77122,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.3.103.37","src_port":50230,"dst_port":17296,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":503,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287311,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.210.244.72","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":503,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":287311,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"74.210.244.72","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":85,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":70230,"flow_last_seen":433135,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.138.20.110","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":85,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":70230,"flow_last_seen":433135,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.138.20.110","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":244,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":89732,"flow_last_seen":98763,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.119.55.28","src_port":50288,"dst_port":20347,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":244,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":89732,"flow_last_seen":98763,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.119.55.28","src_port":50288,"dst_port":20347,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":47,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":64033,"flow_last_seen":73064,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.78.171.204","src_port":50207,"dst_port":6346,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":47,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":64033,"flow_last_seen":73064,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"90.78.171.204","src_port":50207,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":180,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82061,"flow_last_seen":493284,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.131.24.72","src_port":28681,"dst_port":30711,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":180,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82061,"flow_last_seen":493284,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.131.24.72","src_port":28681,"dst_port":30711,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":281,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90744,"flow_last_seen":99778,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":50305,"dst_port":63637,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":281,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90744,"flow_last_seen":99778,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.54.66.82","src_port":50305,"dst_port":63637,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":93,"flow_state":"finished","flow_packets_processed":99,"flow_first_seen":71205,"flow_last_seen":593737,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":6090,"flow_avg_l4_payload_len":61,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.214.154.216","src_port":50248,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":48,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":65061,"flow_last_seen":74092,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":50208,"dst_port":8683,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":48,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":65061,"flow_last_seen":74092,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.237.116.22","src_port":50208,"dst_port":8683,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00664{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":794,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":520019,"flow_last_seen":523077,"flow_idle_time":180000,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"239.255.255.250","src_port":50214,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} +00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":266,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90737,"flow_last_seen":99778,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.89.249.8","src_port":50290,"dst_port":50649,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":266,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90737,"flow_last_seen":99778,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.89.249.8","src_port":50290,"dst_port":50649,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00626{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":797,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":552011,"flow_last_seen":552011,"flow_idle_time":120000,"flow_min_l4_payload_len":60,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":60,"flow_avg_l4_payload_len":60,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"154.3.42.209","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":135,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":72852,"flow_last_seen":491978,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.250.99.158","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":135,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":72852,"flow_last_seen":491978,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.250.99.158","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":78,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":69142,"flow_last_seen":78169,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.123.202.175","src_port":50237,"dst_port":37910,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":78,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":69142,"flow_last_seen":78169,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.123.202.175","src_port":50237,"dst_port":37910,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":151,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":75358,"flow_last_seen":84388,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":50264,"dst_port":48380,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":151,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":75358,"flow_last_seen":84388,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":50264,"dst_port":48380,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":764,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":433136,"flow_last_seen":433136,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"208.92.106.151","src_port":28681,"dst_port":32476,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":764,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":433136,"flow_last_seen":433136,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"208.92.106.151","src_port":28681,"dst_port":32476,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":89,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":71203,"flow_last_seen":80232,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":50244,"dst_port":63978,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":89,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":71203,"flow_last_seen":80232,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"188.61.52.183","src_port":50244,"dst_port":63978,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":92,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":71204,"flow_last_seen":80232,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":50247,"dst_port":51560,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":92,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":71204,"flow_last_seen":80232,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"66.30.221.181","src_port":50247,"dst_port":51560,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":784,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":491496,"flow_last_seen":491496,"flow_idle_time":180000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"23.19.141.110","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":784,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":491496,"flow_last_seen":491496,"flow_idle_time":180000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"23.19.141.110","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":750,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":312956,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.159.27.22","src_port":28681,"dst_port":17563,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":750,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":312956,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.159.27.22","src_port":28681,"dst_port":17563,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":156,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82057,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.244.228.86","src_port":28681,"dst_port":10131,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":156,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82057,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.244.228.86","src_port":28681,"dst_port":10131,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":176,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82061,"flow_last_seen":493284,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.99.164.4","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":176,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82061,"flow_last_seen":493284,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.99.164.4","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":774,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":551702,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":6599,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":774,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":551702,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"50.58.238.149","src_port":28681,"dst_port":6599,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":268,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90738,"flow_last_seen":99778,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":50292,"dst_port":11603,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":268,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90738,"flow_last_seen":99778,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"95.10.205.67","src_port":50292,"dst_port":11603,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":84,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70172,"flow_last_seen":79201,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.138.129.252","src_port":50243,"dst_port":27962,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":84,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70172,"flow_last_seen":79201,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.138.129.252","src_port":50243,"dst_port":27962,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":792,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493288,"flow_last_seen":493288,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.239.213.146","src_port":28681,"dst_port":21750,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":792,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493288,"flow_last_seen":493288,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.239.213.146","src_port":28681,"dst_port":21750,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":157,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":82058,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.227.162.150","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":157,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":82058,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.227.162.150","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":142,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":73299,"flow_last_seen":82326,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":50255,"dst_port":52165,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":142,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":73299,"flow_last_seen":82326,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.236.203.37","src_port":50255,"dst_port":52165,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":209,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":82066,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.179.98.234","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":209,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":82066,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.179.98.234","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":241,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":88706,"flow_last_seen":97732,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.215.130.156","src_port":50287,"dst_port":12405,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":241,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":88706,"flow_last_seen":97732,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.215.130.156","src_port":50287,"dst_port":12405,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":116,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":71540,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.44.190.145","src_port":28681,"dst_port":10170,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":116,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":71540,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.44.190.145","src_port":28681,"dst_port":10170,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":236,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":87671,"flow_last_seen":96685,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.124.66.33","src_port":50282,"dst_port":13060,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":236,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":87671,"flow_last_seen":96685,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"221.124.66.33","src_port":50282,"dst_port":13060,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":226,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":85607,"flow_last_seen":94638,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.172.184.48","src_port":50272,"dst_port":13298,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":226,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":85607,"flow_last_seen":94638,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.172.184.48","src_port":50272,"dst_port":13298,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":225,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":84593,"flow_last_seen":93622,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.198.27","src_port":50271,"dst_port":60202,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":225,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":84593,"flow_last_seen":93622,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.198.27","src_port":50271,"dst_port":60202,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":224,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":84593,"flow_last_seen":93622,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":50270,"dst_port":11427,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":224,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":84593,"flow_last_seen":93622,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.27.24.95","src_port":50270,"dst_port":11427,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":485,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":253025,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"154.3.42.209","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":485,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":253025,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"154.3.42.209","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":145,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":73301,"flow_last_seen":82326,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.100.216.210","src_port":50258,"dst_port":7097,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":145,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":73301,"flow_last_seen":82326,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.100.216.210","src_port":50258,"dst_port":7097,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00575{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":147,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":74328,"flow_last_seen":83345,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.200.161","src_port":50260,"dst_port":51394,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00560{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":147,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":74328,"flow_last_seen":83345,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.255.200.161","src_port":50260,"dst_port":51394,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":81,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70171,"flow_last_seen":79201,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.10.152","src_port":50240,"dst_port":21293,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":81,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70171,"flow_last_seen":79201,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.237.10.152","src_port":50240,"dst_port":21293,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":57,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66077,"flow_last_seen":75077,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":50216,"dst_port":3256,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":57,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66077,"flow_last_seen":75077,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"182.155.128.228","src_port":50216,"dst_port":3256,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":44,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":64032,"flow_last_seen":73065,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":50204,"dst_port":9728,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":44,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":64032,"flow_last_seen":73065,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.26.16","src_port":50204,"dst_port":9728,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":771,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":551881,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"202.27.193.6","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":771,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":551881,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"202.27.193.6","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":234,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":87670,"flow_last_seen":96685,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.199.148.6","src_port":50280,"dst_port":4338,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":234,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":87670,"flow_last_seen":96685,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"99.199.148.6","src_port":50280,"dst_port":4338,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":133,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":72852,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.175.220.161","src_port":28681,"dst_port":15721,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":133,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":72852,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"91.175.220.161","src_port":28681,"dst_port":15721,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":167,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82059,"flow_last_seen":493285,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.29.107.176","src_port":28681,"dst_port":20363,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":167,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82059,"flow_last_seen":493285,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.29.107.176","src_port":28681,"dst_port":20363,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":171,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82060,"flow_last_seen":493286,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"196.217.132.111","src_port":28681,"dst_port":25394,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":171,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82060,"flow_last_seen":493286,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"196.217.132.111","src_port":28681,"dst_port":25394,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":229,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":85608,"flow_last_seen":94638,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.117.100.78","src_port":50275,"dst_port":9010,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":229,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":85608,"flow_last_seen":94638,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"122.117.100.78","src_port":50275,"dst_port":9010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":786,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493286,"flow_last_seen":493286,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.38.9.82","src_port":28681,"dst_port":24223,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":786,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493286,"flow_last_seen":493286,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.38.9.82","src_port":28681,"dst_port":24223,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":781,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":490660,"flow_last_seen":552092,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.105.52.2","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":781,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":490660,"flow_last_seen":552092,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.105.52.2","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":782,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490660,"flow_last_seen":551702,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"65.182.231.232","src_port":28681,"dst_port":7890,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":782,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490660,"flow_last_seen":551702,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"65.182.231.232","src_port":28681,"dst_port":7890,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":160,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":82058,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.150.49.35","src_port":28681,"dst_port":32448,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":160,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":82058,"flow_last_seen":551892,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.150.49.35","src_port":28681,"dst_port":32448,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":486,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":253025,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.68.45.203","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":486,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":253025,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.68.45.203","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":185,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82062,"flow_last_seen":491980,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.196.58","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":185,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":82062,"flow_last_seen":491980,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.132.196.58","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":39,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":63002,"flow_last_seen":72031,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.128.217.128","src_port":50200,"dst_port":45194,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":39,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":63002,"flow_last_seen":72031,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.128.217.128","src_port":50200,"dst_port":45194,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":769,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":551881,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.110.61.169","src_port":28681,"dst_port":11973,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":769,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":551881,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"123.110.61.169","src_port":28681,"dst_port":11973,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":53,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":65063,"flow_last_seen":74092,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.117.153.7","src_port":50213,"dst_port":50138,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":53,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":65063,"flow_last_seen":74092,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.117.153.7","src_port":50213,"dst_port":50138,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":762,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":431830,"flow_last_seen":431830,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.75.43.182","src_port":28681,"dst_port":43502,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":762,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":431830,"flow_last_seen":431830,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.75.43.182","src_port":28681,"dst_port":43502,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":82,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70171,"flow_last_seen":79201,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.18.172.208","src_port":50241,"dst_port":63172,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":82,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70171,"flow_last_seen":79201,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"98.18.172.208","src_port":50241,"dst_port":63172,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":297,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90747,"flow_last_seen":99778,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":50321,"dst_port":4876,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":297,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90747,"flow_last_seen":99778,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.229.111.224","src_port":50321,"dst_port":4876,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":775,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490660,"flow_last_seen":490939,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.17.132.18","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":775,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490660,"flow_last_seen":490939,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":73,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"223.17.132.18","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":130,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":72851,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.224.95.97","src_port":28681,"dst_port":46356,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":130,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":72851,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"119.224.95.97","src_port":28681,"dst_port":46356,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":129,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":72850,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.138.50.179","src_port":28681,"dst_port":29411,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":129,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":72850,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.138.50.179","src_port":28681,"dst_port":29411,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":788,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493287,"flow_last_seen":493287,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.134.167.82","src_port":28681,"dst_port":5820,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":788,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493287,"flow_last_seen":493287,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"220.134.167.82","src_port":28681,"dst_port":5820,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":79,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70170,"flow_last_seen":79200,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.41.253","src_port":50238,"dst_port":59144,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":79,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70170,"flow_last_seen":79200,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"124.218.41.253","src_port":50238,"dst_port":59144,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":230,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":86639,"flow_last_seen":95653,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":50276,"dst_port":56070,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":230,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":86639,"flow_last_seen":95653,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"96.246.156.126","src_port":50276,"dst_port":56070,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":70,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":68109,"flow_last_seen":77122,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.36.249.91","src_port":50229,"dst_port":64920,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00555{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":70,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":68109,"flow_last_seen":77122,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"1.36.249.91","src_port":50229,"dst_port":64920,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":789,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493287,"flow_last_seen":493287,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.98.115.128","src_port":28681,"dst_port":23458,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":789,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493287,"flow_last_seen":493287,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"42.98.115.128","src_port":28681,"dst_port":23458,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":795,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":551890,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.120.26.86","src_port":28681,"dst_port":29946,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":795,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":551890,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"213.120.26.86","src_port":28681,"dst_port":29946,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":33,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61977,"flow_last_seen":61977,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"162.157.143.201","src_port":50195,"dst_port":29762,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":33,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61977,"flow_last_seen":61977,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"162.157.143.201","src_port":50195,"dst_port":29762,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":91,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":71204,"flow_last_seen":80232,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":50246,"dst_port":45685,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":91,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":71204,"flow_last_seen":80232,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.7.252.192","src_port":50246,"dst_port":45685,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":755,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":371838,"flow_last_seen":491980,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.134.107.32","src_port":28681,"dst_port":38836,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":755,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":371838,"flow_last_seen":491980,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"83.134.107.32","src_port":28681,"dst_port":38836,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":50,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":65062,"flow_last_seen":74092,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.234.18.166","src_port":50210,"dst_port":61404,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":50,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":65062,"flow_last_seen":74092,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.234.18.166","src_port":50210,"dst_port":61404,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":137,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":72853,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.65.70.197","src_port":28681,"dst_port":21693,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":137,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":72853,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.65.70.197","src_port":28681,"dst_port":21693,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":45,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":64032,"flow_last_seen":73065,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.46.139.171","src_port":50205,"dst_port":52120,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":45,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":64032,"flow_last_seen":73065,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"114.46.139.171","src_port":50205,"dst_port":52120,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":772,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":551701,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.192.231.237","src_port":28681,"dst_port":9676,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":772,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":551701,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.192.231.237","src_port":28681,"dst_port":9676,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":109,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":71539,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.169.2.153","src_port":28681,"dst_port":52414,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":109,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":71539,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"88.169.2.153","src_port":28681,"dst_port":52414,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":140,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":72853,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.197.111.186","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":140,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":72853,"flow_last_seen":551891,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"77.197.111.186","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":770,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":490846,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":74,"flow_avg_l4_payload_len":37,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":28681,"dst_port":8890,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":770,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490659,"flow_last_seen":490846,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":74,"flow_avg_l4_payload_len":37,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"97.83.183.148","src_port":28681,"dst_port":8890,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":235,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":87670,"flow_last_seen":96685,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.134.154.158","src_port":50281,"dst_port":54130,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":235,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":87670,"flow_last_seen":96685,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"94.134.154.158","src_port":50281,"dst_port":54130,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00628{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":783,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":490916,"flow_last_seen":490916,"flow_idle_time":120000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"65.182.231.232","dst_ip":"10.0.2.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":60,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66079,"flow_last_seen":75108,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.121.165.12","src_port":50219,"dst_port":55376,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":60,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66079,"flow_last_seen":75108,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"193.121.165.12","src_port":50219,"dst_port":55376,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00800{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":239,"flow_state":"finished","flow_packets_processed":312,"flow_first_seen":88704,"flow_last_seen":593713,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":19428,"flow_avg_l4_payload_len":62,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"75.133.101.93","src_port":50285,"dst_port":52367,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00916{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":334,"flow_state":"finished","flow_packets_processed":1251,"flow_first_seen":114930,"flow_last_seen":537520,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":1051202,"flow_avg_l4_payload_len":840,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"189.147.72.83","src_port":50328,"dst_port":26108,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}},"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00576{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":175,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82060,"flow_last_seen":493283,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"115.69.62.99","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00561{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":175,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":82060,"flow_last_seen":493283,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"115.69.62.99","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":756,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":373494,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.100.68.255","src_port":28681,"dst_port":12838,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":756,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":373494,"flow_last_seen":551890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"41.100.68.255","src_port":28681,"dst_port":12838,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":790,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493288,"flow_last_seen":493288,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.39.233","src_port":28681,"dst_port":20855,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":790,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493288,"flow_last_seen":493288,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"218.164.39.233","src_port":28681,"dst_port":20855,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00570{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":80,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70171,"flow_last_seen":79201,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.105.52.2","src_port":50239,"dst_port":6384,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00555{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":80,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70171,"flow_last_seen":79201,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"112.105.52.2","src_port":50239,"dst_port":6384,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":232,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":86640,"flow_last_seen":95653,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.231.59.187","src_port":50278,"dst_port":62234,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":232,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":86640,"flow_last_seen":95653,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"36.231.59.187","src_port":50278,"dst_port":62234,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":766,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490658,"flow_last_seen":490658,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.119.55.28","src_port":28681,"dst_port":20347,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":766,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":490658,"flow_last_seen":490658,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.119.55.28","src_port":28681,"dst_port":20347,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00579{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":763,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":433135,"flow_last_seen":433135,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.170.209.214","src_port":28681,"dst_port":46210,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00564{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":763,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":433135,"flow_last_seen":433135,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"85.170.209.214","src_port":28681,"dst_port":46210,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00801{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":288,"flow_state":"finished","flow_packets_processed":295,"flow_first_seen":90745,"flow_last_seen":593624,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":9996,"flow_avg_l4_payload_len":33,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"104.238.172.250","src_port":50312,"dst_port":23548,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":120,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":72265,"flow_last_seen":81294,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.127.1.235","src_port":50251,"dst_port":37814,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":120,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":72265,"flow_last_seen":81294,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.127.1.235","src_port":50251,"dst_port":37814,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":144,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":73300,"flow_last_seen":82326,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.48.23","src_port":50257,"dst_port":3054,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":144,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":73300,"flow_last_seen":82326,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.70.48.23","src_port":50257,"dst_port":3054,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":286,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90745,"flow_last_seen":99778,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.110.153.177","src_port":50310,"dst_port":40022,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":286,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":90745,"flow_last_seen":99778,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"76.110.153.177","src_port":50310,"dst_port":40022,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":40,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":63002,"flow_last_seen":72031,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.122.93.185","src_port":50201,"dst_port":6346,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":40,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":63002,"flow_last_seen":72031,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"78.122.93.185","src_port":50201,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":58,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66078,"flow_last_seen":75077,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":50217,"dst_port":54958,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":58,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66078,"flow_last_seen":75077,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"113.252.86.162","src_port":50217,"dst_port":54958,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":158,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82058,"flow_last_seen":491980,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.166.226.70","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":158,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":82058,"flow_last_seen":491980,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"118.166.226.70","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00572{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":32,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61975,"flow_last_seen":61975,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.152.66.153","src_port":50194,"dst_port":43771,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00557{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":32,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":61975,"flow_last_seen":61975,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.152.66.153","src_port":50194,"dst_port":43771,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":87,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":70230,"flow_last_seen":493284,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.131.85.245","src_port":28681,"dst_port":31743,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":87,"flow_state":"info","flow_packets_processed":5,"flow_first_seen":70230,"flow_last_seen":493284,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"92.131.85.245","src_port":28681,"dst_port":31743,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":83,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70172,"flow_last_seen":79201,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.210.203.131","src_port":50242,"dst_port":6346,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":83,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":70172,"flow_last_seen":79201,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.210.203.131","src_port":50242,"dst_port":6346,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":66,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":67095,"flow_last_seen":76122,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.210.81.147","src_port":50225,"dst_port":24800,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":66,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":67095,"flow_last_seen":76122,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"109.210.81.147","src_port":50225,"dst_port":24800,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":150,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":75358,"flow_last_seen":84388,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.182.136.42","src_port":50263,"dst_port":27873,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":150,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":75358,"flow_last_seen":84388,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"73.182.136.42","src_port":50263,"dst_port":27873,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00571{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":62,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":67093,"flow_last_seen":76122,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":50221,"dst_port":49956,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":62,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":67093,"flow_last_seen":76122,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"59.104.173.5","src_port":50221,"dst_port":49956,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":785,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493286,"flow_last_seen":493286,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.134.139.39","src_port":28681,"dst_port":6346,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":785,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493286,"flow_last_seen":493286,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"176.134.139.39","src_port":28681,"dst_port":6346,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":780,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490660,"flow_last_seen":551702,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.66.94.132","src_port":28681,"dst_port":17735,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":780,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":490660,"flow_last_seen":551702,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":56,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"68.66.94.132","src_port":28681,"dst_port":17735,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":761,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":431829,"flow_last_seen":431829,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.132.75.56","src_port":28681,"dst_port":56009,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":761,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":431829,"flow_last_seen":431829,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"195.132.75.56","src_port":28681,"dst_port":56009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00573{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":55,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66076,"flow_last_seen":75077,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.193.171.146","src_port":50214,"dst_port":53808,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00558{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":55,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":66076,"flow_last_seen":75077,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"80.193.171.146","src_port":50214,"dst_port":53808,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00574{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":231,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":86639,"flow_last_seen":95653,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":50277,"dst_port":36368,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00559{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":231,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":86639,"flow_last_seen":95653,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"82.181.251.218","src_port":50277,"dst_port":36368,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00577{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":791,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493288,"flow_last_seen":493288,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.11.85","src_port":28681,"dst_port":10722,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00562{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":791,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":493288,"flow_last_seen":493288,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"219.85.11.85","src_port":28681,"dst_port":10722,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00798{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":94,"flow_state":"finished","flow_packets_processed":90,"flow_first_seen":71205,"flow_last_seen":593376,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1065,"flow_tot_l4_payload_len":5915,"flow_avg_l4_payload_len":65,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"86.208.180.181","src_port":50249,"dst_port":45883,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Gnutella","breed":"Potentially Dangerous","category":"Download"}} +00578{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":95716,"flow_last_seen":426518,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":359,"flow_avg_l4_payload_len":51,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.167.201.53","src_port":28681,"dst_port":47282,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00563{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":312,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":95716,"flow_last_seen":426518,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":81,"flow_tot_l4_payload_len":359,"flow_avg_l4_payload_len":51,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"24.167.201.53","src_port":28681,"dst_port":47282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00580{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":138,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":72853,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"167.114.170.156","src_port":28681,"dst_port":23844,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00565{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","flow_id":138,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":72853,"flow_last_seen":553212,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":599747,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"167.114.170.156","src_port":28681,"dst_port":23844,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00567{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":7491,"source":"gnutella.pcap","alias":"nDPId-test","packets-captured":7491,"packets-processed":7468,"total-skipped-flows":0,"total-l4-data-len":3617715,"total-not-detected-flows":699,"total-guessed-flows":4,"total-detected-flows":98,"total-detection-updates":3,"total-updates":290,"current-active-flows":0,"total-active-flows":801,"total-idle-flows":801,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":4251,"global_ts_msec":600247} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 7491/7468 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 3617715 bytes +~~ total detected protocols..: 98 +~~ total active/idle flows...: 801/801 +~~ total timeout flows.......: 151 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 6204240 bytes +~~ total memory freed........: 6204240 bytes +~~ total allocations/frees...: 123006/123006 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 179 chars +~~ json string max len.......: 1916 chars +~~ json string avg len.......: 1047 chars diff --git a/test/results/google_ssl.pcap.out b/test/results/google_ssl.pcap.out index e8b985496..788793af4 100644 --- a/test/results/google_ssl.pcap.out +++ b/test/results/google_ssl.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682370 bytes -~~ total memory freed........: 4682370 bytes -~~ total allocations/frees...: 101172/101172 +~~ total memory allocated....: 5181277 bytes +~~ total memory freed........: 5181277 bytes +~~ total allocations/frees...: 113054/113054 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 456 chars ~~ json string max len.......: 662 chars diff --git a/test/results/googledns_android10.pcap.out b/test/results/googledns_android10.pcap.out index 06254fc4e..3ddaea6c0 100644 --- a/test/results/googledns_android10.pcap.out +++ b/test/results/googledns_android10.pcap.out @@ -65,9 +65,9 @@ ~~ total active/idle flows...: 8/8 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4726914 bytes -~~ total memory freed........: 4726914 bytes -~~ total allocations/frees...: 101757/101757 +~~ total memory allocated....: 5225821 bytes +~~ total memory freed........: 5225821 bytes +~~ total allocations/frees...: 113639/113639 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 1424 chars diff --git a/test/results/gquic.pcap.out b/test/results/gquic.pcap.out index 2982eb250..bd7450e8d 100644 --- a/test/results/gquic.pcap.out +++ b/test/results/gquic.pcap.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685099 bytes -~~ total memory freed........: 4685099 bytes -~~ total allocations/frees...: 101155/101155 +~~ total memory allocated....: 5188817 bytes +~~ total memory freed........: 5188817 bytes +~~ total allocations/frees...: 113046/113046 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 2272 chars diff --git a/test/results/gre_no_options.pcapng.out b/test/results/gre_no_options.pcapng.out new file mode 100644 index 000000000..43a474718 --- /dev/null +++ b/test/results/gre_no_options.pcapng.out @@ -0,0 +1,23 @@ +00467{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"gre_no_options.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00553{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"gre_no_options.pcapng","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1588346159187} +00551{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"gre_no_options.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1588346159187,"flow_last_seen":1588346159187,"flow_idle_time":600000,"flow_min_l4_payload_len":104,"flow_max_l4_payload_len":104,"flow_tot_l4_payload_len":104,"flow_avg_l4_payload_len":104,"midstream":0,"thread_ts_msec":1588346159187,"l3_proto":"ip4","src_ip":"203.0.113.1","dst_ip":"192.0.2.2","l4_proto":47,"flow_datalink":1,"flow_max_packets":3} +00571{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"gre_no_options.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1588346159187,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"thread_ts_msec":1588346159187,"pkt":"qrvMAAQAqrvMAAEACABFAAB8AAUAAP8vvUnLAHEBwAACAgAACABFAABkAAAAAP8Bo5QKAQIBCgECAggAttoAAAAAAAAAAAACx22rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavN"} +00609{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"gre_no_options.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1588346159187,"flow_last_seen":1588346159187,"flow_idle_time":600000,"flow_min_l4_payload_len":104,"flow_max_l4_payload_len":104,"flow_tot_l4_payload_len":104,"flow_avg_l4_payload_len":104,"midstream":0,"thread_ts_msec":1588346159187,"l3_proto":"ip4","src_ip":"203.0.113.1","dst_ip":"192.0.2.2","l4_proto":47,"ndpi": {"confidence": {"4":"DPI"},"proto":"GRE","breed":"Acceptable","category":"Network"}} +00571{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"gre_no_options.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1588346159188,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"thread_ts_msec":1588346159188,"pkt":"qrvMAAEAqrvMAAQACABFAAB8AAUAAP4vvknAAAICywBxAQAACABFAABkAAAAAP8Bo5QKAQICCgECAQAAvtoAAAAAAAAAAAACx22rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavN"} +00648{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2,"source":"gre_no_options.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1588346159187,"flow_last_seen":1588346159188,"flow_idle_time":600000,"flow_min_l4_payload_len":104,"flow_max_l4_payload_len":104,"flow_tot_l4_payload_len":208,"flow_avg_l4_payload_len":104,"midstream":0,"thread_ts_msec":1588346159188,"l3_proto":"ip4","src_ip":"203.0.113.1","dst_ip":"192.0.2.2","l4_proto":47,"flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"GRE","breed":"Acceptable","category":"Network"}} +00557{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2,"source":"gre_no_options.pcapng","alias":"nDPId-test","packets-captured":2,"packets-processed":2,"total-skipped-flows":0,"total-l4-data-len":208,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":8,"global_ts_msec":1588346159188} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 2/2 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 208 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5178475 bytes +~~ total memory freed........: 5178475 bytes +~~ total allocations/frees...: 113027/113027 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 472 chars +~~ json string max len.......: 653 chars +~~ json string avg len.......: 553 chars diff --git a/test/results/gtp_c.pcap.out b/test/results/gtp_c.pcap.out new file mode 100644 index 000000000..d548cc4d1 --- /dev/null +++ b/test/results/gtp_c.pcap.out @@ -0,0 +1,24 @@ +00456{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"gtp_c.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00542{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"gtp_c.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1614767558813} +00575{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"gtp_c.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1614767558813,"flow_last_seen":1614767558813,"flow_idle_time":180000,"flow_min_l4_payload_len":247,"flow_max_l4_payload_len":247,"flow_tot_l4_payload_len":247,"flow_avg_l4_payload_len":247,"midstream":0,"thread_ts_msec":1614767558813,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":1024,"dst_port":2123,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00768{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"gtp_c.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1614767558813,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":289,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":289,"pkt_l4_len":255,"thread_ts_msec":1614767558813,"pkt":"5kBKB+riApXG95NLCABFAAETmxkAAIARAAAKZQACCmYAAgQACEsA\/wAASCAA8wAAAABLVGIAAQAIAIlnRREiM0T1TAAGAJh2VBI0VksACAA0VniQEgEC81YADQAYmHZUEjSYdlQSNFZ4UwADAIlHVlIAAQAGTQACAAAAVwAJAIY1UpIECmUAAkcACQAIaW50ZXJuZXSAAAEAAGMAAQABTwAFAAEhFxcBfwABAAJIAAgAAAAnDwAAJw9JAAEABV0APQBJAAEABVQADQAhMQEJEMCoAQH\/\/\/8AVwAJAoQ1UpIFCmUAAlAAFgAYBwAAAAAAAAAAAAAAAAAAAAAAAAAAhAAHAAGsEGtxAAGEAAcBAawQa3IAAXIAAgAAAF8AAgAAAQ=="} +00639{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"gtp_c.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1614767558813,"flow_last_seen":1614767558813,"flow_idle_time":180000,"flow_min_l4_payload_len":247,"flow_max_l4_payload_len":247,"flow_tot_l4_payload_len":247,"flow_avg_l4_payload_len":247,"midstream":0,"thread_ts_msec":1614767558813,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":1024,"dst_port":2123,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"GTP.GTP_C","breed":"Acceptable","category":"Network"}} +00718{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"gtp_c.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1614767558814,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":254,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":254,"pkt_l4_len":220,"thread_ts_msec":1614767558814,"pkt":"ApXG95NL5kBKB+riCABFAADwmxEAAH8Rix0KZgACCmUAAghLBAAA3AAASCEA0DVSkgRLVGIAAgACABAAVwAJAYc1UpIGCmYAAk8ABQABIRcXAX8AAQABSAAIAAAAJw8AACcPXQBsAEkAAQAFAgACABAAVAAuACIgABgQ3NwAAP\/\/AAAwhEEH0BOIUQfQE4hwAAAQAA8whEEH0BOIUQfQE4hwAABXAAkChTVSkgcKZgACUAAWABgHAAAAAAAAAAAAAAAAAAAAAAAAAABeAAQAEDqYBQMAAQABiAAXAG9mY3MubW5jNjU0Lm1jYzk4Ny5ncHJzhAAHAAGsEGt6AAE="} +00477{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"gtp_c.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1614767558814,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"thread_ts_msec":1614767558814,"pkt":"5kBKB+riApXG95NLCABFAAA+mxoAAIARAAAKZQACCmYAAgQACEsAKgAASCQAHjVSkgZLVGIASQABAAVWAA0AGJh2VBI0mHZUEjRWeA=="} +00677{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4,"source":"gtp_c.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1614767558813,"flow_last_seen":1614767558815,"flow_idle_time":180000,"flow_min_l4_payload_len":23,"flow_max_l4_payload_len":247,"flow_tot_l4_payload_len":516,"flow_avg_l4_payload_len":129,"midstream":0,"thread_ts_msec":1614767558815,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":1024,"dst_port":2123,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"GTP.GTP_C","breed":"Acceptable","category":"Network"}} +00546{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":4,"source":"gtp_c.pcap","alias":"nDPId-test","packets-captured":4,"packets-processed":4,"total-skipped-flows":0,"total-l4-data-len":516,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1614767558815} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 4/4 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 516 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5178533 bytes +~~ total memory freed........: 5178533 bytes +~~ total allocations/frees...: 113029/113029 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 461 chars +~~ json string max len.......: 773 chars +~~ json string avg len.......: 614 chars diff --git a/test/results/gtp_false_positive.pcapng.out b/test/results/gtp_false_positive.pcapng.out index ae0c891a7..1f13295ba 100644 --- a/test/results/gtp_false_positive.pcapng.out +++ b/test/results/gtp_false_positive.pcapng.out @@ -25,9 +25,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681457 bytes -~~ total memory freed........: 4681457 bytes -~~ total allocations/frees...: 101156/101156 +~~ total memory allocated....: 5180364 bytes +~~ total memory freed........: 5180364 bytes +~~ total allocations/frees...: 113038/113038 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 891 chars diff --git a/test/results/gtp_prime.pcapng.out b/test/results/gtp_prime.pcapng.out new file mode 100644 index 000000000..74e5a732d --- /dev/null +++ b/test/results/gtp_prime.pcapng.out @@ -0,0 +1,20 @@ +00462{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"gtp_prime.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00548{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"gtp_prime.pcapng","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1424882324190} +00188{"error_event_id":5,"error_event_name":"Unknown packet type","datalink":1,"packet_id":1,"source":"gtp_prime.pcapng","alias":"nDPId-test","layer_type":33024,"global_ts_msec":1424882324190} +00667{"packet_event_id":1,"packet_event_name":"packet","packet_id":1,"source":"gtp_prime.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":300,"pkt_type":33024,"pkt_l3_offset":18,"pkt_l4_offset":0,"pkt_len":300,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"tjL\/AAFBtij\/AAFBgQAAZIEAAGcIAEXAARYAAAAAPxEI+QoKNgEKCicK\/EQNOgEC27Eu8AD0AAR+AfwA7wEBHAYA6b9gggDkgAFggwgTACEAAAAA8KQGgAQKCjUBhQQHkAAAhwVlaHJwZIgC8SGpCKAGgAQBAAAGiwEBrIIAKjAogwIDSIQCA0iFAQKGCRUCJRY4RCsAAKkQgQEIhgEJhwNMS0CIA0xLQI0JFQIlFjgBKwAAjgErjwEAsCKkIAYOKwYBBAGyfwMBAkYEAQCBAQCiCzAJAgEBAgEBgQEOkgpBTFUtTk9ERTAxlAEBlQEAlwIBAJgBA54BA58iAQG\/JAaABAoKBgOfJQMTIBCfJgkVAiUWOAArAACfJwkVAiUWOEQrAACfKAQHkAAA"} +00550{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"gtp_prime.pcapng","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":5,"global_ts_msec":1424882324190} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 1/0 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 0 bytes +~~ total detected protocols..: 0 +~~ total active/idle flows...: 0/0 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5177545 bytes +~~ total memory freed........: 5177545 bytes +~~ total allocations/frees...: 113022/113022 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 193 chars +~~ json string max len.......: 672 chars +~~ json string avg len.......: 417 chars diff --git a/test/results/h323-overflow.pcap.out b/test/results/h323-overflow.pcap.out index afc0c13bf..e8ce88574 100644 --- a/test/results/h323-overflow.pcap.out +++ b/test/results/h323-overflow.pcap.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681587 bytes -~~ total memory freed........: 4681587 bytes -~~ total allocations/frees...: 101145/101145 +~~ total memory allocated....: 5180494 bytes +~~ total memory freed........: 5180494 bytes +~~ total allocations/frees...: 113027/113027 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 466 chars ~~ json string max len.......: 654 chars diff --git a/test/results/h323.pcap.out b/test/results/h323.pcap.out new file mode 100644 index 000000000..f32e04519 --- /dev/null +++ b/test/results/h323.pcap.out @@ -0,0 +1,29 @@ +00455{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"h323.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00541{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"h323.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1198747079978} +00570{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"h323.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1198747079978,"flow_last_seen":1198747079978,"flow_idle_time":180000,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":38,"flow_tot_l4_payload_len":38,"flow_avg_l4_payload_len":38,"midstream":0,"thread_ts_msec":1198747079978,"l3_proto":"ip4","src_ip":"17.2.0.124","dst_ip":"17.2.0.161","src_port":2034,"dst_port":1719,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"h323.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1198747079978,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"thread_ts_msec":1198747079978,"pkt":"ABj+bZZlABMh8GpfCABFAABCx9cAAIART7MRAgB8EQIAoQfyBrcALv7LAiAAAAYACJFKAAQAEQIAfAfyIgCuAQA9AAEDAIXImlEggAMBQAA="} +00626{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"h323.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1198747079978,"flow_last_seen":1198747079978,"flow_idle_time":180000,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":38,"flow_tot_l4_payload_len":38,"flow_avg_l4_payload_len":38,"midstream":0,"thread_ts_msec":1198747079978,"l3_proto":"ip4","src_ip":"17.2.0.124","dst_ip":"17.2.0.161","src_port":2034,"dst_port":1719,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"H323","breed":"Acceptable","category":"VoIP"}} +00543{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"h323.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1198747080010,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":125,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":125,"pkt_l4_len":91,"thread_ts_msec":1198747080010,"pkt":"ABMh8GpfABj+bZZlCABFAABviRAAAIARjk0RAgChEQIAfAa3B\/IAWwaKBIAAAAYACJFKAAQ+AE8AcABlAG4ASAAzADIAMwAgAEcAYQB0AGUAawBlAGUAcABlAHIAIABvAG4AIABtAGYAbwB0AHQAZQBrAGkAbgARAgChBrc="} +00607{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"h323.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1198747080226,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":174,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":174,"pkt_l4_len":140,"thread_ts_msec":1198747080226,"pkt":"ABj+bZZlABMh8GpfCABFAACgx94AAIART04RAgB8EQIAoQfyBrcAjI1fDsAAAQYACJFKAASAAQARAgB8BrgBABECAHwH8iIArgEAPQABhA4QA0AzMzMzMzMzMzCZkD4ATwBwAGUAbgBIADMAMgAzACAARwBhAHQAZQBrAGUAZQBwAGUAcgAgAG8AbgAgAG0AZgBvAHQAdABlAGsAaQBuAK4BAD0oCwAAAQABgAGA"} +00575{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7,"source":"h323.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1198747081344,"flow_last_seen":1198747081344,"flow_idle_time":7440000,"flow_min_l4_payload_len":153,"flow_max_l4_payload_len":153,"flow_tot_l4_payload_len":153,"flow_avg_l4_payload_len":153,"midstream":1,"thread_ts_msec":1198747081344,"l3_proto":"ip4","src_ip":"17.2.0.124","dst_ip":"17.2.0.122","src_port":3032,"dst_port":1720,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00655{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"h323.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1198747081344,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":207,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":207,"pkt_l4_len":173,"thread_ts_msec":1198747081344,"pkt":"ABMh8GmQABMh8GpfCABFAADByARAAIAGDzkRAgB8EQIAegvYBrgNUNrQGPo2h1AY\/\/8jrQAAAwAAmQgCAAEFBAOQkKJsCME1Mjk1NjcycAjBOTI0NjUyNn4AcwUgqAYACJFKAAQBAwCFyJpSIK4BAD0AEQIAega4AAA9\/TAAAEgzgAAFBAMCAQAAzQ2AAgcAEQIAfAa4EQAAQJH7con5EYAqBQQDAgEAAQABAAEAAQAZAXggFAARaW5mb0Bhc2Vsc2FuLmNvbW9tKBCAAQCh"} +00512{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"h323.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1198747081402,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":100,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":100,"pkt_l4_len":66,"thread_ts_msec":1198747081402,"pkt":"ABMh8GpfABMh8GmQCABFAABWwtdAAIAGFNERAgB6EQIAfAa4C9gY+jaHDVDbaVAY\/2aqggAAAwAALggCgAFafgAiBSXABgAIkUoABFgIEQAkqxVydvoYEJpYABMh8GmQAoABAA=="} +00629{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"h323.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1198747081344,"flow_last_seen":1198747081402,"flow_idle_time":7440000,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":153,"flow_tot_l4_payload_len":199,"flow_avg_l4_payload_len":99,"midstream":1,"thread_ts_msec":1198747081402,"l3_proto":"ip4","src_ip":"17.2.0.124","dst_ip":"17.2.0.122","src_port":3032,"dst_port":1720,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"H323","breed":"Acceptable","category":"VoIP"}} +00671{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":12,"source":"h323.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":1198747079978,"flow_last_seen":1198747160184,"flow_idle_time":180000,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":369,"flow_tot_l4_payload_len":1098,"flow_avg_l4_payload_len":109,"midstream":0,"thread_ts_msec":1198747160184,"l3_proto":"ip4","src_ip":"17.2.0.124","dst_ip":"17.2.0.161","src_port":2034,"dst_port":1719,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"H323","breed":"Acceptable","category":"VoIP"}} +00669{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":12,"source":"h323.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1198747081344,"flow_last_seen":1198747081402,"flow_idle_time":7440000,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":153,"flow_tot_l4_payload_len":199,"flow_avg_l4_payload_len":99,"midstream":1,"thread_ts_msec":1198747160184,"l3_proto":"ip4","src_ip":"17.2.0.124","dst_ip":"17.2.0.122","src_port":3032,"dst_port":1720,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"H323","breed":"Acceptable","category":"VoIP"}} +00550{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":12,"source":"h323.pcap","alias":"nDPId-test","packets-captured":12,"packets-processed":12,"total-skipped-flows":0,"total-l4-data-len":1297,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":14,"global_ts_msec":1198747160184} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 12/12 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 1297 bytes +~~ total detected protocols..: 2 +~~ total active/idle flows...: 2/2 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5181685 bytes +~~ total memory freed........: 5181685 bytes +~~ total allocations/frees...: 113041/113041 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 460 chars +~~ json string max len.......: 676 chars +~~ json string avg len.......: 566 chars diff --git a/test/results/hangout.pcap.out b/test/results/hangout.pcap.out index 0e0c7ae91..06c2ce47a 100644 --- a/test/results/hangout.pcap.out +++ b/test/results/hangout.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4688269 bytes -~~ total memory freed........: 4688269 bytes -~~ total allocations/frees...: 101164/101164 +~~ total memory allocated....: 5187176 bytes +~~ total memory freed........: 5187176 bytes +~~ total allocations/frees...: 113046/113046 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 844 chars diff --git a/test/results/hpvirtgrp.pcap.out b/test/results/hpvirtgrp.pcap.out index fad6038f3..3bc662be0 100644 --- a/test/results/hpvirtgrp.pcap.out +++ b/test/results/hpvirtgrp.pcap.out @@ -70,9 +70,9 @@ ~~ total active/idle flows...: 9/9 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4708833 bytes -~~ total memory freed........: 4708833 bytes -~~ total allocations/frees...: 101311/101311 +~~ total memory allocated....: 5207740 bytes +~~ total memory freed........: 5207740 bytes +~~ total allocations/frees...: 113193/113193 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 457 chars ~~ json string max len.......: 696 chars diff --git a/test/results/hsrp0.pcap.out b/test/results/hsrp0.pcap.out index d8f602771..6cdb9dd5f 100644 --- a/test/results/hsrp0.pcap.out +++ b/test/results/hsrp0.pcap.out @@ -25,9 +25,9 @@ ~~ total active/idle flows...: 4/4 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682242 bytes -~~ total memory freed........: 4682242 bytes -~~ total allocations/frees...: 101156/101156 +~~ total memory allocated....: 5181149 bytes +~~ total memory freed........: 5181149 bytes +~~ total allocations/frees...: 113038/113038 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 676 chars diff --git a/test/results/hsrp2.pcap.out b/test/results/hsrp2.pcap.out index dc5a6dc9b..d794bce20 100644 --- a/test/results/hsrp2.pcap.out +++ b/test/results/hsrp2.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680440 bytes -~~ total memory freed........: 4680440 bytes -~~ total allocations/frees...: 101148/101148 +~~ total memory allocated....: 5179347 bytes +~~ total memory freed........: 5179347 bytes +~~ total allocations/frees...: 113030/113030 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 678 chars diff --git a/test/results/hsrp2_ipv6.pcapng.out b/test/results/hsrp2_ipv6.pcapng.out index ebedb845b..a088657ad 100644 --- a/test/results/hsrp2_ipv6.pcapng.out +++ b/test/results/hsrp2_ipv6.pcapng.out @@ -21,9 +21,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681426 bytes -~~ total memory freed........: 4681426 bytes -~~ total allocations/frees...: 101182/101182 +~~ total memory allocated....: 5180333 bytes +~~ total memory freed........: 5180333 bytes +~~ total allocations/frees...: 113064/113064 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 468 chars ~~ json string max len.......: 819 chars diff --git a/test/results/http-crash-content-disposition.pcap.out b/test/results/http-crash-content-disposition.pcap.out index 558387c45..a3907ee91 100644 --- a/test/results/http-crash-content-disposition.pcap.out +++ b/test/results/http-crash-content-disposition.pcap.out @@ -27,9 +27,9 @@ ~~ total active/idle flows...: 0/0 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4678638 bytes -~~ total memory freed........: 4678638 bytes -~~ total allocations/frees...: 101140/101140 +~~ total memory allocated....: 5177545 bytes +~~ total memory freed........: 5177545 bytes +~~ total allocations/frees...: 113022/113022 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 201 chars ~~ json string max len.......: 2276 chars diff --git a/test/results/http-lines-split.pcap.out b/test/results/http-lines-split.pcap.out index de9aea40c..d3b59c60a 100644 --- a/test/results/http-lines-split.pcap.out +++ b/test/results/http-lines-split.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679946 bytes -~~ total memory freed........: 4679946 bytes -~~ total allocations/frees...: 101159/101159 +~~ total memory allocated....: 5178853 bytes +~~ total memory freed........: 5178853 bytes +~~ total allocations/frees...: 113041/113041 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 471 chars ~~ json string max len.......: 886 chars diff --git a/test/results/http-manipulated.pcap.out b/test/results/http-manipulated.pcap.out index ae22647a4..a772688b6 100644 --- a/test/results/http-manipulated.pcap.out +++ b/test/results/http-manipulated.pcap.out @@ -22,9 +22,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4690075 bytes -~~ total memory freed........: 4690075 bytes -~~ total allocations/frees...: 101481/101481 +~~ total memory allocated....: 5188982 bytes +~~ total memory freed........: 5188982 bytes +~~ total allocations/frees...: 113363/113363 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 992 chars diff --git a/test/results/http_auth.pcap.out b/test/results/http_auth.pcap.out index 332e3b733..b3c328b5f 100644 --- a/test/results/http_auth.pcap.out +++ b/test/results/http_auth.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680649 bytes -~~ total memory freed........: 4680649 bytes -~~ total allocations/frees...: 101180/101180 +~~ total memory allocated....: 5179556 bytes +~~ total memory freed........: 5179556 bytes +~~ total allocations/frees...: 113062/113062 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 885 chars diff --git a/test/results/http_connect.pcap.out b/test/results/http_connect.pcap.out new file mode 100644 index 000000000..b4c817e0d --- /dev/null +++ b/test/results/http_connect.pcap.out @@ -0,0 +1,37 @@ +00463{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"http_connect.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00549{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"http_connect.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1631454722864} +00581{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1631454722864,"flow_last_seen":1631454722864,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1631454722864,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.146","src_port":1714,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00469{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1631454722864,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1631454722864,"pkt":"AAwpTU5kKBaoBOm8CABFAAA0iNFAAIAG7ajAqAFnwKgBkgayH5A7mDABAAAAAIAC+vBd+gAAAgQFtAEDAwgBAQQC"} +00469{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1631454722864,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1631454722864,"pkt":"KBaoBOm8AAwpTU5kCABFAAA0AABAAEAGtnrAqAGSwKgBZx+QBrLnDc0lO5gwAoAS+vCEcAAAAgQFtAEBBAIBAwMH"} +00461{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1631454722866,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_msec":1631454722866,"pkt":"AAwpTU5kKBaoBOm8CABFAAAoiNJAAIAG7bPAqAFnwKgBkgayH5A7mDAC5w3NJlAQBALhdwAAAAAAAAAA"} +00649{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1631454722864,"flow_last_seen":1631454722867,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":203,"flow_tot_l4_payload_len":203,"flow_avg_l4_payload_len":50,"midstream":0,"thread_ts_msec":1631454722867,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.146","src_port":1714,"dst_port":8080,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP_Connect","breed":"Acceptable","category":"Web"}} +00581{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1631454722867,"flow_last_seen":1631454722867,"flow_idle_time":180000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":1631454722867,"l3_proto":"ip4","src_ip":"192.168.1.146","dst_ip":"192.168.1.2","src_port":47767,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1631454722867,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"thread_ts_msec":1631454722867,"pkt":"AAwpGN5XAAwpTU5kCABFAABDZMpAAEARUfvAqAGSwKgBArqXADUAL4Ql9bcBAAABAAAAAAABBmFwYWNoZQNvcmcAAAEAAQAAKQIAAAAAAAAA"} +00765{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1631454722867,"flow_last_seen":1631454722867,"flow_idle_time":180000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":1631454722867,"l3_proto":"ip4","src_ip":"192.168.1.146","dst_ip":"192.168.1.2","src_port":47767,"dst_port":53,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"apache.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00512{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1631454722867,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":97,"pkt_l4_len":63,"thread_ts_msec":1631454722867,"pkt":"AAwpTU5kAAwpGN5XCABFAABTqZtAAEARDRrAqAECwKgBkgA1upcAP92U9beBgAABAAEAAAABBmFwYWNoZQNvcmcAAAEAAcAMAAEAAQAAA0oABJdlAoQAACkE0AAAAAAAAA=="} +00779{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":7,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1631454722867,"flow_last_seen":1631454722867,"flow_idle_time":180000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":55,"flow_tot_l4_payload_len":94,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":1631454722867,"l3_proto":"ip4","src_ip":"192.168.1.146","dst_ip":"192.168.1.2","src_port":47767,"dst_port":53,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"apache.org","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"151.101.2.132"}} +00581{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":8,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1631454722867,"flow_last_seen":1631454722867,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1631454722867,"l3_proto":"ip4","src_ip":"192.168.1.146","dst_ip":"151.101.2.132","src_port":35968,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":1631454722867,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1631454722867,"pkt":"ACWQX+cTAAwpTU5kCABFAAA8Fy1AAEAGx2vAqAGSl2UChIyAAbsTD57aAAAAAKAC+vBcUgAAAgQFtAQCCAoKBFeEAAAAAAEDAwc="} +00483{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":1631454722876,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1631454722876,"pkt":"AAwpTU5kACWQX+cTCABFAAA8AABAADwG4piXZQKEwKgBkgG7jICt6jOtEw+e26AS\/\/+T8gAAAgQFdAQCCAosPaiUCgRXhAEDAwk="} +00470{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_last_seen":1631454722876,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1631454722876,"pkt":"ACWQX+cTAAwpTU5kCABFAAA0Fy5AAEAGx3LAqAGSl2UChIyAAbsTD57breozroAQAfZcSgAAAQEICgoEV40sPaiU"} +00878{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":14,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1631454722867,"flow_last_seen":1631454722879,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"thread_ts_msec":1631454722879,"l3_proto":"ip4","src_ip":"192.168.1.146","dst_ip":"151.101.2.132","src_port":35968,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"apache.org","ja3":"c834494f5948ae026d160656c93c8871","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00919{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":16,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1631454722867,"flow_last_seen":1631454722895,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1384,"flow_tot_l4_payload_len":1901,"flow_avg_l4_payload_len":316,"midstream":0,"thread_ts_msec":1631454722895,"l3_proto":"ip4","src_ip":"192.168.1.146","dst_ip":"151.101.2.132","src_port":35968,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"apache.org","ja3":"c834494f5948ae026d160656c93c8871","ja3s":"f4febc55ea12b31ae17cfb7e614afda8","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00680{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":100,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1631454722867,"flow_last_seen":1631454722867,"flow_idle_time":180000,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":55,"flow_tot_l4_payload_len":94,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":1631454722977,"l3_proto":"ip4","src_ip":"192.168.1.146","dst_ip":"192.168.1.2","src_port":47767,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"DNS","breed":"Acceptable","category":"Network"}} +00680{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":100,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":58,"flow_first_seen":1631454722867,"flow_last_seen":1631454722977,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1384,"flow_tot_l4_payload_len":32652,"flow_avg_l4_payload_len":562,"midstream":0,"thread_ts_msec":1631454722977,"l3_proto":"ip4","src_ip":"192.168.1.146","dst_ip":"151.101.2.132","src_port":35968,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"}} +00695{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":100,"source":"http_connect.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":40,"flow_first_seen":1631454722864,"flow_last_seen":1631454722977,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5536,"flow_tot_l4_payload_len":24627,"flow_avg_l4_payload_len":615,"midstream":0,"thread_ts_msec":1631454722977,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.146","src_port":1714,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP_Connect","breed":"Acceptable","category":"Web"}} +00562{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":100,"source":"http_connect.pcap","alias":"nDPId-test","packets-captured":100,"packets-processed":100,"total-skipped-flows":0,"total-l4-data-len":57373,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":3,"total-detection-updates":2,"total-updates":0,"current-active-flows":0,"total-active-flows":3,"total-idle-flows":3,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":22,"global_ts_msec":1631454722977} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 100/100 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 57373 bytes +~~ total detected protocols..: 3 +~~ total active/idle flows...: 3/3 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5185256 bytes +~~ total memory freed........: 5185256 bytes +~~ total allocations/frees...: 113137/113137 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 466 chars +~~ json string max len.......: 924 chars +~~ json string avg len.......: 693 chars diff --git a/test/results/http_ipv6.pcap.out b/test/results/http_ipv6.pcap.out index 9da5a5c99..3ba94fcc0 100644 --- a/test/results/http_ipv6.pcap.out +++ b/test/results/http_ipv6.pcap.out @@ -104,9 +104,9 @@ ~~ total active/idle flows...: 15/15 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4767544 bytes -~~ total memory freed........: 4767544 bytes -~~ total allocations/frees...: 101444/101444 +~~ total memory allocated....: 5266451 bytes +~~ total memory freed........: 5266451 bytes +~~ total allocations/frees...: 113326/113326 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 2310 chars diff --git a/test/results/iax.pcap.out b/test/results/iax.pcap.out new file mode 100644 index 000000000..c73525ec0 --- /dev/null +++ b/test/results/iax.pcap.out @@ -0,0 +1,24 @@ +00454{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"iax.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00540{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"iax.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1123840005963} +00574{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"iax.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1123840005963,"flow_last_seen":1123840005963,"flow_idle_time":180000,"flow_min_l4_payload_len":66,"flow_max_l4_payload_len":66,"flow_tot_l4_payload_len":66,"flow_avg_l4_payload_len":66,"midstream":0,"thread_ts_msec":1123840005963,"l3_proto":"ip4","src_ip":"82.110.36.84","dst_ip":"192.168.2.120","src_port":4569,"dst_port":4566,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00518{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"iax.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1123840005963,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"thread_ts_msec":1123840005963,"pkt":"AMDwli5rAOCBJ2JwCABFEABeAABAAEARAJ1SbiRUwKgCeBHZEdYASpLMgAQAAAAAAAEAAAYBCwIAAgEMNDQyMDg4MjA1MTU1Agw0NDc3ODIyNjc5NDkEAAoCZW7\/BAAAAAIMAgAAHwQLDFXW"} +00629{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"iax.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1123840005963,"flow_last_seen":1123840005963,"flow_idle_time":180000,"flow_min_l4_payload_len":66,"flow_max_l4_payload_len":66,"flow_tot_l4_payload_len":66,"flow_avg_l4_payload_len":66,"midstream":0,"thread_ts_msec":1123840005963,"l3_proto":"ip4","src_ip":"82.110.36.84","dst_ip":"192.168.2.120","src_port":4569,"dst_port":4566,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"IAX","breed":"Acceptable","category":"VoIP"}} +00443{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"iax.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1123840005966,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":1123840005966,"pkt":"AOCBJ2JwAMDwli5rCABFAAAoV7tAAEARqSfAqAJ4Um4kVBHWEdkAFBwTgBcABAAAAAEAAQYE"} +00443{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"iax.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1123840005971,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":1123840005971,"pkt":"AOCBJ2JwAMDwli5rCABFAAAoV71AAEARqSXAqAJ4Um4kVBHWEdkAFBwJgBcABAAAAAgAAQYH"} +00674{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":50,"source":"iax.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":50,"flow_first_seen":1123840005963,"flow_last_seen":1123840006489,"flow_idle_time":180000,"flow_min_l4_payload_len":12,"flow_max_l4_payload_len":172,"flow_tot_l4_payload_len":7054,"flow_avg_l4_payload_len":141,"midstream":0,"thread_ts_msec":1123840006489,"l3_proto":"ip4","src_ip":"82.110.36.84","dst_ip":"192.168.2.120","src_port":4569,"dst_port":4566,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"IAX","breed":"Acceptable","category":"VoIP"}} +00548{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":50,"source":"iax.pcap","alias":"nDPId-test","packets-captured":50,"packets-processed":50,"total-skipped-flows":0,"total-l4-data-len":7054,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1123840006489} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 50/50 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 7054 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5179867 bytes +~~ total memory freed........: 5179867 bytes +~~ total allocations/frees...: 113075/113075 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 448 chars +~~ json string max len.......: 679 chars +~~ json string avg len.......: 555 chars diff --git a/test/results/icmp-tunnel.pcap.out b/test/results/icmp-tunnel.pcap.out new file mode 100644 index 000000000..e3ab23f0c --- /dev/null +++ b/test/results/icmp-tunnel.pcap.out @@ -0,0 +1,33 @@ +00462{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"icmp-tunnel.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00548{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"icmp-tunnel.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1360227866458} +00556{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"icmp-tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1360227866459,"flow_last_seen":1360227866459,"flow_idle_time":120000,"flow_min_l4_payload_len":92,"flow_max_l4_payload_len":92,"flow_tot_l4_payload_len":92,"flow_avg_l4_payload_len":92,"midstream":0,"thread_ts_msec":1360227866459,"l3_proto":"ip4","src_ip":"192.168.154.131","dst_ip":"192.168.154.132","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3} +00550{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"icmp-tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1360227866459,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":126,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":126,"pkt_l4_len":92,"thread_ts_msec":1360227866459,"pkt":"AAwpy+OCAAwpzwzBCABFAABwAABAAEABhDTAqJqDwKiahAgAAAD+\/wAARQAAVAAAQABAASPpCl8BAQpfAQIIAFvrPQgAAS1uE1EtSQYACAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3"} +00754{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"icmp-tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1360227866459,"flow_last_seen":1360227866459,"flow_idle_time":120000,"flow_min_l4_payload_len":92,"flow_max_l4_payload_len":92,"flow_tot_l4_payload_len":92,"flow_avg_l4_payload_len":92,"midstream":0,"thread_ts_msec":1360227866459,"l3_proto":"ip4","src_ip":"192.168.154.131","dst_ip":"192.168.154.132","l4_proto":"icmp","ndpi": {"flow_risk": {"17": {"risk":"Malformed Packet","severity":"Low","risk_score": {"total":260,"client":130,"server":130}}},"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":5.703333} +00550{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"icmp-tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1360227867458,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":126,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":126,"pkt_l4_len":92,"thread_ts_msec":1360227867458,"pkt":"AAwpy+OCAAwpzwzBCABFAABwAABAAEABhDTAqJqDwKiahAgAAAD+\/wAARQAAVAAAQABAASPpCl8BAQpfAQIIAH3tPQgAAi5uE1EKRgYACAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3"} +00551{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"icmp-tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1360227868458,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":126,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":126,"pkt_l4_len":92,"thread_ts_msec":1360227868458,"pkt":"AAwpy+OCAAwpzwzBCABFAABwAABAAEABhDTAqJqDwKiahAgAAAD+\/wAARQAAVAAAQABAASPpCl8BAQpfAQIIAD\/sPQgAAy9uE1FHRgYACAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3"} +00785{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":160,"source":"icmp-tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":147,"flow_first_seen":1360227866459,"flow_last_seen":1360228057029,"flow_idle_time":120000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":852,"flow_tot_l4_payload_len":17193,"flow_avg_l4_payload_len":116,"midstream":0,"thread_ts_msec":1360228057029,"l3_proto":"ip4","src_ip":"192.168.154.131","dst_ip":"192.168.154.132","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"17": {"risk":"Malformed Packet","severity":"Low","risk_score": {"total":260,"client":130,"server":130}}},"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00786{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":214,"source":"icmp-tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":187,"flow_first_seen":1360227866459,"flow_last_seen":1360228178094,"flow_idle_time":120000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":1036,"flow_tot_l4_payload_len":30249,"flow_avg_l4_payload_len":161,"midstream":0,"thread_ts_msec":1360228178094,"l3_proto":"ip4","src_ip":"192.168.154.131","dst_ip":"192.168.154.132","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"17": {"risk":"Malformed Packet","severity":"Low","risk_score": {"total":260,"client":130,"server":130}}},"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00786{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":257,"source":"icmp-tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":220,"flow_first_seen":1360227866459,"flow_last_seen":1360228298215,"flow_idle_time":120000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":1041,"flow_tot_l4_payload_len":37116,"flow_avg_l4_payload_len":168,"midstream":0,"thread_ts_msec":1360228298215,"l3_proto":"ip4","src_ip":"192.168.154.131","dst_ip":"192.168.154.132","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"17": {"risk":"Malformed Packet","severity":"Low","risk_score": {"total":260,"client":130,"server":130}}},"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00786{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":294,"source":"icmp-tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":247,"flow_first_seen":1360227866459,"flow_last_seen":1360228422618,"flow_idle_time":120000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":1041,"flow_tot_l4_payload_len":40240,"flow_avg_l4_payload_len":162,"midstream":0,"thread_ts_msec":1360228422618,"l3_proto":"ip4","src_ip":"192.168.154.131","dst_ip":"192.168.154.132","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"17": {"risk":"Malformed Packet","severity":"Low","risk_score": {"total":260,"client":130,"server":130}}},"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00559{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":298,"source":"icmp-tunnel.pcap","alias":"nDPId-test","packets-captured":298,"packets-processed":251,"total-skipped-flows":0,"total-l4-data-len":40400,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":4,"current-active-flows":1,"total-active-flows":1,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":12,"global_ts_msec":1360228467662} +00786{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":455,"source":"icmp-tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":400,"flow_first_seen":1360227866459,"flow_last_seen":1360228543914,"flow_idle_time":120000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":1041,"flow_tot_l4_payload_len":59886,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":1360228543914,"l3_proto":"ip4","src_ip":"192.168.154.131","dst_ip":"192.168.154.132","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"17": {"risk":"Malformed Packet","severity":"Low","risk_score": {"total":260,"client":130,"server":130}}},"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00786{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":523,"source":"icmp-tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":458,"flow_first_seen":1360227866459,"flow_last_seen":1360228662467,"flow_idle_time":120000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":1041,"flow_tot_l4_payload_len":67172,"flow_avg_l4_payload_len":146,"midstream":0,"thread_ts_msec":1360228662467,"l3_proto":"ip4","src_ip":"192.168.154.131","dst_ip":"192.168.154.132","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"17": {"risk":"Malformed Packet","severity":"Low","risk_score": {"total":260,"client":130,"server":130}}},"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00786{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":547,"source":"icmp-tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":472,"flow_first_seen":1360227866459,"flow_last_seen":1360228790336,"flow_idle_time":120000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":1041,"flow_tot_l4_payload_len":67918,"flow_avg_l4_payload_len":143,"midstream":0,"thread_ts_msec":1360228790336,"l3_proto":"ip4","src_ip":"192.168.154.131","dst_ip":"192.168.154.132","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"17": {"risk":"Malformed Packet","severity":"Low","risk_score": {"total":260,"client":130,"server":130}}},"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00786{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":777,"source":"icmp-tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":688,"flow_first_seen":1360227866459,"flow_last_seen":1360228907632,"flow_idle_time":120000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":1041,"flow_tot_l4_payload_len":95960,"flow_avg_l4_payload_len":139,"midstream":0,"thread_ts_msec":1360228907632,"l3_proto":"ip4","src_ip":"192.168.154.131","dst_ip":"192.168.154.132","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"17": {"risk":"Malformed Packet","severity":"Low","risk_score": {"total":260,"client":130,"server":130}}},"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00785{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":961,"source":"icmp-tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":863,"flow_first_seen":1360227866459,"flow_last_seen":1360228988973,"flow_idle_time":120000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":1041,"flow_tot_l4_payload_len":161468,"flow_avg_l4_payload_len":187,"midstream":0,"thread_ts_msec":1360228988973,"l3_proto":"ip4","src_ip":"192.168.154.131","dst_ip":"192.168.154.132","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"17": {"risk":"Malformed Packet","severity":"Low","risk_score": {"total":260,"client":130,"server":130}}},"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00562{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":961,"source":"icmp-tunnel.pcap","alias":"nDPId-test","packets-captured":961,"packets-processed":863,"total-skipped-flows":0,"total-l4-data-len":161468,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":8,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":18,"global_ts_msec":1360228988973} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 961/863 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 161468 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5203444 bytes +~~ total memory freed........: 5203444 bytes +~~ total allocations/frees...: 113888/113888 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 467 chars +~~ json string max len.......: 791 chars +~~ json string avg len.......: 628 chars diff --git a/test/results/iec60780-5-104.pcap.out b/test/results/iec60780-5-104.pcap.out index 63d28e90d..b3fca2c74 100644 --- a/test/results/iec60780-5-104.pcap.out +++ b/test/results/iec60780-5-104.pcap.out @@ -46,9 +46,9 @@ ~~ total active/idle flows...: 6/6 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4688133 bytes -~~ total memory freed........: 4688133 bytes -~~ total allocations/frees...: 101305/101305 +~~ total memory allocated....: 5187040 bytes +~~ total memory freed........: 5187040 bytes +~~ total allocations/frees...: 113187/113187 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 470 chars ~~ json string max len.......: 698 chars diff --git a/test/results/imap-starttls.pcap.out b/test/results/imap-starttls.pcap.out index 87c19aa61..029cd0f64 100644 --- a/test/results/imap-starttls.pcap.out +++ b/test/results/imap-starttls.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682486 bytes -~~ total memory freed........: 4682486 bytes -~~ total allocations/frees...: 101176/101176 +~~ total memory allocated....: 5181393 bytes +~~ total memory freed........: 5181393 bytes +~~ total allocations/frees...: 113058/113058 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 459 chars ~~ json string max len.......: 828 chars diff --git a/test/results/imap.pcap.out b/test/results/imap.pcap.out index c5760f1ac..999447a30 100644 --- a/test/results/imap.pcap.out +++ b/test/results/imap.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682515 bytes -~~ total memory freed........: 4682515 bytes -~~ total allocations/frees...: 101177/101177 +~~ total memory allocated....: 5181422 bytes +~~ total memory freed........: 5181422 bytes +~~ total allocations/frees...: 113059/113059 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 460 chars ~~ json string max len.......: 792 chars diff --git a/test/results/imaps.pcap.out b/test/results/imaps.pcap.out index a065e0ccb..bfdd3fbfe 100644 --- a/test/results/imaps.pcap.out +++ b/test/results/imaps.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685001 bytes -~~ total memory freed........: 4685001 bytes -~~ total allocations/frees...: 101168/101168 +~~ total memory allocated....: 5183908 bytes +~~ total memory freed........: 5183908 bytes +~~ total allocations/frees...: 113050/113050 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 1217 chars diff --git a/test/results/imo.pcap.out b/test/results/imo.pcap.out new file mode 100644 index 000000000..c5a642a7a --- /dev/null +++ b/test/results/imo.pcap.out @@ -0,0 +1,30 @@ +00454{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"imo.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00540{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"imo.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1646579366752} +00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"imo.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646579366752,"flow_last_seen":1646579366752,"flow_idle_time":180000,"flow_min_l4_payload_len":200,"flow_max_l4_payload_len":200,"flow_tot_l4_payload_len":200,"flow_avg_l4_payload_len":200,"midstream":0,"thread_ts_msec":1646579366752,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"185.155.137.30","src_port":49207,"dst_port":36535,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00699{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"imo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1646579366752,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":242,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":242,"pkt_l4_len":208,"thread_ts_msec":1646579366752,"pkt":"CL6sCxdumt9Y+uvcCABFAADkB2xAAEARIpLAqAypuZuJHsA3jrcA0NESgTwOaEjDNFXzxmxamfOGor3xFD3A7FnCXNc+hJhFKrJOPpMIHUdqj1x7ZYe+fmL104ZlZ8QSGjgMDxxGQ47M5ARZG9YmBTkKmoomp0C2r5k7+UuqXgkHofa9I06kfQJKjgPnNwBdZocQSlex2Z6G1oBdByRvxIbfLnB1AU5Z2+ssSUPzcUN05190AJa8ogAW0Cie1vmNKFuiNZVeV2v82D2eARVTcN232VacWZMHJ\/PcqQx4XLqiWe9HSh0LDQkCIZoCAAAAAAA="} +00877{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"imo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1646579366752,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":371,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":371,"pkt_l4_len":337,"thread_ts_msec":1646579366752,"pkt":"CL6sCxdumt9Y+uvcCABFAAFlB21AAEARIhDAqAypuZuJHsA3jrcBUW71gkcNAABefWxEZ6P52eWWE1NsVUgX\/f\/SEU49gh0z128SrDnndBBJ7Xzv30Qrd+KJJN6jW88s97nwOxW1SXOJ19HPmvCIhrHR5EVDIS67bqqmEITlpL2AWZxihzDdfZ9+dgCuOQIy4YhI67L+NII4MlG7p6wa+Z43u8VCM7MQ94E5SdjxWl3zDFPxVycVf7KV2xCPfzi+nLVEj6bW7qHP3SW0XSDmXsZYCq\/fkVzkG6GD9VCFwOzRvPlMFOvXxrdNScJnQTp3jwA9ixJO\/EZEvZGmxF8KX1lLWK60\/AnhsK8ResfH4lG\/M+7QsKf8h+0F6\/JreyOlSKUahDlCIMAkz9CNbMMyQvDt1lT9Ujr+5G5FKQSNp7Os7CbxgGOrC+XUDj1qcRw+csAXbivPEt1405allpHSrfAa3hDWEw734vz46COasfJjrLY="} +00443{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"imo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1646579366793,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":53,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":53,"pkt_l4_len":19,"thread_ts_msec":1646579366793,"pkt":"mt9Y+uvcCL6sCxduCABFAAAnWnIAADIRHkm5m4kewKgMqY63wDcAEwOhAAkDIZoCAAAAAAA="} +00637{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"imo.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646579366752,"flow_last_seen":1646579366793,"flow_idle_time":180000,"flow_min_l4_payload_len":11,"flow_max_l4_payload_len":329,"flow_tot_l4_payload_len":540,"flow_avg_l4_payload_len":180,"midstream":0,"thread_ts_msec":1646579366793,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"185.155.137.30","src_port":49207,"dst_port":36535,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"IMO","breed":"Acceptable","category":"VoIP"}} +00573{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":19,"source":"imo.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646579366870,"flow_last_seen":1646579366870,"flow_idle_time":180000,"flow_min_l4_payload_len":1,"flow_max_l4_payload_len":1,"flow_tot_l4_payload_len":1,"flow_avg_l4_payload_len":1,"midstream":0,"thread_ts_msec":1646579366870,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"93.33.47.58","src_port":49207,"dst_port":57604,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00431{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"imo.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1646579366870,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":43,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":43,"pkt_l4_len":9,"thread_ts_msec":1646579366870,"pkt":"CL6sCxdumt9Y+uvcCABFAAAdWdFAAEARh1LAqAypXSEvOsA34QQACf3yBw=="} +00431{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"imo.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1646579366906,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":43,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":43,"pkt_l4_len":9,"thread_ts_msec":1646579366906,"pkt":"mt9Y+uvcCL6sCxduCABFAAAd07xAADYRF2ddIS86wKgMqeEEwDcACY7ydg=="} +00578{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":27,"source":"imo.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1646579366927,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":149,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":149,"pkt_l4_len":115,"thread_ts_msec":1646579366927,"pkt":"mt9Y+uvcCL6sCxduCABFAACH071AADYRFvxdIS86wKgMqeEEwDcAc11kag0AAJobOdZhqhsqD3t\/ZsLZznm6P+VojS4Ym286bkA4KafGXg3iLF\/wjB8hr6WLuR7MT5lbl5UGnsPZptwcvPKKbJmOyY4TOPC9kAo6L6kDDYE4iSyFwPlyWfdtSAheyL2rRrc\/cATh7Qs="} +00633{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":28,"source":"imo.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646579366870,"flow_last_seen":1646579366939,"flow_idle_time":180000,"flow_min_l4_payload_len":1,"flow_max_l4_payload_len":107,"flow_tot_l4_payload_len":119,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":1646579366939,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"93.33.47.58","src_port":49207,"dst_port":57604,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"IMO","breed":"Acceptable","category":"VoIP"}} +00678{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":100,"source":"imo.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":65,"flow_first_seen":1646579366870,"flow_last_seen":1646579370091,"flow_idle_time":180000,"flow_min_l4_payload_len":1,"flow_max_l4_payload_len":1052,"flow_tot_l4_payload_len":18219,"flow_avg_l4_payload_len":280,"midstream":0,"thread_ts_msec":1646579370091,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"93.33.47.58","src_port":49207,"dst_port":57604,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"IMO","breed":"Acceptable","category":"VoIP"}} +00682{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":100,"source":"imo.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":35,"flow_first_seen":1646579366752,"flow_last_seen":1646579369944,"flow_idle_time":180000,"flow_min_l4_payload_len":10,"flow_max_l4_payload_len":1224,"flow_tot_l4_payload_len":12961,"flow_avg_l4_payload_len":370,"midstream":0,"thread_ts_msec":1646579370091,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"185.155.137.30","src_port":49207,"dst_port":36535,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"IMO","breed":"Acceptable","category":"VoIP"}} +00553{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":100,"source":"imo.pcap","alias":"nDPId-test","packets-captured":100,"packets-processed":100,"total-skipped-flows":0,"total-l4-data-len":31180,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":15,"global_ts_msec":1646579370091} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 100/100 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 31180 bytes +~~ total detected protocols..: 2 +~~ total active/idle flows...: 2/2 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5182189 bytes +~~ total memory freed........: 5182189 bytes +~~ total allocations/frees...: 113128/113128 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 436 chars +~~ json string max len.......: 882 chars +~~ json string avg len.......: 658 chars diff --git a/test/results/instagram.pcap.out b/test/results/instagram.pcap.out index 9d5c22fc9..8145b2f31 100644 --- a/test/results/instagram.pcap.out +++ b/test/results/instagram.pcap.out @@ -248,9 +248,9 @@ ~~ total active/idle flows...: 38/38 ~~ total timeout flows.......: 9 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5373844 bytes -~~ total memory freed........: 5373844 bytes -~~ total allocations/frees...: 104831/104831 +~~ total memory allocated....: 5872751 bytes +~~ total memory freed........: 5872751 bytes +~~ total allocations/frees...: 116713/116713 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 2417 chars diff --git a/test/results/ip_fragmented_garbage.pcap.out b/test/results/ip_fragmented_garbage.pcap.out index 098fa1e55..03921b4c1 100644 --- a/test/results/ip_fragmented_garbage.pcap.out +++ b/test/results/ip_fragmented_garbage.pcap.out @@ -18221,9 +18221,9 @@ ~~ total active/idle flows...: 29/29 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4704767 bytes -~~ total memory freed........: 4704767 bytes -~~ total allocations/frees...: 101256/101256 +~~ total memory allocated....: 5203674 bytes +~~ total memory freed........: 5203674 bytes +~~ total allocations/frees...: 113138/113138 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 220 chars ~~ json string max len.......: 609 chars diff --git a/test/results/iphone.pcap.out b/test/results/iphone.pcap.out index 369fdb2c2..997619d8a 100644 --- a/test/results/iphone.pcap.out +++ b/test/results/iphone.pcap.out @@ -321,9 +321,9 @@ ~~ total active/idle flows...: 51/51 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4995498 bytes -~~ total memory freed........: 4995498 bytes -~~ total allocations/frees...: 102026/102026 +~~ total memory allocated....: 5494405 bytes +~~ total memory freed........: 5494405 bytes +~~ total allocations/frees...: 113908/113908 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 452 chars ~~ json string max len.......: 3629 chars diff --git a/test/results/ipp.pcap.out b/test/results/ipp.pcap.out new file mode 100644 index 000000000..a3b0a9e84 --- /dev/null +++ b/test/results/ipp.pcap.out @@ -0,0 +1,36 @@ +00454{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ipp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00540{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"ipp.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1210953938216} +00569{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"ipp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1210953938217,"flow_last_seen":1210953938217,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1210953938217,"l3_proto":"ip4","src_ip":"10.10.10.49","dst_ip":"10.10.10.251","src_port":55341,"dst_port":631,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00472{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"ipp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1210953938217,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1210953938217,"pkt":"ABJ5gGlgABtjmL82CABFAAA84QBAAEAGMHwKCgoxCgoK+9gtAnfcBg8oAAAAAKACFtBTiQAAAgQFtAQCCAoAa+4oAAAAAAEDAwc="} +00473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"ipp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1210953938217,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1210953938217,"pkt":"ABtjmL82ABJ5gGlgCABFAAA8U54AAEAG\/d4KCgr7CgoKMQJ32C21dp4B3AYPKaASFtAViwAAAgQFtAEDAwABAQgKAFjtJABr7ig="} +00460{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"ipp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1210953938217,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1210953938217,"pkt":"ABJ5gGlgABtjmL82CABFAAA04QFAAEAGMIMKCgoxCgoK+9gtAnfcBg8ptXaeAoAQAC5X7gAAAQEICgBr7isAWO0k"} +00759{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"ipp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1210953938217,"flow_last_seen":1210953938217,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":141,"flow_tot_l4_payload_len":141,"flow_avg_l4_payload_len":35,"midstream":0,"thread_ts_msec":1210953938217,"l3_proto":"ip4","src_ip":"10.10.10.49","dst_ip":"10.10.10.251","src_port":55341,"dst_port":631,"l4_proto":"tcp","ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}}},"confidence": {"4":"DPI"},"proto":"IPP.HTTP","breed":"Acceptable","category":"Web"}} +00570{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":18,"source":"ipp.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1210953938235,"flow_last_seen":1210953938235,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1210953938235,"l3_proto":"ip4","src_ip":"10.10.10.49","dst_ip":"10.10.10.251","src_port":55342,"dst_port":631,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"ipp.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1210953938235,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1210953938235,"pkt":"ABJ5gGlgABtjmL82CABFAAA8xghAAEAGS3QKCgoxCgoK+9guAnfcdyg0AAAAAKACFtA59wAAAgQFtAQCCAoAa+48AAAAAAEDAwc="} +00474{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"ipp.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1210953938235,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1210953938235,"pkt":"ABtjmL82ABJ5gGlgCABFAAA8U6wAAEAG\/dAKCgr7CgoKMQJ32C61d5gB3HcoNaASFtAB+AAAAgQFtAEDAwABAQgKAFjtJABr7jw="} +00461{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"ipp.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1210953938235,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1210953938235,"pkt":"ABJ5gGlgABtjmL82CABFAAA0xglAAEAGS3sKCgoxCgoK+9guAnfcdyg1tXeYAoAQAC5EXQAAAQEICgBr7j0AWO0k"} +00760{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":22,"source":"ipp.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1210953938235,"flow_last_seen":1210953938236,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":1210953938236,"l3_proto":"ip4","src_ip":"10.10.10.49","dst_ip":"10.10.10.251","src_port":55342,"dst_port":631,"l4_proto":"tcp","ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}}},"confidence": {"4":"DPI"},"proto":"IPP.HTTP","breed":"Acceptable","category":"Web"}} +00571{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":252,"source":"ipp.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1210953939430,"flow_last_seen":1210953939430,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1210953939430,"l3_proto":"ip4","src_ip":"10.10.10.49","dst_ip":"10.10.10.251","src_port":55343,"dst_port":631,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00475{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":252,"source":"ipp.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":1210953939430,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1210953939430,"pkt":"ABJ5gGlgABtjmL82CABFAAA8ASxAAEAGEFEKCgoxCgoK+9gvAnfdKfPLAAAAAKACFtBpAQAAAgQFtAQCCAoAa\/LnAAAAAAEDAwc="} +00475{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":254,"source":"ipp.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":1210953939431,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1210953939431,"pkt":"ABtjmL82ABJ5gGlgCABFAAA8VFQAAEAG\/SgKCgr7CgoKMQJ32C+1fm4B3SnzzKASFtBa+AAAAgQFtAEDAwABAQgKAFjtJwBr8uc="} +00462{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":255,"source":"ipp.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_last_seen":1210953939431,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1210953939431,"pkt":"ABJ5gGlgABtjmL82CABFAAA0AS1AAEAGEFgKCgoxCgoK+9gvAnfdKfPMtX5uAoAQAC6dXQAAAQEICgBr8ugAWO0n"} +00761{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":256,"source":"ipp.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1210953939430,"flow_last_seen":1210953939431,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":141,"flow_tot_l4_payload_len":141,"flow_avg_l4_payload_len":35,"midstream":0,"thread_ts_msec":1210953939431,"l3_proto":"ip4","src_ip":"10.10.10.49","dst_ip":"10.10.10.251","src_port":55343,"dst_port":631,"l4_proto":"tcp","ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}}},"confidence": {"4":"DPI"},"proto":"IPP.HTTP","breed":"Acceptable","category":"Web"}} +00800{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":279,"source":"ipp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":18,"flow_first_seen":1210953938217,"flow_last_seen":1210953938237,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":327,"flow_tot_l4_payload_len":931,"flow_avg_l4_payload_len":51,"midstream":0,"thread_ts_msec":1210953939492,"l3_proto":"ip4","src_ip":"10.10.10.49","dst_ip":"10.10.10.251","src_port":55341,"dst_port":631,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}}},"confidence": {"4":"DPI"},"proto":"IPP.HTTP","breed":"Acceptable","category":"Web"}} +00806{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":279,"source":"ipp.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":234,"flow_first_seen":1210953938235,"flow_last_seen":1210953939433,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":2896,"flow_tot_l4_payload_len":227991,"flow_avg_l4_payload_len":974,"midstream":0,"thread_ts_msec":1210953939492,"l3_proto":"ip4","src_ip":"10.10.10.49","dst_ip":"10.10.10.251","src_port":55342,"dst_port":631,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}}},"confidence": {"4":"DPI"},"proto":"IPP.HTTP","breed":"Acceptable","category":"Web"}} +00801{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":279,"source":"ipp.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":25,"flow_first_seen":1210953939430,"flow_last_seen":1210953939492,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":267,"flow_tot_l4_payload_len":1302,"flow_avg_l4_payload_len":52,"midstream":0,"thread_ts_msec":1210953939492,"l3_proto":"ip4","src_ip":"10.10.10.49","dst_ip":"10.10.10.251","src_port":55343,"dst_port":631,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}}},"confidence": {"4":"DPI"},"proto":"IPP.HTTP","breed":"Acceptable","category":"Web"}} +00554{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":279,"source":"ipp.pcap","alias":"nDPId-test","packets-captured":279,"packets-processed":277,"total-skipped-flows":0,"total-l4-data-len":230224,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":3,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":3,"total-idle-flows":3,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":21,"global_ts_msec":1210953939492} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 279/277 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 230224 bytes +~~ total detected protocols..: 3 +~~ total active/idle flows...: 3/3 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5188329 bytes +~~ total memory freed........: 5188329 bytes +~~ total allocations/frees...: 113317/113317 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 459 chars +~~ json string max len.......: 811 chars +~~ json string avg len.......: 633 chars diff --git a/test/results/ipv6_in_gtp.pcap.out b/test/results/ipv6_in_gtp.pcap.out index 250d0e430..843ef8d3a 100644 --- a/test/results/ipv6_in_gtp.pcap.out +++ b/test/results/ipv6_in_gtp.pcap.out @@ -14,9 +14,9 @@ ~~ total active/idle flows...: 0/0 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4678638 bytes -~~ total memory freed........: 4678638 bytes -~~ total allocations/frees...: 101140/101140 +~~ total memory allocated....: 5177545 bytes +~~ total memory freed........: 5177545 bytes +~~ total allocations/frees...: 113022/113022 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 193 chars ~~ json string max len.......: 555 chars diff --git a/test/results/irc.pcap.out b/test/results/irc.pcap.out index 411df93c7..8528af757 100644 --- a/test/results/irc.pcap.out +++ b/test/results/irc.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682399 bytes -~~ total memory freed........: 4682399 bytes -~~ total allocations/frees...: 101173/101173 +~~ total memory allocated....: 5181306 bytes +~~ total memory freed........: 5181306 bytes +~~ total allocations/frees...: 113055/113055 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 459 chars ~~ json string max len.......: 922 chars diff --git a/test/results/ja3_lots_of_cipher_suites.pcap.out b/test/results/ja3_lots_of_cipher_suites.pcap.out index a18bb1e96..8695c68d7 100644 --- a/test/results/ja3_lots_of_cipher_suites.pcap.out +++ b/test/results/ja3_lots_of_cipher_suites.pcap.out @@ -31,9 +31,9 @@ ~~ total active/idle flows...: 0/0 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4678638 bytes -~~ total memory freed........: 4678638 bytes -~~ total allocations/frees...: 101140/101140 +~~ total memory allocated....: 5177545 bytes +~~ total memory freed........: 5177545 bytes +~~ total allocations/frees...: 113022/113022 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 207 chars ~~ json string max len.......: 2328 chars diff --git a/test/results/ja3_lots_of_cipher_suites_2_anon.pcap.out b/test/results/ja3_lots_of_cipher_suites_2_anon.pcap.out index 074ec52a9..7a68de3e7 100644 --- a/test/results/ja3_lots_of_cipher_suites_2_anon.pcap.out +++ b/test/results/ja3_lots_of_cipher_suites_2_anon.pcap.out @@ -41,9 +41,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680293 bytes -~~ total memory freed........: 4680293 bytes -~~ total allocations/frees...: 101170/101170 +~~ total memory allocated....: 5179200 bytes +~~ total memory freed........: 5179200 bytes +~~ total allocations/frees...: 113052/113052 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 260 chars ~~ json string max len.......: 1928 chars diff --git a/test/results/jabber.pcap.out b/test/results/jabber.pcap.out new file mode 100644 index 000000000..21572cfb1 --- /dev/null +++ b/test/results/jabber.pcap.out @@ -0,0 +1,24 @@ +00457{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"jabber.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00543{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"jabber.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1504181789350} +00576{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"jabber.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1504181789350,"flow_last_seen":1504181789350,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1504181789350,"l3_proto":"ip4","src_ip":"192.168.58.1","dst_ip":"192.168.58.153","src_port":53460,"dst_port":5222,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"jabber.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1504181789350,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1504181789350,"pkt":"AAwpvhIxAFBWwAAICABFAAA0dxlAAIAGjb\/AqDoBwKg6mdDUFGaBHPlXAAAAAIACIAD5dQAAAgQFtAEDAwgBAQQC"} +00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"jabber.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1504181789365,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1504181789365,"pkt":"AFBWwAAIAAwpvhIxCABFAAA0AABAAEAGRNnAqDqZwKg6ARRm0NRyyKsUgRz5WIASchCJeAAAAgQFtAEBBAIBAwMH"} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"jabber.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1504181789366,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_msec":1504181789366,"pkt":"AAwpvhIxAFBWwAAICABFAAAodxpAAIAGjcrAqDoBwKg6mdDUFGaBHPlYcsirFVAQAQA7WwAAAAAAAAAA"} +00638{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"jabber.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1504181789350,"flow_last_seen":1504181789367,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":119,"flow_tot_l4_payload_len":141,"flow_avg_l4_payload_len":23,"midstream":0,"thread_ts_msec":1504181789367,"l3_proto":"ip4","src_ip":"192.168.58.1","dst_ip":"192.168.58.153","src_port":53460,"dst_port":5222,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"Jabber","breed":"Acceptable","category":"Web"}} +00678{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":13,"source":"jabber.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":13,"flow_first_seen":1504181789350,"flow_last_seen":1504181789418,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":119,"flow_tot_l4_payload_len":157,"flow_avg_l4_payload_len":12,"midstream":0,"thread_ts_msec":1504181789418,"l3_proto":"ip4","src_ip":"192.168.58.1","dst_ip":"192.168.58.153","src_port":53460,"dst_port":5222,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"Jabber","breed":"Acceptable","category":"Web"}} +00550{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":13,"source":"jabber.pcap","alias":"nDPId-test","packets-captured":13,"packets-processed":13,"total-skipped-flows":0,"total-l4-data-len":157,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1504181789418} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 13/13 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 157 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5180842 bytes +~~ total memory freed........: 5180842 bytes +~~ total allocations/frees...: 113039/113039 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 460 chars +~~ json string max len.......: 683 chars +~~ json string avg len.......: 560 chars diff --git a/test/results/kerberos.pcap.out b/test/results/kerberos.pcap.out index 7dc0f6ded..aeb17d6fc 100644 --- a/test/results/kerberos.pcap.out +++ b/test/results/kerberos.pcap.out @@ -198,9 +198,9 @@ ~~ total active/idle flows...: 36/36 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4763463 bytes -~~ total memory freed........: 4763463 bytes -~~ total allocations/frees...: 101350/101350 +~~ total memory allocated....: 5262370 bytes +~~ total memory freed........: 5262370 bytes +~~ total allocations/frees...: 113232/113232 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 2423 chars diff --git a/test/results/kerberos_fuzz.pcapng.out b/test/results/kerberos_fuzz.pcapng.out index 585b04a18..4fad004de 100644 --- a/test/results/kerberos_fuzz.pcapng.out +++ b/test/results/kerberos_fuzz.pcapng.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679539 bytes -~~ total memory freed........: 4679539 bytes -~~ total allocations/frees...: 101144/101144 +~~ total memory allocated....: 5178446 bytes +~~ total memory freed........: 5178446 bytes +~~ total allocations/frees...: 113026/113026 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 471 chars ~~ json string max len.......: 813 chars diff --git a/test/results/kontiki.pcap.out b/test/results/kontiki.pcap.out new file mode 100644 index 000000000..5362355ad --- /dev/null +++ b/test/results/kontiki.pcap.out @@ -0,0 +1,58 @@ +00458{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"kontiki.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00544{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"kontiki.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1213662195077} +00585{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662195077,"flow_last_seen":1213662195077,"flow_idle_time":180000,"flow_min_l4_payload_len":991,"flow_max_l4_payload_len":991,"flow_tot_l4_payload_len":991,"flow_avg_l4_payload_len":991,"midstream":0,"thread_ts_msec":1213662195077,"l3_proto":"ip4","src_ip":"10.25.32.59","dst_ip":"255.255.255.255","src_port":19948,"dst_port":19948,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +01773{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1213662195077,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1033,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1033,"pkt_l4_len":999,"thread_ts_msec":1213662195077,"pkt":"\/\/\/\/\/\/\/\/ABVYKKDoCABFAAP7D3UAACARXSoKGSA7\/\/\/\/\/03sTewD53pePD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjxaTWVzc2FnZSB0YXJnZXQ9IlpCQlAuMS5TdWJuZXRSZXF1ZXN0IiBtaW5vcj0iMjAiIHBhcmFtaGVhZGVybGVuZ3RoPSI0OTQiIHNpZ25hdHVyZT0iNE5QY0MyZTRZVGh2ZkFESUdPd2pNRFVENjl3NURpVTNsTWdZSFZCcVZGaUZKaXdTRXZ2Yit2cVVvUllHb25NdXd5c0lxWEIyZHJJNGR0aDNVR2ZSZ3lXbU9ES0JZYVVUVys1dzJRdWpYNk5ZQW5Vc3E1cGVWdnJQZ1ZJNFNqU1JhWjhkZXM3SkptU3RZRGtramVZR3hLblVsODUzZzFFSlVRZkVQVTdEY0RHQyIgc2lnbmVyPSI2UEJrWm50NHgzampVbFk2NjdXa2M5WFZESWh4YmZGbHI0VmE5UnE5WWdSZngzczhZWUw5cVp1ZXRCaXRqdytGRDU0T3hKcnF6TzBqMVlCc1YvaEFpL3d2UnlRcFVVdm52Z0pHejNVYTc5V1FXNDFURzZBTnhoWFl1TkZxRDMwZDFoakdDa1dRalhBK0Z0UFc2WFQ4UjB3NktkZk9sNjlhSHh0WG81eEIwY2I5Ij4NCjwvWk1lc3NhZ2U+DQo8WlBhcmFtU2V0Pg0KPHBhcmFtIG5hbWU9Il9fbXNnaGRyIiB0eXBlPSJtYXAiPg0KPC9wYXJhbT4NCjxwYXJhbSBuYW1lPSJtYXAiIHR5cGU9Im1hcCI+DQo8cGFyYW0gbmFtZT0ibW9pZCIgdHlwZT0ic3RyaW5nIj5hMjQ1MmI5OC02MDdkLTIzM2MtMTFkOS1jN2MyNGRmMDQxYmY8L3BhcmFtPg0KPHBhcmFtIG5hbWU9InNlbGZyZWYiIHR5cGU9Im1hcCI+DQo8cGFyYW0gbmFtZT0iYWRkciIgdHlwZT0ic3RyaW5nIj4xMC4yNS4zMi41OTwvcGFyYW0+DQo8cGFyYW0gbmFtZT0iZXh0YWRkciIgdHlwZT0ic3RyaW5nIj42NS4yMDUuMjUxLjUxPC9wYXJhbT4NCjxwYXJhbSBuYW1lPSJwb3J0IiB0eXBlPSJ1aW50Ij44MDwvcGFyYW0+DQo8cGFyYW0gbmFtZT0idWRwcG9ydCIgdHlwZT0idWludCI+MTk5NDg8L3BhcmFtPg0KPHBhcmFtIG5hbWU9InZlcnNpb24iIHR5cGU9InN0cmluZyI+djEuMjA8L3BhcmFtPg0KPC9wYXJhbT4NCjwvcGFyYW0+DQo8L1pQYXJhbVNldD4NCg=="} +00582{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662198289,"flow_last_seen":1213662198289,"flow_idle_time":180000,"flow_min_l4_payload_len":311,"flow_max_l4_payload_len":311,"flow_tot_l4_payload_len":311,"flow_avg_l4_payload_len":311,"midstream":0,"thread_ts_msec":1213662198289,"l3_proto":"ip4","src_ip":"10.25.32.59","dst_ip":"64.200.148.82","src_port":19948,"dst_port":1948,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00856{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1213662198289,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":353,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":353,"pkt_l4_len":319,"thread_ts_msec":1213662198289,"pkt":"AAAMB6wIABVYKKDoCABFAAFTD48AACARip0KGSA7QMiUUk3sB5wBPyUCAgUEALiJxyqdfRurkGvxcQAAAAHGclB+GpXQo7ilG\/X+QBPHZNzcc2Vgl8HXEWakCXkI\/uj8lmIl1eBkbhN4MvAcq86Z98N3bIP98eTWEBdQEYXavGuDSMiGARvJZed\/c1zWfWkiBQDMPgD+Ih+\/PJjSy0mU1LUYMuUE02zzTShWQfCvM2Xa9SOg6ec0xfxrP6bVssVjaXJqz1AT6v7o8NtJtnsERCco1F8aGfNVg8yXB5v\/LbWp1E2sz6l3Uqjqcfx5ZJSkZLl83RIr7uaKcsAZozQEdGaeqFqM+vh1lG8CYU5v3cUXR+iWSzTqhorAV8WhTpNJoFMNHVApj2b53cJQug6cwf67kqgCY5\/UQxlKUrAgIAb+T+C6ITKs8wNPNWZJmf3s1l4sH4nkFe9HNSIG47QjMrQ="} +00574{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662198289,"flow_last_seen":1213662198289,"flow_idle_time":180000,"flow_min_l4_payload_len":4,"flow_max_l4_payload_len":4,"flow_tot_l4_payload_len":4,"flow_avg_l4_payload_len":4,"midstream":0,"thread_ts_msec":1213662198289,"l3_proto":"ip4","src_ip":"10.25.32.59","dst_ip":"64.200.148.86","src_port":19948,"dst_port":8888,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00439{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":1213662198289,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":46,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":46,"pkt_l4_len":12,"thread_ts_msec":1213662198289,"pkt":"AAAMB6wIABVYKKDoCABFAAAgD5AAAAIRqcsKGSA7QMiUVk3sIrgADIy+AgEBAA=="} +00764{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662198289,"flow_last_seen":1213662198289,"flow_idle_time":180000,"flow_min_l4_payload_len":4,"flow_max_l4_payload_len":4,"flow_tot_l4_payload_len":4,"flow_avg_l4_payload_len":4,"midstream":0,"thread_ts_msec":1213662198289,"l3_proto":"ip4","src_ip":"10.25.32.59","dst_ip":"64.200.148.86","src_port":19948,"dst_port":8888,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Kontiki","breed":"Potentially Dangerous","category":"Media"}} +00545{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662198289,"flow_last_seen":1213662198289,"flow_idle_time":120000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"thread_ts_msec":1213662198289,"l3_proto":"ip4","src_ip":"10.25.249.14","dst_ip":"10.25.32.59","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3} +00475{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_last_seen":1213662198289,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1213662198289,"pkt":"ABVYKKDoANAreRD8CABFwAA8nDwAAP4B8kgKGfkOChkgOwsA9I8AAAAARQAAIA+QAAABEarLChkgO0DIlFZN7CK4AAyMvgIBAQA="} +00623{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662198289,"flow_last_seen":1213662198289,"flow_idle_time":120000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"thread_ts_msec":1213662198289,"l3_proto":"ip4","src_ip":"10.25.249.14","dst_ip":"10.25.32.59","l4_proto":"icmp","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":4.304229} +00719{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1213662198292,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":252,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":252,"pkt_l4_len":218,"thread_ts_msec":1213662198292,"pkt":"ABVYKKDoANAreRD8CABFAADuAABAADQRRpFAyJRSChkgOwecTewA2iL0AgUEADrI\/CCQa\/FynX0bqwAAAAEU3Ww9OKrYuWJ\/RoFyF3QkawgIztP7rZEqNEZAvKFqVsbVX6Q7o7C1GOOdgQ95sj8arDoplqug4W5ycMyrjvQQyOwCiAR\/6y2A+p1htTIZLrGyKHiEi2Jp9hwzPzovQAePahwaDoff8ISW08I83wX6VJuH0Ja\/8FiWxNnH+Ai3SlJjJhuk49id1Yw4mSXZ8jvVv5UwGXcIGiI6B0mhLZ+A10L6EpKDfeBwW1y7ll9X6Tp66XFf4oxdv3GVbO9k"} +00576{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662198298,"flow_last_seen":1213662198298,"flow_idle_time":180000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":20,"flow_tot_l4_payload_len":20,"flow_avg_l4_payload_len":20,"midstream":0,"thread_ts_msec":1213662198298,"l3_proto":"ip4","src_ip":"10.25.32.59","dst_ip":"64.200.148.88","src_port":19948,"dst_port":80,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00460{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_last_seen":1213662198298,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1213662198298,"pkt":"AAAMB6wIABVYKKDoCABFAAAwD5EAACARi7gKGSA7QMiUWE3sAFAAHNz5AgUCAE9LWIs\/euHNAAAE5AIEAQA="} +00766{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662198298,"flow_last_seen":1213662198298,"flow_idle_time":180000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":20,"flow_tot_l4_payload_len":20,"flow_avg_l4_payload_len":20,"midstream":0,"thread_ts_msec":1213662198298,"l3_proto":"ip4","src_ip":"10.25.32.59","dst_ip":"64.200.148.88","src_port":19948,"dst_port":80,"l4_proto":"udp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Kontiki","breed":"Potentially Dangerous","category":"Media"}} +00543{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662198298,"flow_last_seen":1213662198298,"flow_idle_time":120000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":1213662198298,"l3_proto":"ip4","src_ip":"10.25.32.3","dst_ip":"10.25.32.59","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3} +00471{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_last_seen":1213662198298,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":1213662198298,"pkt":"ABVYKKDoANABJAf8CABFAAA4wMIAAP8BppIKGSADChkgOwMN0aAAAAAARQAAMA+RAAAfEYy4ChkgO0DIlFhN7ABQABzc+Q=="} +00621{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662198298,"flow_last_seen":1213662198298,"flow_idle_time":120000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":1213662198298,"l3_proto":"ip4","src_ip":"10.25.32.3","dst_ip":"10.25.32.59","l4_proto":"icmp","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":4.253434} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1213662198301,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":1213662198301,"pkt":"AAAMB6wIABVYKKDoCABFAAAsD5IAACARi8EKGSA7QMiUUk3sB5wAGMoHAgQkALiJxyqdfRurkGvxcg=="} +00439{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":1213662198488,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":46,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":46,"pkt_l4_len":12,"thread_ts_msec":1213662198488,"pkt":"AAAMB6wIABVYKKDoCABFAAAgD5cAAAQRp8QKGSA7QMiUVk3sIrgADIy+AgEBAA=="} +00549{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":10,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662198488,"flow_last_seen":1213662198488,"flow_idle_time":120000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":1213662198488,"l3_proto":"ip4","src_ip":"216.168.241.157","dst_ip":"10.25.32.59","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3} +00472{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_last_seen":1213662198488,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":1213662198488,"pkt":"ABVYKKDoANAreRD8CABFwAA4pIcAAPwBJOPYqPGdChkgOwsADhsAAAAARQAAIA+XAAABEarEChkgO0DIlFZN7CK4AAx2NA=="} +00627{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":10,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662198488,"flow_last_seen":1213662198488,"flow_idle_time":120000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":1213662198488,"l3_proto":"ip4","src_ip":"216.168.241.157","dst_ip":"10.25.32.59","l4_proto":"icmp","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":4.321296} +00440{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_last_seen":1213662198700,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":46,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":46,"pkt_l4_len":12,"thread_ts_msec":1213662198700,"pkt":"AAAMB6wIABVYKKDoCABFAAAgD6YAAAYRpbUKGSA7QMiUVk3sIrgADIy+AgEBAA=="} +00546{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":12,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662198701,"flow_last_seen":1213662198701,"flow_idle_time":120000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":1213662198701,"l3_proto":"ip4","src_ip":"4.79.219.125","dst_ip":"10.25.32.59","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3} +00473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_last_seen":1213662198701,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":1213662198701,"pkt":"ABVYKKDoANAreRD8CABFwAA4\/Y8AAPoBuFQET9t9ChkgOwsADhsAAAAARQAAIA+mAAABEaq1ChkgO0DIlFZN7CK4AAx2NA=="} +00624{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":12,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662198701,"flow_last_seen":1213662198701,"flow_idle_time":120000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":1213662198701,"l3_proto":"ip4","src_ip":"4.79.219.125","dst_ip":"10.25.32.59","l4_proto":"icmp","ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"},"entropy":4.321296} +00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1173,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_last_seen":1213662200284,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1213662200284,"pkt":"AAAMB6wIABVYKKDoCABFAAAwEAgAACARi0EKGSA7QMiUWE3sAFAAHLz5AgUiAE9LWIs\/euHNAAAE5AIEAQA="} +00474{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1174,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_last_seen":1213662200285,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":1213662200285,"pkt":"ABVYKKDoANABJAf8CABFAAA4wRIAAP8BpkIKGSADChkgOwMN8aAAAAAARQAAMBAIAAAfEYxBChkgO0DIlFhN7ABQABy8+Q=="} +00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2709,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_last_seen":1213662202284,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1213662202284,"pkt":"AAAMB6wIABVYKKDoCABFAAAwEJ8AACARiqoKGSA7QMiUWE3sAFAAHLz5AgUiAE9LWIs\/euHNAAAE5AIEAQA="} +00474{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2710,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_last_seen":1213662202285,"flow_idle_time":120000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":1213662202285,"pkt":"ABVYKKDoANABJAf8CABFAAA4wVoAAP8BpfoKGSADChkgOwMN8aAAAAAARQAAMBCfAAAfEYuqChkgO0DIlFhN7ABQABy8+Q=="} +00646{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3289,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":1213662198701,"flow_last_seen":1213662198701,"flow_idle_time":120000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":1213662202883,"l3_proto":"ip4","src_ip":"4.79.219.125","dst_ip":"10.25.32.59","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00649{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3289,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":1213662198488,"flow_last_seen":1213662198488,"flow_idle_time":120000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":1213662202883,"l3_proto":"ip4","src_ip":"216.168.241.157","dst_ip":"10.25.32.59","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00821{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3289,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":3274,"flow_first_seen":1213662198289,"flow_last_seen":1213662202882,"flow_idle_time":180000,"flow_min_l4_payload_len":4,"flow_max_l4_payload_len":1241,"flow_tot_l4_payload_len":3714566,"flow_avg_l4_payload_len":1134,"midstream":0,"thread_ts_msec":1213662202883,"l3_proto":"ip4","src_ip":"10.25.32.59","dst_ip":"64.200.148.86","src_port":19948,"dst_port":8888,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Kontiki","breed":"Potentially Dangerous","category":"Media"}} +00645{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3289,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1213662198298,"flow_last_seen":1213662202883,"flow_idle_time":120000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":1213662202883,"l3_proto":"ip4","src_ip":"10.25.32.3","dst_ip":"10.25.32.59","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00646{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3289,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":1213662198289,"flow_last_seen":1213662198289,"flow_idle_time":120000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"thread_ts_msec":1213662202883,"l3_proto":"ip4","src_ip":"10.25.249.14","dst_ip":"10.25.32.59","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00604{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3289,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662195077,"flow_last_seen":1213662195077,"flow_idle_time":180000,"flow_min_l4_payload_len":991,"flow_max_l4_payload_len":991,"flow_tot_l4_payload_len":991,"flow_avg_l4_payload_len":991,"midstream":0,"thread_ts_msec":1213662202883,"l3_proto":"ip4","src_ip":"10.25.32.59","dst_ip":"255.255.255.255","src_port":19948,"dst_port":19948,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00589{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3289,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1213662195077,"flow_last_seen":1213662195077,"flow_idle_time":180000,"flow_min_l4_payload_len":991,"flow_max_l4_payload_len":991,"flow_tot_l4_payload_len":991,"flow_avg_l4_payload_len":991,"midstream":0,"thread_ts_msec":1213662202883,"l3_proto":"ip4","src_ip":"10.25.32.59","dst_ip":"255.255.255.255","src_port":19948,"dst_port":19948,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00600{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":3289,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1213662198289,"flow_last_seen":1213662198301,"flow_idle_time":180000,"flow_min_l4_payload_len":16,"flow_max_l4_payload_len":311,"flow_tot_l4_payload_len":537,"flow_avg_l4_payload_len":179,"midstream":0,"thread_ts_msec":1213662202883,"l3_proto":"ip4","src_ip":"10.25.32.59","dst_ip":"64.200.148.82","src_port":19948,"dst_port":1948,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00585{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3289,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1213662198289,"flow_last_seen":1213662198301,"flow_idle_time":180000,"flow_min_l4_payload_len":16,"flow_max_l4_payload_len":311,"flow_tot_l4_payload_len":537,"flow_avg_l4_payload_len":179,"midstream":0,"thread_ts_msec":1213662202883,"l3_proto":"ip4","src_ip":"10.25.32.59","dst_ip":"64.200.148.82","src_port":19948,"dst_port":1948,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00808{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3289,"source":"kontiki.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1213662198298,"flow_last_seen":1213662202883,"flow_idle_time":180000,"flow_min_l4_payload_len":20,"flow_max_l4_payload_len":20,"flow_tot_l4_payload_len":80,"flow_avg_l4_payload_len":20,"midstream":0,"thread_ts_msec":1213662202883,"l3_proto":"ip4","src_ip":"10.25.32.59","dst_ip":"64.200.148.88","src_port":19948,"dst_port":80,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Kontiki","breed":"Potentially Dangerous","category":"Media"}} +00562{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":3289,"source":"kontiki.pcap","alias":"nDPId-test","packets-captured":3289,"packets-processed":3289,"total-skipped-flows":0,"total-l4-data-len":3716430,"total-not-detected-flows":2,"total-guessed-flows":0,"total-detected-flows":6,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":8,"total-idle-flows":8,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":43,"global_ts_msec":1213662202883} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 3289/3289 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 3716430 bytes +~~ total detected protocols..: 6 +~~ total active/idle flows...: 8/8 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5279902 bytes +~~ total memory freed........: 5279902 bytes +~~ total allocations/frees...: 116335/116335 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 444 chars +~~ json string max len.......: 1778 chars +~~ json string avg len.......: 1110 chars diff --git a/test/results/lisp_registration.pcap.out b/test/results/lisp_registration.pcap.out new file mode 100644 index 000000000..8a3b17cdc --- /dev/null +++ b/test/results/lisp_registration.pcap.out @@ -0,0 +1,42 @@ +00468{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"lisp_registration.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00554{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"lisp_registration.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1597152685554} +00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597152685554,"flow_last_seen":1597152685554,"flow_idle_time":180000,"flow_min_l4_payload_len":88,"flow_max_l4_payload_len":88,"flow_tot_l4_payload_len":88,"flow_avg_l4_payload_len":88,"midstream":0,"thread_ts_msec":1597152685554,"l3_proto":"ip4","src_ip":"10.0.123.2","dst_ip":"10.0.123.1","src_port":4342,"dst_port":4342,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00564{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1597152685554,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"thread_ts_msec":1597152685554,"pkt":"qrvMAAEAqrvMAAIACABFwAB0AJYAAP8RsB8KAHsCCgB7ARD2EPYAYGa4MgABAWerkx+ei5dKAAEAFLdG1odgiOW+z\/RAIKtUGCaiNO0QAAAFoAEgEAAAAAABCgAAAhYWFhYABQABCgB7AtD01FgUttPjIYPJQy5LWPIAAAAAAAAAAA=="} +00640{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597152685554,"flow_last_seen":1597152685554,"flow_idle_time":180000,"flow_min_l4_payload_len":88,"flow_max_l4_payload_len":88,"flow_tot_l4_payload_len":88,"flow_avg_l4_payload_len":88,"midstream":0,"thread_ts_msec":1597152685554,"l3_proto":"ip4","src_ip":"10.0.123.2","dst_ip":"10.0.123.1","src_port":4342,"dst_port":4342,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"LISP","breed":"Acceptable","category":"Cloud"}} +00581{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1597152685555,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":142,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":142,"pkt_l4_len":108,"thread_ts_msec":1597152685555,"pkt":"qrvMAAEAqrvMAAIACABFwACAAJcAAP8RsBIKAHsCCgB7ARD2EPYAbMDFMgABAT470dH4ChLaAAEAFJgCmsMIGdOV75RgmwLw3u2YWic1AAAFoAGAEAAAAAAC\/AAAAAAAAAAAAAAAAAAAAhYWFhYABQABCgB7AtD01FgUttPjIYPJQy5LWPIAAAAAAAAAAA=="} +00580{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1597152685555,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":142,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":142,"pkt_l4_len":108,"thread_ts_msec":1597152685555,"pkt":"qrvMAAEAqrvMAAIACABFwACAAJgAAP8RsBEKAHsCCgB7ARD2EPYAbFMcMgABAecEMPyhgJYjAAEAFLR7gLhELdB05V0IZvC04Du3TwxeAAAFoAEaEAAAAEADAAACIAAKAAAAZAABwKhmABYWFhYABQABCgB7AtD01FgUttPjIYPJQy5LWPIAAAAAAAAAAA=="} +00581{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":9,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597152687289,"flow_last_seen":1597152687289,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1597152687289,"l3_proto":"ip4","src_ip":"10.0.123.2","dst_ip":"10.0.123.1","src_port":15373,"dst_port":4342,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1597152687289,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"thread_ts_msec":1597152687289,"pkt":"qrvMAAEAqrvMAAIACABFwAAs6QkAAP8Gx\/4KAHsCCgB7ATwNEPYND3HOAAAAAGACQACCQgAAAgQFtAAA"} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1597152687290,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"thread_ts_msec":1597152687290,"pkt":"qrvMAAIAqrvMAAEACABFwAAszvYAAP8G4hEKAHsBCgB7AhD2PA22haFWDQ9xz2ASQAAqVQAAAgQFtAAA"} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1597152687291,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_msec":1597152687291,"pkt":"qrvMAAEAqrvMAAIACABFwAAo6QoAAP8GyAEKAHsCCgB7ATwNEPYND3HPtoWhV1AQQABCEgAAAAAAAAAA"} +00641{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":12,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1597152687289,"flow_last_seen":1597152687436,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":15,"flow_tot_l4_payload_len":15,"flow_avg_l4_payload_len":3,"midstream":0,"thread_ts_msec":1597152687436,"l3_proto":"ip4","src_ip":"10.0.123.2","dst_ip":"10.0.123.1","src_port":15373,"dst_port":4342,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"LISP","breed":"Acceptable","category":"Cloud"}} +00588{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":16,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597152709936,"flow_last_seen":1597152709936,"flow_idle_time":180000,"flow_min_l4_payload_len":116,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":116,"flow_avg_l4_payload_len":116,"midstream":0,"thread_ts_msec":1597152709936,"l3_proto":"ip4","src_ip":"10.0.123.3","dst_ip":"10.0.123.1","src_port":4342,"dst_port":4342,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00601{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":1597152709936,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":158,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":158,"pkt_l4_len":124,"thread_ts_msec":1597152709936,"pkt":"qrvMAAEAqrvMAAMACABFwACQAEwAAP8RsEwKAHsDCgB7ARD2EPYAfBP6MgABAnsDNrGOEKjEAAEAFGka+80ImORwcY2JmGWtrFsZgmcCAAAFoAEaEAAAAAABwKhnAP8hISEABQABCgB7AwAABaABIBAAAAAAAQoAAAMhISEhAAUAAQoAewNZ6z+5+pkdP+8AUonJfzt9AAAAAAAAAAA="} +00645{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":16,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597152709936,"flow_last_seen":1597152709936,"flow_idle_time":180000,"flow_min_l4_payload_len":116,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":116,"flow_avg_l4_payload_len":116,"midstream":0,"thread_ts_msec":1597152709936,"l3_proto":"ip4","src_ip":"10.0.123.3","dst_ip":"10.0.123.1","src_port":4342,"dst_port":4342,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"LISP","breed":"Acceptable","category":"Cloud"}} +00634{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":1597152709936,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":182,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":182,"pkt_l4_len":148,"thread_ts_msec":1597152709936,"pkt":"qrvMAAEAqrvMAAMACABFwACoAE0AAP8RsDMKAHsDCgB7ARD2EPYAlFlmMgABAqopDMUFFm31AAEAFBocdBgtY+Hz9Ueh9UZxQJ1vv2IjAAAFoAFAEAAAAAAC\/AABkgFoAQMAAAAAAAAAAP8hISEABQABCgB7AwAABaABgBAAAAAAAvwAAAAAAAAAAAAAAAAAAAMhISEhAAUAAQoAewNZ6z+5+pkdP+8AUonJfzt9AAAAAAAAAAA="} +00583{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_last_seen":1597152709936,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":142,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":142,"pkt_l4_len":108,"thread_ts_msec":1597152709936,"pkt":"qrvMAAEAqrvMAAMACABFwACAAE4AAP8RsFoKAHsDCgB7ARD2EPYAbDmBMgABAXFyKntOHooaAAEAFI0ikSo37n3NSMdaLlvkb41n5QfMAAAFoAEaEAAAAEADAAACIAAKAAAAZAABwKhnACEhISEABQABCgB7A1nrP7n6mR0\/7wBSicl\/O30AAAAAAAAAAA=="} +00582{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":24,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597152711673,"flow_last_seen":1597152711673,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1597152711673,"l3_proto":"ip4","src_ip":"10.0.123.3","dst_ip":"10.0.123.1","src_port":52995,"dst_port":4342,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_last_seen":1597152711673,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"thread_ts_msec":1597152711673,"pkt":"qrvMAAEAqrvMAAMACABFwAAsuMMAAP8G+EMKAHsDCgB7Ac8DEPZkcBpBAAAAAGACQADvdgAAAgQFtAAA"} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":25,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_last_seen":1597152711674,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"thread_ts_msec":1597152711674,"pkt":"qrvMAAMAqrvMAAEACABFwAAsBk8AAP8GqrgKAHsBCgB7AxD2zwMtqeWdZHAaQmASQADcHgAAAgQFtAAA"} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":26,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":3,"flow_last_seen":1597152711674,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_msec":1597152711674,"pkt":"qrvMAAEAqrvMAAMACABFwAAouMQAAP8G+EYKAHsDCgB7Ac8DEPZkcBpCLanlnlAQQADz2wAAAAAAAAAA"} +00641{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":27,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1597152711673,"flow_last_seen":1597152711820,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":15,"flow_tot_l4_payload_len":15,"flow_avg_l4_payload_len":3,"midstream":0,"thread_ts_msec":1597152711820,"l3_proto":"ip4","src_ip":"10.0.123.3","dst_ip":"10.0.123.1","src_port":52995,"dst_port":4342,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"LISP","breed":"Acceptable","category":"Cloud"}} +00685{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":30,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":1597152711673,"flow_last_seen":1597152712034,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":660,"flow_tot_l4_payload_len":1207,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1597152712034,"l3_proto":"ip4","src_ip":"10.0.123.3","dst_ip":"10.0.123.1","src_port":52995,"dst_port":4342,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LISP","breed":"Acceptable","category":"Cloud"}} +00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":30,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":1597152709936,"flow_last_seen":1597152709943,"flow_idle_time":180000,"flow_min_l4_payload_len":88,"flow_max_l4_payload_len":140,"flow_tot_l4_payload_len":868,"flow_avg_l4_payload_len":108,"midstream":0,"thread_ts_msec":1597152712034,"l3_proto":"ip4","src_ip":"10.0.123.3","dst_ip":"10.0.123.1","src_port":4342,"dst_port":4342,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LISP","breed":"Acceptable","category":"Cloud"}} +00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":30,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":1597152685554,"flow_last_seen":1597152685560,"flow_idle_time":180000,"flow_min_l4_payload_len":88,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":800,"flow_avg_l4_payload_len":100,"midstream":0,"thread_ts_msec":1597152712034,"l3_proto":"ip4","src_ip":"10.0.123.2","dst_ip":"10.0.123.1","src_port":4342,"dst_port":4342,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LISP","breed":"Acceptable","category":"Cloud"}} +00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":30,"source":"lisp_registration.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":1597152687289,"flow_last_seen":1597152687645,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":452,"flow_tot_l4_payload_len":915,"flow_avg_l4_payload_len":130,"midstream":0,"thread_ts_msec":1597152712034,"l3_proto":"ip4","src_ip":"10.0.123.2","dst_ip":"10.0.123.1","src_port":15373,"dst_port":4342,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"LISP","breed":"Acceptable","category":"Cloud"}} +00563{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":30,"source":"lisp_registration.pcap","alias":"nDPId-test","packets-captured":30,"packets-processed":30,"total-skipped-flows":0,"total-l4-data-len":3790,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":4,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":4,"total-idle-flows":4,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":27,"global_ts_msec":1597152712034} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 30/30 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 3790 bytes +~~ total detected protocols..: 4 +~~ total active/idle flows...: 4/4 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5185999 bytes +~~ total memory freed........: 5185999 bytes +~~ total allocations/frees...: 113066/113066 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 472 chars +~~ json string max len.......: 690 chars +~~ json string avg len.......: 580 chars diff --git a/test/results/log4j-webapp-exploit.pcap.out b/test/results/log4j-webapp-exploit.pcap.out index e6836ff4a..0b1bcbdb7 100644 --- a/test/results/log4j-webapp-exploit.pcap.out +++ b/test/results/log4j-webapp-exploit.pcap.out @@ -60,9 +60,9 @@ ~~ total active/idle flows...: 7/7 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4703360 bytes -~~ total memory freed........: 4703360 bytes -~~ total allocations/frees...: 101596/101596 +~~ total memory allocated....: 5202267 bytes +~~ total memory freed........: 5202267 bytes +~~ total allocations/frees...: 113478/113478 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 201 chars ~~ json string max len.......: 1065 chars diff --git a/test/results/long_tls_certificate.pcap.out b/test/results/long_tls_certificate.pcap.out index 495b4aa7d..52b5f4a85 100644 --- a/test/results/long_tls_certificate.pcap.out +++ b/test/results/long_tls_certificate.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5078141 bytes -~~ total memory freed........: 5078141 bytes -~~ total allocations/frees...: 101383/101383 +~~ total memory allocated....: 5577048 bytes +~~ total memory freed........: 5577048 bytes +~~ total allocations/frees...: 113265/113265 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 468 chars ~~ json string max len.......: 5070 chars diff --git a/test/results/malformed_dns.pcap.out b/test/results/malformed_dns.pcap.out index 007327bfb..462981e08 100644 --- a/test/results/malformed_dns.pcap.out +++ b/test/results/malformed_dns.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679684 bytes -~~ total memory freed........: 4679684 bytes -~~ total allocations/frees...: 101149/101149 +~~ total memory allocated....: 5178591 bytes +~~ total memory freed........: 5178591 bytes +~~ total allocations/frees...: 113031/113031 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 2655 chars diff --git a/test/results/malformed_icmp.pcap.out b/test/results/malformed_icmp.pcap.out index a1b914b76..72058c354 100644 --- a/test/results/malformed_icmp.pcap.out +++ b/test/results/malformed_icmp.pcap.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679539 bytes -~~ total memory freed........: 4679539 bytes -~~ total allocations/frees...: 101144/101144 +~~ total memory allocated....: 5178446 bytes +~~ total memory freed........: 5178446 bytes +~~ total allocations/frees...: 113026/113026 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 443 chars ~~ json string max len.......: 777 chars diff --git a/test/results/malware.pcap.out b/test/results/malware.pcap.out index 0fb5b89d3..fc83fd32f 100644 --- a/test/results/malware.pcap.out +++ b/test/results/malware.pcap.out @@ -37,9 +37,9 @@ ~~ total active/idle flows...: 5/5 ~~ total timeout flows.......: 1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4722968 bytes -~~ total memory freed........: 4722968 bytes -~~ total allocations/frees...: 101243/101243 +~~ total memory allocated....: 5221875 bytes +~~ total memory freed........: 5221875 bytes +~~ total allocations/frees...: 113125/113125 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 453 chars ~~ json string max len.......: 2474 chars diff --git a/test/results/memcached.cap.out b/test/results/memcached.cap.out index b441c3f0e..cde2a1be1 100644 --- a/test/results/memcached.cap.out +++ b/test/results/memcached.cap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681848 bytes -~~ total memory freed........: 4681848 bytes -~~ total allocations/frees...: 101154/101154 +~~ total memory allocated....: 5180755 bytes +~~ total memory freed........: 5180755 bytes +~~ total allocations/frees...: 113036/113036 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 688 chars diff --git a/test/results/modbus.pcap.out b/test/results/modbus.pcap.out index 4894e7fe4..9f4ed20ff 100644 --- a/test/results/modbus.pcap.out +++ b/test/results/modbus.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682468 bytes -~~ total memory freed........: 4682468 bytes -~~ total allocations/frees...: 101245/101245 +~~ total memory allocated....: 5181375 bytes +~~ total memory freed........: 5181375 bytes +~~ total allocations/frees...: 113127/113127 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 695 chars diff --git a/test/results/monero.pcap.out b/test/results/monero.pcap.out index 127030361..ebc3ac7f9 100644 --- a/test/results/monero.pcap.out +++ b/test/results/monero.pcap.out @@ -22,9 +22,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4701937 bytes -~~ total memory freed........: 4701937 bytes -~~ total allocations/frees...: 101469/101469 +~~ total memory allocated....: 5200844 bytes +~~ total memory freed........: 5200844 bytes +~~ total allocations/frees...: 113351/113351 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 454 chars ~~ json string max len.......: 934 chars diff --git a/test/results/mongodb.pcap.out b/test/results/mongodb.pcap.out index bca00b519..9ecdab15d 100644 --- a/test/results/mongodb.pcap.out +++ b/test/results/mongodb.pcap.out @@ -43,9 +43,9 @@ ~~ total active/idle flows...: 5/5 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685829 bytes -~~ total memory freed........: 4685829 bytes -~~ total allocations/frees...: 101183/101183 +~~ total memory allocated....: 5184736 bytes +~~ total memory freed........: 5184736 bytes +~~ total allocations/frees...: 113065/113065 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 825 chars diff --git a/test/results/mpeg.pcap.out b/test/results/mpeg.pcap.out index db2e21e13..a1de04be9 100644 --- a/test/results/mpeg.pcap.out +++ b/test/results/mpeg.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680119 bytes -~~ total memory freed........: 4680119 bytes -~~ total allocations/frees...: 101165/101165 +~~ total memory allocated....: 5179026 bytes +~~ total memory freed........: 5179026 bytes +~~ total allocations/frees...: 113047/113047 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 460 chars ~~ json string max len.......: 800 chars diff --git a/test/results/mpegts.pcap.out b/test/results/mpegts.pcap.out index 4738f647d..e5457364b 100644 --- a/test/results/mpegts.pcap.out +++ b/test/results/mpegts.pcap.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679539 bytes -~~ total memory freed........: 4679539 bytes -~~ total allocations/frees...: 101144/101144 +~~ total memory allocated....: 5178446 bytes +~~ total memory freed........: 5178446 bytes +~~ total allocations/frees...: 113026/113026 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 2722 chars diff --git a/test/results/mqtt.pcap.out b/test/results/mqtt.pcap.out index ba797292c..dbc2d465a 100644 --- a/test/results/mqtt.pcap.out +++ b/test/results/mqtt.pcap.out @@ -19,9 +19,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680643 bytes -~~ total memory freed........: 4680643 bytes -~~ total allocations/frees...: 101155/101155 +~~ total memory allocated....: 5179550 bytes +~~ total memory freed........: 5179550 bytes +~~ total allocations/frees...: 113037/113037 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 460 chars ~~ json string max len.......: 857 chars diff --git a/test/results/mssql_tds.pcap.out b/test/results/mssql_tds.pcap.out index 46279b24e..1bd8f44eb 100644 --- a/test/results/mssql_tds.pcap.out +++ b/test/results/mssql_tds.pcap.out @@ -66,9 +66,9 @@ ~~ total active/idle flows...: 12/12 ~~ total timeout flows.......: 1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4729037 bytes -~~ total memory freed........: 4729037 bytes -~~ total allocations/frees...: 101221/101221 +~~ total memory allocated....: 5227944 bytes +~~ total memory freed........: 5227944 bytes +~~ total allocations/frees...: 113103/113103 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 2417 chars diff --git a/test/results/mysql-8.pcap.out b/test/results/mysql-8.pcap.out index 68074069e..077c47f43 100644 --- a/test/results/mysql-8.pcap.out +++ b/test/results/mysql-8.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679626 bytes -~~ total memory freed........: 4679626 bytes -~~ total allocations/frees...: 101147/101147 +~~ total memory allocated....: 5178533 bytes +~~ total memory freed........: 5178533 bytes +~~ total allocations/frees...: 113029/113029 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 680 chars diff --git a/test/results/nats.pcap.out b/test/results/nats.pcap.out index b89bba8be..d1384697a 100644 --- a/test/results/nats.pcap.out +++ b/test/results/nats.pcap.out @@ -21,9 +21,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685261 bytes -~~ total memory freed........: 4685261 bytes -~~ total allocations/frees...: 101175/101175 +~~ total memory allocated....: 5184168 bytes +~~ total memory freed........: 5184168 bytes +~~ total allocations/frees...: 113057/113057 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 455 chars ~~ json string max len.......: 672 chars diff --git a/test/results/ndpi_match_string_subprotocol__error.pcapng.out b/test/results/ndpi_match_string_subprotocol__error.pcapng.out index f907e5cf7..68bcaed3b 100644 --- a/test/results/ndpi_match_string_subprotocol__error.pcapng.out +++ b/test/results/ndpi_match_string_subprotocol__error.pcapng.out @@ -18,9 +18,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679978 bytes -~~ total memory freed........: 4679978 bytes -~~ total allocations/frees...: 101159/101159 +~~ total memory allocated....: 5178885 bytes +~~ total memory freed........: 5178885 bytes +~~ total allocations/frees...: 113041/113041 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 239 chars ~~ json string max len.......: 1994 chars diff --git a/test/results/nest_log_sink.pcap.out b/test/results/nest_log_sink.pcap.out index 03fc9e46c..dca86b4a2 100644 --- a/test/results/nest_log_sink.pcap.out +++ b/test/results/nest_log_sink.pcap.out @@ -126,9 +126,9 @@ ~~ total active/idle flows...: 17/17 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4740484 bytes -~~ total memory freed........: 4740484 bytes -~~ total allocations/frees...: 101977/101977 +~~ total memory allocated....: 5239391 bytes +~~ total memory freed........: 5239391 bytes +~~ total allocations/frees...: 113859/113859 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 805 chars diff --git a/test/results/netbios.pcap.out b/test/results/netbios.pcap.out index 7824198fd..2d8334714 100644 --- a/test/results/netbios.pcap.out +++ b/test/results/netbios.pcap.out @@ -79,9 +79,9 @@ ~~ total active/idle flows...: 15/15 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4701306 bytes -~~ total memory freed........: 4701306 bytes -~~ total allocations/frees...: 101446/101446 +~~ total memory allocated....: 5200213 bytes +~~ total memory freed........: 5200213 bytes +~~ total allocations/frees...: 113328/113328 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 806 chars diff --git a/test/results/netbios_wildcard_dns_query.pcap.out b/test/results/netbios_wildcard_dns_query.pcap.out index e4335520d..76b46c271 100644 --- a/test/results/netbios_wildcard_dns_query.pcap.out +++ b/test/results/netbios_wildcard_dns_query.pcap.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679539 bytes -~~ total memory freed........: 4679539 bytes -~~ total allocations/frees...: 101144/101144 +~~ total memory allocated....: 5178446 bytes +~~ total memory freed........: 5178446 bytes +~~ total allocations/frees...: 113026/113026 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 482 chars ~~ json string max len.......: 804 chars diff --git a/test/results/netflix.pcap.out b/test/results/netflix.pcap.out index 7d1f1def0..fff0a0188 100644 --- a/test/results/netflix.pcap.out +++ b/test/results/netflix.pcap.out @@ -414,9 +414,9 @@ ~~ total active/idle flows...: 61/61 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5036710 bytes -~~ total memory freed........: 5036710 bytes -~~ total allocations/frees...: 108532/108532 +~~ total memory allocated....: 5535617 bytes +~~ total memory freed........: 5535617 bytes +~~ total allocations/frees...: 120414/120414 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 1482 chars diff --git a/test/results/netflow-fritz.pcap.out b/test/results/netflow-fritz.pcap.out index c49fb2f0f..cc96b7f39 100644 --- a/test/results/netflow-fritz.pcap.out +++ b/test/results/netflow-fritz.pcap.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679539 bytes -~~ total memory freed........: 4679539 bytes -~~ total allocations/frees...: 101144/101144 +~~ total memory allocated....: 5178446 bytes +~~ total memory freed........: 5178446 bytes +~~ total allocations/frees...: 113026/113026 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 693 chars diff --git a/test/results/netflowv9.pcap.out b/test/results/netflowv9.pcap.out index 13f6d18e2..caf1405a7 100644 --- a/test/results/netflowv9.pcap.out +++ b/test/results/netflowv9.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679800 bytes -~~ total memory freed........: 4679800 bytes -~~ total allocations/frees...: 101153/101153 +~~ total memory allocated....: 5178707 bytes +~~ total memory freed........: 5178707 bytes +~~ total allocations/frees...: 113035/113035 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 2303 chars diff --git a/test/results/nfsv2.pcap.out b/test/results/nfsv2.pcap.out new file mode 100644 index 000000000..330ef5e5e --- /dev/null +++ b/test/results/nfsv2.pcap.out @@ -0,0 +1,54 @@ +00456{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"nfsv2.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00541{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"nfsv2.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":944207338400} +00571{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207338400,"flow_last_seen":944207338400,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":944207338400,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3289,"dst_port":111,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00517{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":944207338400,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"thread_ts_msec":944207338400,"pkt":"AMCV+E3TAMCV4Bm+CABFAABcZMIAAEAR0zSLGRYCixkWZgzZAG8ASG3iOEEWnwAAAAAAAAACAAGGoAAAAAMAAAADAAAAAAAAAAAAAAAAAAAAAAABhqUAAAABAAAAA3VkcAAAAAAAAAAAAA=="} +00774{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207338400,"flow_last_seen":944207338400,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":944207338400,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3289,"dst_port":111,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00491{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":944207338410,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"thread_ts_msec":944207338410,"pkt":"AMCV4Bm+AMCV+E3TCABFAABMjjQAAEARqdKLGRZmixkWAgBvDNkAOJnwOEEWnwAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAEjEzOS4yNS4yMi4xMDIuNC4yNAAA"} +00575{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207338410,"flow_last_seen":944207338410,"flow_idle_time":180000,"flow_min_l4_payload_len":116,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":116,"flow_avg_l4_payload_len":116,"midstream":0,"thread_ts_msec":944207338410,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":671,"dst_port":1048,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00586{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":944207338410,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":158,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":158,"pkt_l4_len":124,"thread_ts_msec":944207338410,"pkt":"AMCV+E3TAMCV4Bm+CABFAACQZMMAAEAR0v+LGRYCixkWZgKfBBgAfBoVOEEWnwAAAAAAAAACAAGGpQAAAAEAAAABAAAAAQAAADQ4R3XQAAAACXdlcnJtc2NoZQAAAAAAAAAAAAABAAAABQAAAAEAAAAAAAAAAgAAAAMAAAARAAAAAAAAAAAAAAAUL2hvbWUvZ2lybGljaC9leHBvcnQ="} +00778{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207338410,"flow_last_seen":944207338410,"flow_idle_time":180000,"flow_min_l4_payload_len":116,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":116,"flow_avg_l4_payload_len":116,"midstream":0,"thread_ts_msec":944207338410,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":671,"dst_port":1048,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00509{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":944207338430,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":102,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":102,"pkt_l4_len":68,"thread_ts_msec":944207338430,"pkt":"AMCV4Bm+AMCV+E3TCABFAABYjkAAAEARqbqLGRZmixkWAgQYAp8ARO2bOEEWnwAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAQEIUAAAPnAAoAAAAAsloAAAApAAoAAAAAsloAAAAp"} +00571{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207338440,"flow_last_seen":944207338440,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":944207338440,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3291,"dst_port":111,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00517{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":944207338440,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"thread_ts_msec":944207338440,"pkt":"AMCV+E3TAMCV4Bm+CABFAABcZMQAAEAR0zKLGRYCixkWZgzbAG8ASNmgOEGq3wAAAAAAAAACAAGGoAAAAAMAAAADAAAAAAAAAAAAAAAAAAAAAAABhqMAAAACAAAAA3VkcAAAAAAAAAAAAA=="} +00774{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":5,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207338440,"flow_last_seen":944207338440,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":944207338440,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3291,"dst_port":111,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00491{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":944207338450,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"thread_ts_msec":944207338450,"pkt":"AMCV4Bm+AMCV+E3TCABFAABMjkcAAEARqb+LGRZmixkWAgBvDNsAOALjOEGq3wAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAETEzOS4yNS4yMi4xMDIuOC4xAAAA"} +00572{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207338450,"flow_last_seen":944207338450,"flow_idle_time":180000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"thread_ts_msec":944207338450,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3292,"dst_port":2049,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00483{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_last_seen":944207338450,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"thread_ts_msec":944207338450,"pkt":"AMCV+E3TAMCV4Bm+CABFAABEZMUAAEAR00mLGRYCixkWZgzcCAEAMD5NOEGq3wAAAAAAAAACAAGGowAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00635{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207338450,"flow_last_seen":944207338450,"flow_idle_time":180000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"thread_ts_msec":944207338450,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3292,"dst_port":2049,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00459{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_last_seen":944207338450,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":944207338450,"pkt":"AMCV4Bm+AMCV+E3TCABFAAA0jkkAAP8R6tSLGRZmixkWAggBDNwAIMUUOEGq3wAAAAEAAAAAAAAAAAAAAAAAAAAA"} +00576{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":9,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207338490,"flow_last_seen":944207338490,"flow_idle_time":180000,"flow_min_l4_payload_len":124,"flow_max_l4_payload_len":124,"flow_tot_l4_payload_len":124,"flow_avg_l4_payload_len":124,"midstream":0,"thread_ts_msec":944207338490,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":1023,"dst_port":2049,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00600{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_last_seen":944207338490,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":166,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":166,"pkt_l4_len":132,"thread_ts_msec":944207338490,"pkt":"AMCV+E3TAMCV4Bm+CABFAACYZMYAAP8RE\/SLGRYCixkWZgP\/CAEAhHgyXh0LlAAAAAAAAAACAAGGowAAAAIAAAABAAAAAQAAADQ4R3XQAAAACXdlcnJtc2NoZQAAAAAAAAAAAAABAAAABQAAAAEAAAAAAAAAAgAAAAMAAAARAAAAAAAAAAAAEBCFAAAD5wAKAAAAALJaAAAAKQAKAAAAALJaAAAAKQ=="} +00639{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":9,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207338490,"flow_last_seen":944207338490,"flow_idle_time":180000,"flow_min_l4_payload_len":124,"flow_max_l4_payload_len":124,"flow_tot_l4_payload_len":124,"flow_avg_l4_payload_len":124,"midstream":0,"thread_ts_msec":944207338490,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":1023,"dst_port":2049,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00560{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_last_seen":944207338490,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"thread_ts_msec":944207338490,"pkt":"AMCV4Bm+AMCV+E3TCABFAAB8jl8AAP8R6naLGRZmixkWAggBA\/8AaNSdXh0LlAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAEHtAAAAAgAAAAAAAAABAAAAYAAAQAAAAAAAAAAAAAAQEIUAALJaOEd1QgAFMCA4R3VCAAd6EDhHdUIAB3oQ"} +00601{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_last_seen":944207338490,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":166,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":166,"pkt_l4_len":132,"thread_ts_msec":944207338490,"pkt":"AMCV+E3TAMCV4Bm+CABFAACYZMcAAP8RE\/OLGRYCixkWZgP\/CAEAhHghXh0LlQAAAAAAAAACAAGGowAAAAIAAAARAAAAAQAAADQ4R3XQAAAACXdlcnJtc2NoZQAAAAAAAAAAAAABAAAABQAAAAEAAAAAAAAAAgAAAAMAAAARAAAAAAAAAAAAEBCFAAAD5wAKAAAAALJaAAAAKQAKAAAAALJaAAAAKQ=="} +00573{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":153,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207338880,"flow_last_seen":944207338880,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":944207338880,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3293,"dst_port":111,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00519{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":153,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_last_seen":944207338880,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"thread_ts_msec":944207338880,"pkt":"AMCV+E3TAMCV4Bm+CABFAABcZRAAAEAR0uaLGRYCixkWZgzdAG8ASKDlOErjjgAAAAAAAAACAAGGoAAAAAMAAAADAAAAAAAAAAAAAAAAAAAAAAABhqUAAAABAAAAA3VkcAAAAAAAAAAAAA=="} +00776{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":153,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207338880,"flow_last_seen":944207338880,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":944207338880,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3293,"dst_port":111,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00493{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":154,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_last_seen":944207338890,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"thread_ts_msec":944207338890,"pkt":"AMCV4Bm+AMCV+E3TCABFAABMj1sAAEARqKuLGRZmixkWAgBvDN0AOMzzOErjjgAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAEjEzOS4yNS4yMi4xMDIuNC4yNAAA"} +00577{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":155,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207338890,"flow_last_seen":944207338890,"flow_idle_time":180000,"flow_min_l4_payload_len":116,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":116,"flow_avg_l4_payload_len":116,"midstream":0,"thread_ts_msec":944207338890,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":686,"dst_port":1048,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00588{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":155,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_last_seen":944207338890,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":158,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":158,"pkt_l4_len":124,"thread_ts_msec":944207338890,"pkt":"AMCV+E3TAMCV4Bm+CABFAACQZRIAAEAR0rCLGRYCixkWZgKuBBgAfE0LOErjjgAAAAAAAAACAAGGpQAAAAEAAAADAAAAAQAAADQ4R3XQAAAACXdlcnJtc2NoZQAAAAAAAAAAAAABAAAABQAAAAEAAAAAAAAAAgAAAAMAAAARAAAAAAAAAAAAAAAUL2hvbWUvZ2lybGljaC9leHBvcnQ="} +00780{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":155,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207338890,"flow_last_seen":944207338890,"flow_idle_time":180000,"flow_min_l4_payload_len":116,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":116,"flow_avg_l4_payload_len":116,"midstream":0,"thread_ts_msec":944207338890,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":686,"dst_port":1048,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00461{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":156,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_last_seen":944207338890,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":944207338890,"pkt":"AMCV4Bm+AMCV+E3TCABFAAA0j18AAEARqL+LGRZmixkWAgQYAq4AIJpzOErjjgAAAAEAAAAAAAAAAAAAAAAAAAAA"} +00676{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":156,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":944207338450,"flow_last_seen":944207338450,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":944207338890,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3292,"dst_port":2049,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00816{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":156,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":944207338400,"flow_last_seen":944207338410,"flow_idle_time":180000,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":56,"midstream":0,"thread_ts_msec":944207338890,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3289,"dst_port":111,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00816{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":156,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":944207338440,"flow_last_seen":944207338450,"flow_idle_time":180000,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":56,"midstream":0,"thread_ts_msec":944207338890,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3291,"dst_port":111,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00816{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":156,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":944207338880,"flow_last_seen":944207338890,"flow_idle_time":180000,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":56,"midstream":0,"thread_ts_msec":944207338890,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3293,"dst_port":111,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00817{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":156,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":944207338410,"flow_last_seen":944207338430,"flow_idle_time":180000,"flow_min_l4_payload_len":60,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":176,"flow_avg_l4_payload_len":88,"midstream":0,"thread_ts_msec":944207338890,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":671,"dst_port":1048,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00817{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":156,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":944207338890,"flow_last_seen":944207338890,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":140,"flow_avg_l4_payload_len":70,"midstream":0,"thread_ts_msec":944207338890,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":686,"dst_port":1048,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":156,"source":"nfsv2.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"finished","flow_packets_processed":144,"flow_first_seen":944207338490,"flow_last_seen":944207338840,"flow_idle_time":180000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":172,"flow_tot_l4_payload_len":15876,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":944207338890,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":1023,"dst_port":2049,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00554{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":156,"source":"nfsv2.pcap","alias":"nDPId-test","packets-captured":156,"packets-processed":156,"total-skipped-flows":0,"total-l4-data-len":16592,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":7,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":7,"total-idle-flows":7,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":39,"global_ts_msec":944207338890} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 156/156 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 16592 bytes +~~ total detected protocols..: 7 +~~ total active/idle flows...: 7/7 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5188173 bytes +~~ total memory freed........: 5188173 bytes +~~ total allocations/frees...: 113199/113199 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 461 chars +~~ json string max len.......: 822 chars +~~ json string avg len.......: 640 chars diff --git a/test/results/nfsv3.pcap.out b/test/results/nfsv3.pcap.out new file mode 100644 index 000000000..a5b2c11b5 --- /dev/null +++ b/test/results/nfsv3.pcap.out @@ -0,0 +1,59 @@ +00456{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"nfsv3.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00541{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"nfsv3.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":944207397280} +00571{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397280,"flow_last_seen":944207397280,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":944207397280,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3295,"dst_port":111,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00517{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":944207397280,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"thread_ts_msec":944207397280,"pkt":"AMCV+E3TAMCV4Bm+CABFAABcZTwAAEAR0rqLGRYCixkWZgzfAG8ASDUOOENPaQAAAAAAAAACAAGGoAAAAAMAAAADAAAAAAAAAAAAAAAAAAAAAAABhqUAAAADAAAAA3VkcAAAAAAAAAAAAA=="} +00774{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397280,"flow_last_seen":944207397280,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":944207397280,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3295,"dst_port":111,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00491{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":944207397280,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"thread_ts_msec":944207397280,"pkt":"AMCV4Bm+AMCV+E3TCABFAABM5CwAAEARU9qLGRZmixkWAgBvDN8AOGEeOENPaQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAEjEzOS4yNS4yMi4xMDIuNC4yNAAA"} +00572{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397290,"flow_last_seen":944207397290,"flow_idle_time":180000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"thread_ts_msec":944207397290,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3296,"dst_port":1048,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00483{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":944207397290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"thread_ts_msec":944207397290,"pkt":"AMCV+E3TAMCV4Bm+CABFAABEZT0AAEAR0tGLGRYCixkWZgzgBBgAMHazOEN2WQAAAAAAAAACAAGGpQAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00775{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397290,"flow_last_seen":944207397290,"flow_idle_time":180000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"thread_ts_msec":944207397290,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3296,"dst_port":1048,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00459{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":944207397290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":944207397290,"pkt":"AMCV4Bm+AMCV+E3TCABFAAA05C8AAEARU++LGRZmixkWAgQYDOAAIP19OEN2WQAAAAEAAAAAAAAAAAAAAAAAAAAA"} +00575{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397290,"flow_last_seen":944207397290,"flow_idle_time":180000,"flow_min_l4_payload_len":116,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":116,"flow_avg_l4_payload_len":116,"midstream":0,"thread_ts_msec":944207397290,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":706,"dst_port":1048,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00586{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":944207397290,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":158,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":158,"pkt_l4_len":124,"thread_ts_msec":944207397290,"pkt":"AMCV+E3TAMCV4Bm+CABFAACQZT4AAEAR0oSLGRYCixkWZgLCBBgAfLn3OER2WQAAAAAAAAACAAGGpQAAAAMAAAABAAAAAQAAADQ4R3YLAAAACXdlcnJtc2NoZQAAAAAAAAAAAAABAAAABQAAAAEAAAAAAAAAAgAAAAMAAAARAAAAAAAAAAAAAAAUL2hvbWUvZ2lybGljaC9leHBvcnQ="} +00778{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":5,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397290,"flow_last_seen":944207397290,"flow_idle_time":180000,"flow_min_l4_payload_len":116,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":116,"flow_avg_l4_payload_len":116,"midstream":0,"thread_ts_msec":944207397290,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":706,"dst_port":1048,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00525{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":944207397310,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":114,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":114,"pkt_l4_len":80,"thread_ts_msec":944207397310,"pkt":"AMCV4Bm+AMCV+E3TCABFAABk5DcAAEARU7eLGRZmixkWAgQYAsIAUI2BOER2WQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAEBCFAAAD5wAKAAAAALJaAAAAKQAKAAAAALJaAAAAKQAAAAEAAAAB"} +00571{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397320,"flow_last_seen":944207397320,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":944207397320,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3297,"dst_port":111,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00517{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_last_seen":944207397320,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"thread_ts_msec":944207397320,"pkt":"AMCV+E3TAMCV4Bm+CABFAABcZT8AAEAR0reLGRYCixkWZgzhAG8ASKFNOEPjKQAAAAAAAAACAAGGoAAAAAMAAAADAAAAAAAAAAAAAAAAAAAAAAABhqMAAAADAAAAA3VkcAAAAAAAAAAAAA=="} +00774{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397320,"flow_last_seen":944207397320,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":944207397320,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3297,"dst_port":111,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00491{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_last_seen":944207397320,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"thread_ts_msec":944207397320,"pkt":"AMCV4Bm+AMCV+E3TCABFAABM5DsAAEARU8uLGRZmixkWAgBvDOEAOMqQOEPjKQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAETEzOS4yNS4yMi4xMDIuOC4xAAAA"} +00572{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":9,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397330,"flow_last_seen":944207397330,"flow_idle_time":180000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"thread_ts_msec":944207397330,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3298,"dst_port":2049,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00483{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_last_seen":944207397330,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"thread_ts_msec":944207397330,"pkt":"AMCV+E3TAMCV4Bm+CABFAABEZUAAAEAR0s6LGRYCixkWZgziCAEAMF8KOEOKGQAAAAAAAAACAAGGowAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00635{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":9,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397330,"flow_last_seen":944207397330,"flow_idle_time":180000,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"thread_ts_msec":944207397330,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3298,"dst_port":2049,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00460{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_last_seen":944207397330,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":944207397330,"pkt":"AMCV4Bm+AMCV+E3TCABFAAA05D0AAP8RlOCLGRZmixkWAggBDOIAIOXSOEOKGQAAAAEAAAAAAAAAAAAAAAAAAAAA"} +00577{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":11,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397400,"flow_last_seen":944207397400,"flow_idle_time":180000,"flow_min_l4_payload_len":128,"flow_max_l4_payload_len":128,"flow_tot_l4_payload_len":128,"flow_avg_l4_payload_len":128,"midstream":0,"thread_ts_msec":944207397400,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":1022,"dst_port":2049,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00603{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_last_seen":944207397400,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":170,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":170,"pkt_l4_len":136,"thread_ts_msec":944207397400,"pkt":"AMCV+E3TAMCV4Bm+CABFAACcZUEAAP8RE3WLGRYCixkWZgP+CAEAiHeHXh0L3AAAAAAAAAACAAGGowAAAAMAAAABAAAAAQAAADQ4R3YLAAAACXdlcnJtc2NoZQAAAAAAAAAAAAABAAAABQAAAAEAAAAAAAAAAgAAAAMAAAARAAAAAAAAAAAAAAAgABAQhQAAA+cACgAAAACyWgAAACkACgAAAACyWgAAACk="} +00640{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397400,"flow_last_seen":944207397400,"flow_idle_time":180000,"flow_min_l4_payload_len":128,"flow_max_l4_payload_len":128,"flow_tot_l4_payload_len":128,"flow_avg_l4_payload_len":128,"midstream":0,"thread_ts_msec":944207397400,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":1022,"dst_port":2049,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00585{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_last_seen":944207397400,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"thread_ts_msec":944207397400,"pkt":"AMCV4Bm+AMCV+E3TCABFAACM5FMAAP8RlHKLGRZmixkWAggBA\/4AeFlmXh0L3AAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAEHtAAAAAgAAAAAAAAABAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQEIUAAAAAAACyWjhHdgwUQ\/0COEd16jDgNQI4R3XqMOA1Ag=="} +00603{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_last_seen":944207397400,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":170,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":170,"pkt_l4_len":136,"thread_ts_msec":944207397400,"pkt":"AMCV+E3TAMCV4Bm+CABFAACcZUIAAP8RE3SLGRYCixkWZgP+CAEAiHd0Xh0L3QAAAAAAAAACAAGGowAAAAMAAAATAAAAAQAAADQ4R3YLAAAACXdlcnJtc2NoZQAAAAAAAAAAAAABAAAABQAAAAEAAAAAAAAAAgAAAAMAAAARAAAAAAAAAAAAAAAgABAQhQAAA+cACgAAAACyWgAAACkACgAAAACyWgAAACk="} +00573{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":125,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397740,"flow_last_seen":944207397740,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":944207397740,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3299,"dst_port":111,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00519{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":125,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_last_seen":944207397740,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"thread_ts_msec":944207397740,"pkt":"AMCV+E3TAMCV4Bm+CABFAABcZXwAAEAR0nqLGRYCixkWZgzjAG8ASDjzOExLeQAAAAAAAAACAAGGoAAAAAMAAAADAAAAAAAAAAAAAAAAAAAAAAABhqUAAAABAAAAA3VkcAAAAAAAAAAAAA=="} +00776{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":125,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397740,"flow_last_seen":944207397740,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":944207397740,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3299,"dst_port":111,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00493{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":126,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_last_seen":944207397740,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"thread_ts_msec":944207397740,"pkt":"AMCV4Bm+AMCV+E3TCABFAABM5PUAAEARUxGLGRZmixkWAgBvDOMAOGUBOExLeQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAEjEzOS4yNS4yMi4xMDIuNC4yNAAA"} +00577{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":127,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397750,"flow_last_seen":944207397750,"flow_idle_time":180000,"flow_min_l4_payload_len":116,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":116,"flow_avg_l4_payload_len":116,"midstream":0,"thread_ts_msec":944207397750,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":722,"dst_port":1048,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00588{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":127,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_last_seen":944207397750,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":158,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":158,"pkt_l4_len":124,"thread_ts_msec":944207397750,"pkt":"AMCV+E3TAMCV4Bm+CABFAACQZX4AAEAR0kSLGRYCixkWZgLSBBgAfLyvOExziQAAAAAAAAACAAGGpQAAAAEAAAADAAAAAQAAADQ4R3YLAAAACXdlcnJtc2NoZQAAAAAAAAAAAAABAAAABQAAAAEAAAAAAAAAAgAAAAMAAAARAAAAAAAAAAAAAAAUL2hvbWUvZ2lybGljaC9leHBvcnQ="} +00780{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":127,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":944207397750,"flow_last_seen":944207397750,"flow_idle_time":180000,"flow_min_l4_payload_len":116,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":116,"flow_avg_l4_payload_len":116,"midstream":0,"thread_ts_msec":944207397750,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":722,"dst_port":1048,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00461{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":128,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_last_seen":944207397750,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":944207397750,"pkt":"AMCV4Bm+AMCV+E3TCABFAAA05PgAAEARUyaLGRZmixkWAgQYAtIAIApTOExziQAAAAEAAAAAAAAAAAAAAAAAAAAA"} +00676{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":128,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":944207397330,"flow_last_seen":944207397330,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":944207397750,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3298,"dst_port":2049,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00816{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":128,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":944207397280,"flow_last_seen":944207397280,"flow_idle_time":180000,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":56,"midstream":0,"thread_ts_msec":944207397750,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3295,"dst_port":111,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00816{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":128,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":944207397320,"flow_last_seen":944207397320,"flow_idle_time":180000,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":56,"midstream":0,"thread_ts_msec":944207397750,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3297,"dst_port":111,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00816{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":128,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":944207397740,"flow_last_seen":944207397740,"flow_idle_time":180000,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":56,"midstream":0,"thread_ts_msec":944207397750,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3299,"dst_port":111,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00817{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":128,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":944207397290,"flow_last_seen":944207397310,"flow_idle_time":180000,"flow_min_l4_payload_len":72,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":94,"midstream":0,"thread_ts_msec":944207397750,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":706,"dst_port":1048,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00817{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":128,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":944207397750,"flow_last_seen":944207397750,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":140,"flow_avg_l4_payload_len":70,"midstream":0,"thread_ts_msec":944207397750,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":722,"dst_port":1048,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00816{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":128,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":944207397290,"flow_last_seen":944207397290,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":32,"midstream":0,"thread_ts_msec":944207397750,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3296,"dst_port":1048,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":128,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"finished","flow_packets_processed":114,"flow_first_seen":944207397400,"flow_last_seen":944207397690,"flow_idle_time":180000,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":300,"flow_tot_l4_payload_len":16648,"flow_avg_l4_payload_len":146,"midstream":0,"thread_ts_msec":944207397750,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":1022,"dst_port":2049,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"NFS","breed":"Acceptable","category":"DataTransfer"}} +00554{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":128,"source":"nfsv3.pcap","alias":"nDPId-test","packets-captured":128,"packets-processed":128,"total-skipped-flows":0,"total-l4-data-len":17440,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":8,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":8,"total-idle-flows":8,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":44,"global_ts_msec":944207397750} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 128/128 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 17440 bytes +~~ total detected protocols..: 8 +~~ total active/idle flows...: 8/8 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5188233 bytes +~~ total memory freed........: 5188233 bytes +~~ total allocations/frees...: 113174/113174 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 461 chars +~~ json string max len.......: 822 chars +~~ json string avg len.......: 640 chars diff --git a/test/results/nintendo.pcap.out b/test/results/nintendo.pcap.out index 704671613..cf101a9d3 100644 --- a/test/results/nintendo.pcap.out +++ b/test/results/nintendo.pcap.out @@ -138,9 +138,9 @@ ~~ total active/idle flows...: 21/21 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4737674 bytes -~~ total memory freed........: 4737674 bytes -~~ total allocations/frees...: 102212/102212 +~~ total memory allocated....: 5236581 bytes +~~ total memory freed........: 5236581 bytes +~~ total allocations/frees...: 114094/114094 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 456 chars ~~ json string max len.......: 1399 chars diff --git a/test/results/nntp.pcap.out b/test/results/nntp.pcap.out new file mode 100644 index 000000000..5e41e3386 --- /dev/null +++ b/test/results/nntp.pcap.out @@ -0,0 +1,24 @@ +00455{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"nntp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00541{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"nntp.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1258844926423} +00574{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"nntp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1258844926423,"flow_last_seen":1258844926423,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1258844926423,"l3_proto":"ip4","src_ip":"192.168.190.20","dst_ip":"192.168.190.5","src_port":55630,"dst_port":119,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"nntp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1258844926423,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1258844926423,"pkt":"AEBj1fcCABQqM3R+CABFAAA8fZdAAEAGv7nAqL4UwKi+BdlOAHfZ0lWUAAAAAKACFtABzgAAAgQFtAQCCAoAyCgDAAAAAAEDAwY="} +00473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"nntp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1258844926423,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1258844926423,"pkt":"ABQqM3R+AEBj1fcCCABFAAA8AABAAEAGPVHAqL4FwKi+FAB32U6dVo1l2dJVlaASFqBxAwAAAgQFtAQCCAoKz1tgAMgoAwEDAwQ="} +00461{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"nntp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1258844926423,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1258844926423,"pkt":"AEBj1fcCABQqM3R+CABFAAA0fZhAAEAGv8DAqL4UwKi+BdlOAHfZ0lWVnVaNZoAQAFy2EAAAAQEICgDIKAMKz1tg"} +00636{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"nntp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1258844926423,"flow_last_seen":1258844926441,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":124,"flow_tot_l4_payload_len":137,"flow_avg_l4_payload_len":22,"midstream":0,"thread_ts_msec":1258844926441,"l3_proto":"ip4","src_ip":"192.168.190.20","dst_ip":"192.168.190.5","src_port":55630,"dst_port":119,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"Usenet","breed":"Acceptable","category":"Web"}} +00679{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":32,"source":"nntp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":32,"flow_first_seen":1258844926423,"flow_last_seen":1258844993785,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":4921,"flow_avg_l4_payload_len":153,"midstream":0,"thread_ts_msec":1258844993785,"l3_proto":"ip4","src_ip":"192.168.190.20","dst_ip":"192.168.190.5","src_port":55630,"dst_port":119,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"Usenet","breed":"Acceptable","category":"Web"}} +00549{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":32,"source":"nntp.pcap","alias":"nDPId-test","packets-captured":32,"packets-processed":32,"total-skipped-flows":0,"total-l4-data-len":4921,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1258844993785} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 32/32 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 4921 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5181393 bytes +~~ total memory freed........: 5181393 bytes +~~ total allocations/frees...: 113058/113058 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 460 chars +~~ json string max len.......: 684 chars +~~ json string avg len.......: 561 chars diff --git a/test/results/no_sni.pcap.out b/test/results/no_sni.pcap.out index 32e250d0e..a6f2aa1b3 100644 --- a/test/results/no_sni.pcap.out +++ b/test/results/no_sni.pcap.out @@ -64,9 +64,9 @@ ~~ total active/idle flows...: 8/8 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4738899 bytes -~~ total memory freed........: 4738899 bytes -~~ total allocations/frees...: 102375/102375 +~~ total memory allocated....: 5237806 bytes +~~ total memory freed........: 5237806 bytes +~~ total allocations/frees...: 114257/114257 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 453 chars ~~ json string max len.......: 988 chars diff --git a/test/results/ocs.pcap.out b/test/results/ocs.pcap.out index 15a23fd2b..28d6562ba 100644 --- a/test/results/ocs.pcap.out +++ b/test/results/ocs.pcap.out @@ -1901,9 +1901,9 @@ ~~ total active/idle flows...: 0/0 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4678638 bytes -~~ total memory freed........: 4678638 bytes -~~ total allocations/frees...: 101140/101140 +~~ total memory allocated....: 5177545 bytes +~~ total memory freed........: 5177545 bytes +~~ total allocations/frees...: 113022/113022 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 174 chars ~~ json string max len.......: 2208 chars diff --git a/test/results/ocsp.pcapng.out b/test/results/ocsp.pcapng.out index c8f5a62ad..94391bc72 100644 --- a/test/results/ocsp.pcapng.out +++ b/test/results/ocsp.pcapng.out @@ -73,9 +73,9 @@ ~~ total active/idle flows...: 10/10 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4698966 bytes -~~ total memory freed........: 4698966 bytes -~~ total allocations/frees...: 101562/101562 +~~ total memory allocated....: 5197873 bytes +~~ total memory freed........: 5197873 bytes +~~ total allocations/frees...: 113444/113444 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 908 chars diff --git a/test/results/ookla.pcap.out b/test/results/ookla.pcap.out index 3c139cff3..bf00bcffd 100644 --- a/test/results/ookla.pcap.out +++ b/test/results/ookla.pcap.out @@ -21,9 +21,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4838148 bytes -~~ total memory freed........: 4838148 bytes -~~ total allocations/frees...: 106236/106236 +~~ total memory allocated....: 5337055 bytes +~~ total memory freed........: 5337055 bytes +~~ total allocations/frees...: 118118/118118 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 835 chars diff --git a/test/results/openvpn.pcap.out b/test/results/openvpn.pcap.out index cde1675d2..492830a12 100644 --- a/test/results/openvpn.pcap.out +++ b/test/results/openvpn.pcap.out @@ -29,9 +29,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4691944 bytes -~~ total memory freed........: 4691944 bytes -~~ total allocations/frees...: 101448/101448 +~~ total memory allocated....: 5190851 bytes +~~ total memory freed........: 5190851 bytes +~~ total allocations/frees...: 113330/113330 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 834 chars diff --git a/test/results/oracle12.pcapng.out b/test/results/oracle12.pcapng.out new file mode 100644 index 000000000..551ded626 --- /dev/null +++ b/test/results/oracle12.pcapng.out @@ -0,0 +1,24 @@ +00461{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"oracle12.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00547{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"oracle12.pcapng","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1481291750025} +00574{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"oracle12.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1481291750025,"flow_last_seen":1481291750025,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1481291750025,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.72.139","src_port":40226,"dst_port":1521,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"oracle12.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1481291750025,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1481291750025,"pkt":"UlQAEjUCCAAn5\/q0CABFAAA8b5VAAEAGbI0KAAIPCgBIi50iBfF8VCT6AAAAAKACchBeyAAAAgQFtAQCCAoFQUtvAAAAAAEDAwc="} +00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"oracle12.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1481291750026,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"thread_ts_msec":1481291750026,"pkt":"CAAn5\/q0UlQAEjUCCABFAAAsAf4AAEAGGjUKAEiLCgACDwXxnSIAeB4BfFQk+2AS\/\/\/WoAAAAgQFtAAA"} +00452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"oracle12.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1481291750027,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":1481291750027,"pkt":"UlQAEjUCCAAn5\/q0CABFAAAob5ZAAEAGbKAKAAIPCgBIi50iBfF8VCT7AHgeAlAQchBetAAA"} +00653{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":20,"source":"oracle12.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":20,"flow_first_seen":1481291750025,"flow_last_seen":1481291750055,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":239,"flow_tot_l4_payload_len":1382,"flow_avg_l4_payload_len":69,"midstream":0,"thread_ts_msec":1481291750055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.72.139","src_port":40226,"dst_port":1521,"l4_proto":"tcp","ndpi": {"confidence": {"1":"Match by port"},"proto":"Oracle","breed":"Acceptable","category":"Database"}} +00583{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":20,"source":"oracle12.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":20,"flow_first_seen":1481291750025,"flow_last_seen":1481291750055,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":239,"flow_tot_l4_payload_len":1382,"flow_avg_l4_payload_len":69,"midstream":0,"thread_ts_msec":1481291750055,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"10.0.72.139","src_port":40226,"dst_port":1521,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00555{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":20,"source":"oracle12.pcapng","alias":"nDPId-test","packets-captured":20,"packets-processed":20,"total-skipped-flows":0,"total-l4-data-len":1382,"total-not-detected-flows":0,"total-guessed-flows":1,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1481291750055} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 20/20 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 1382 bytes +~~ total detected protocols..: 0 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5181045 bytes +~~ total memory freed........: 5181045 bytes +~~ total allocations/frees...: 113046/113046 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 457 chars +~~ json string max len.......: 658 chars +~~ json string avg len.......: 551 chars diff --git a/test/results/os_detected.pcapng.out b/test/results/os_detected.pcapng.out index dba51f569..737969193 100644 --- a/test/results/os_detected.pcapng.out +++ b/test/results/os_detected.pcapng.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685088 bytes -~~ total memory freed........: 4685088 bytes -~~ total allocations/frees...: 101158/101158 +~~ total memory allocated....: 5188700 bytes +~~ total memory freed........: 5188700 bytes +~~ total allocations/frees...: 113049/113049 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 2155 chars diff --git a/test/results/ospfv2_add_new_prefix.pcap.out b/test/results/ospfv2_add_new_prefix.pcap.out new file mode 100644 index 000000000..00d06d3a1 --- /dev/null +++ b/test/results/ospfv2_add_new_prefix.pcap.out @@ -0,0 +1,23 @@ +00472{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ospfv2_add_new_prefix.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00558{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"ospfv2_add_new_prefix.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1596626889276} +00551{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"ospfv2_add_new_prefix.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1596626889276,"flow_last_seen":1596626889276,"flow_idle_time":600000,"flow_min_l4_payload_len":88,"flow_max_l4_payload_len":88,"flow_tot_l4_payload_len":88,"flow_avg_l4_payload_len":88,"midstream":0,"thread_ts_msec":1596626889276,"l3_proto":"ip4","src_ip":"10.1.10.10","dst_ip":"10.1.10.1","l4_proto":89,"flow_datalink":1,"flow_max_packets":3} +00565{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"ospfv2_add_new_prefix.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1596626889276,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":122,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":122,"pkt_l4_len":88,"thread_ts_msec":1596626889276,"pkt":"qrvMAAEwqrvMAAowCABFwABsAPoAAAFZj3MKAQoKCgEKAQIEAFisEAAKAAAABqsnAAAAAAAAAAAAAAAAAAEAASIBrBAACqwQAAqAAAASxYoAPAAAAAMKAAAK\/\/\/\/\/wMAAAGsEAAK\/\/\/\/\/wMAAAEKAQoKCgEKCgIAAAo="} +00610{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"ospfv2_add_new_prefix.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1596626889276,"flow_last_seen":1596626889276,"flow_idle_time":600000,"flow_min_l4_payload_len":88,"flow_max_l4_payload_len":88,"flow_tot_l4_payload_len":88,"flow_avg_l4_payload_len":88,"midstream":0,"thread_ts_msec":1596626889276,"l3_proto":"ip4","src_ip":"10.1.10.10","dst_ip":"10.1.10.1","l4_proto":89,"ndpi": {"confidence": {"4":"DPI"},"proto":"OSPF","breed":"Acceptable","category":"Network"}} +00493{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"ospfv2_add_new_prefix.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1596626891781,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"thread_ts_msec":1596626891781,"pkt":"qrvMAAowqrvMAAEwCABFwABAAqkAAAFZjfAKAQoBCgEKCgIFACwKAAABAAAABjO3AAAAAAAAAAAAAAABIgGsEAAKrBAACoAAABLFigA8"} +00650{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2,"source":"ospfv2_add_new_prefix.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1596626889276,"flow_last_seen":1596626891781,"flow_idle_time":600000,"flow_min_l4_payload_len":44,"flow_max_l4_payload_len":88,"flow_tot_l4_payload_len":132,"flow_avg_l4_payload_len":66,"midstream":0,"thread_ts_msec":1596626891781,"l3_proto":"ip4","src_ip":"10.1.10.10","dst_ip":"10.1.10.1","l4_proto":89,"flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"OSPF","breed":"Acceptable","category":"Network"}} +00562{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2,"source":"ospfv2_add_new_prefix.pcap","alias":"nDPId-test","packets-captured":2,"packets-processed":2,"total-skipped-flows":0,"total-l4-data-len":132,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":8,"global_ts_msec":1596626891781} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 2/2 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 132 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5178475 bytes +~~ total memory freed........: 5178475 bytes +~~ total allocations/frees...: 113027/113027 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 477 chars +~~ json string max len.......: 655 chars +~~ json string avg len.......: 557 chars diff --git a/test/results/pgsql.pcap.out b/test/results/pgsql.pcap.out new file mode 100644 index 000000000..837865e7f --- /dev/null +++ b/test/results/pgsql.pcap.out @@ -0,0 +1,30 @@ +00456{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"pgsql.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00542{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"pgsql.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1103453983214} +00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"pgsql.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1103453983214,"flow_last_seen":1103453983214,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1103453983214,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":45930,"dst_port":5432,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00479{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"pgsql.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1103453983214,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1103453983214,"pkt":"AAAAAAAAAAAAAAAACABFAAA8\/wlAAEAGPbB\/AAABfwAAAbNqFTjJW\/IgAAAAAKACf\/\/rIgAAAgRADAQCCAoTQg0pAAAAAAEDAwA="} +00476{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"pgsql.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1103453983214,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1103453983214,"pkt":"AAAAAAAAAAAAAAAACABFAAA8AABAAEAGPLp\/AAABfwAAARU4s2rJRrU9yVvyIaASf\/9MIgAAAgRADAQCCAoTQg0pE0INKQEDAwA="} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"pgsql.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1103453983214,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1103453983214,"pkt":"AAAAAAAAAAAAAAAACABFAAA0\/wpAAEAGPbd\/AAABfwAAAbNqFTjJW\/IhyUa1PoAQf\/+1PwAAAQEIChNCDSkTQg0p"} +00567{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4,"source":"pgsql.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1103453983215,"flow_last_seen":1103453983215,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1103453983215,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":45931,"dst_port":5432,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00476{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"pgsql.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1103453983215,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1103453983215,"pkt":"AAAAAAAAAAAAAAAACABFAAA8vZZAAEAGfyN\/AAABfwAAAbNrFTjJAbC8AAAAAKACf\/8s3wAAAgRADAQCCAoTQg0qAAAAAAEDAwA="} +00476{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"pgsql.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1103453983215,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1103453983215,"pkt":"AAAAAAAAAAAAAAAACABFAAA8AABAAEAGPLp\/AAABfwAAARU4s2vJSeIcyQGwvaASf\/9g+wAAAgRADAQCCAoTQg0qE0INKgEDAwA="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"pgsql.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1103453983215,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1103453983215,"pkt":"AAAAAAAAAAAAAAAACABFAAA0vZdAAEAGfyp\/AAABfwAAAbNrFTjJAbC9yUniHYAQf\/\/KGAAAAQEIChNCDSoTQg0q"} +00636{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"pgsql.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1103453983214,"flow_last_seen":1103453983217,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":38,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":8,"midstream":0,"thread_ts_msec":1103453983217,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":45930,"dst_port":5432,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"PostgreSQL","breed":"Acceptable","category":"Database"}} +00636{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":13,"source":"pgsql.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1103453983215,"flow_last_seen":1103453983217,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":38,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":8,"midstream":0,"thread_ts_msec":1103453983217,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":45931,"dst_port":5432,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"PostgreSQL","breed":"Acceptable","category":"Database"}} +00680{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":39,"source":"pgsql.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":24,"flow_first_seen":1103453983214,"flow_last_seen":1103453998615,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":282,"flow_tot_l4_payload_len":1430,"flow_avg_l4_payload_len":59,"midstream":0,"thread_ts_msec":1103453998615,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":45930,"dst_port":5432,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"PostgreSQL","breed":"Acceptable","category":"Database"}} +00679{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":39,"source":"pgsql.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":15,"flow_first_seen":1103453983215,"flow_last_seen":1103453983338,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":185,"flow_tot_l4_payload_len":673,"flow_avg_l4_payload_len":44,"midstream":0,"thread_ts_msec":1103453998615,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":45931,"dst_port":5432,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"PostgreSQL","breed":"Acceptable","category":"Database"}} +00551{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":39,"source":"pgsql.pcap","alias":"nDPId-test","packets-captured":39,"packets-processed":39,"total-skipped-flows":0,"total-l4-data-len":2103,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":15,"global_ts_msec":1103453998615} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 39/39 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 2103 bytes +~~ total detected protocols..: 2 +~~ total active/idle flows...: 2/2 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5184516 bytes +~~ total memory freed........: 5184516 bytes +~~ total allocations/frees...: 113069/113069 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 461 chars +~~ json string max len.......: 685 chars +~~ json string avg len.......: 569 chars diff --git a/test/results/pinterest.pcap.out b/test/results/pinterest.pcap.out index 054707e67..2cc198259 100644 --- a/test/results/pinterest.pcap.out +++ b/test/results/pinterest.pcap.out @@ -247,9 +247,9 @@ ~~ total active/idle flows...: 37/37 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 6208143 bytes -~~ total memory freed........: 6208143 bytes -~~ total allocations/frees...: 120103/120103 +~~ total memory allocated....: 6707050 bytes +~~ total memory freed........: 6707050 bytes +~~ total allocations/frees...: 131985/131985 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 3224 chars diff --git a/test/results/pop3.pcap.out b/test/results/pop3.pcap.out index 15f3d303e..4b5237843 100644 --- a/test/results/pop3.pcap.out +++ b/test/results/pop3.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682457 bytes -~~ total memory freed........: 4682457 bytes -~~ total allocations/frees...: 101175/101175 +~~ total memory allocated....: 5181364 bytes +~~ total memory freed........: 5181364 bytes +~~ total allocations/frees...: 113057/113057 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 460 chars ~~ json string max len.......: 822 chars diff --git a/test/results/pops.pcapng.out b/test/results/pops.pcapng.out new file mode 100644 index 000000000..fc91b013d --- /dev/null +++ b/test/results/pops.pcapng.out @@ -0,0 +1,24 @@ +00457{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"pops.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00543{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"pops.pcapng","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1614938117011} +00570{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"pops.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1614938117011,"flow_last_seen":1614938117011,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1614938117011,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"10.10.10.1","src_port":55077,"dst_port":995,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"pops.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1614938117011,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1614938117011,"pkt":"AAAAAAAAAAgACwgJCABFAAA0BaxAAH8GIWTAqAABCgoKAdclA+N8RI7kAAAAAIACIACU+AAAAgQE7AEDAwIBAQQC"} +00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"pops.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1614938117270,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1614938117270,"pkt":"AAAAAAAAAAgACwgJCABFAAA0AABAADMGcxAKCgoBwKgAAQPj1yVpzHIcfESO5YASchBmIQAAAgQFtAEBBAIBAwMH"} +00702{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"pops.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1614938117298,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":238,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":238,"pkt_l4_len":204,"thread_ts_msec":1614938117298,"pkt":"AAAAAAAAAAgACwgJCABFAADgBbBAAH8GILTAqAABCgoKAdclA+N8RI7lacxyHVAYQTecFQAAFgMDALMBAACvAwNgQf\/5kgLNNRPYdtFiHEoPzfeU37\/0FcJ+JWxvuPQRAgAAOMAowCfAFMATAJ8AngA5ADMAnQCcAD0APAA1AC\/ALMArwCTAI8AKwAkAagBAADgAMgAKABMABQAEAQAATgAAABkAFwAAFHBvcC5zZWN1cmVzZXJ2ZXIubmV0AAoABgAEABcAGAALAAIBAAANABQAEgYBBgMEAQUBAgEEAwUDAgMCAgAXAAD\/AQABAA=="} +00762{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"pops.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1614938117011,"flow_last_seen":1614938117298,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":184,"flow_tot_l4_payload_len":184,"flow_avg_l4_payload_len":61,"midstream":0,"thread_ts_msec":1614938117298,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"10.10.10.1","src_port":55077,"dst_port":995,"l4_proto":"tcp","ndpi": {"flow_risk": {"15": {"risk":"TLS (probably) Not Carrying HTTPS","severity":"Low","risk_score": {"total":760,"client":680,"server":80}}},"confidence": {"4":"DPI"},"proto":"POPS","breed":"Safe","category":"Email"}} +00804{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5,"source":"pops.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":1614938117011,"flow_last_seen":1614938117559,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":2704,"flow_avg_l4_payload_len":540,"midstream":0,"thread_ts_msec":1614938117559,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"10.10.10.1","src_port":55077,"dst_port":995,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"15": {"risk":"TLS (probably) Not Carrying HTTPS","severity":"Low","risk_score": {"total":760,"client":680,"server":80}}},"confidence": {"4":"DPI"},"proto":"POPS","breed":"Safe","category":"Email"}} +00548{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":5,"source":"pops.pcapng","alias":"nDPId-test","packets-captured":5,"packets-processed":5,"total-skipped-flows":0,"total-l4-data-len":2704,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1614938117559} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 5/5 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 2704 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5180610 bytes +~~ total memory freed........: 5180610 bytes +~~ total allocations/frees...: 113031/113031 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 462 chars +~~ json string max len.......: 809 chars +~~ json string avg len.......: 620 chars diff --git a/test/results/pps.pcap.out b/test/results/pps.pcap.out index 4087a9afd..3f28ef3cc 100644 --- a/test/results/pps.pcap.out +++ b/test/results/pps.pcap.out @@ -123,7 +123,7 @@ 00601{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":921,"source":"pps.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":32,"flow_first_seen":1467353136439,"flow_last_seen":1467353136900,"flow_idle_time":180000,"flow_min_l4_payload_len":19,"flow_max_l4_payload_len":1065,"flow_tot_l4_payload_len":8362,"flow_avg_l4_payload_len":261,"midstream":0,"thread_ts_msec":1467353136900,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"222.197.138.12","src_port":22793,"dst_port":6956,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00587{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":994,"source":"pps.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353138757,"flow_last_seen":1467353138757,"flow_idle_time":7440000,"flow_min_l4_payload_len":1260,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":1260,"midstream":1,"thread_ts_msec":1467353138757,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50463,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 02136{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":994,"source":"pps.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_last_seen":1467353138757,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1314,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1314,"pkt_l4_len":1280,"thread_ts_msec":1467353138757,"pkt":"TF4M6gNlABxCjnAxCABFAAUUA1lAAIAGkOvAqHMIZePIC8UfAFBKp6EFWDmKmFAQ\/\/B9QgAAR0VUIC90cmFjazI\/YT0xJmFzPTE7MiwzOzQsNSZiPTE0NjczNTMxMzgmYz1hZTg3Y2IzY2ZkZjQ5NGFhNDhkYzYwODkwOWY2OTI1MCZjdj01LjIuMTUuMjI0MCZkPTUwMDAwMDA4NTg4NzQmZHI9MjE3NSZmPTRlM2FlNDE1YTU4NDc0OGFjOWFhMzE2MjhmMzlkMWU4Jmc9MF9hYW9lZmR0cWdmZGVweGMydG52M3BpdWNnY2I0ZW9mbiZoPSZpPXFjXzEwMDAwMV8xMDAxNDAmaXY9MCZqPTMxJms9MTgwOTMyMzAxJmtwPTRlM2FlNDE1YTU4NDc0OGFjOWFhMzE2MjhmMzlkMWU4Jm49NDc5NTMxMDAwJm89MSZwPTEwMDAwMDAwMDAzODEmcT01MDAwMDAwOTI3NTU4JnI9YzQ4ODllNjRhZDlkOWVlYjlmZjQzODkxMDg1MGM0NDImcnQ9MTQ2NzM1MzExMyZzPWFlYTU2YTgwOGZjOTJlZjM2MDUxOTEyMTk0OGUwZjI3JnN2PTQuMTAuMDA0JnU9MSZ1cD0mdj01MDAwMDAwODU5MTI0JnZlPTEmdz0yLDMgSFRUUC8xLjENCkFjY2VwdC1MYW5ndWFnZTogemgtQ04NClJlZmVyZXI6IGh0dHA6Ly93d3cuaXFpeWkuY29tL2NvbW1vbi9mbGFzaHBsYXllci8yMDE0MDkyNC9NYWluUGxheWVyXzVfMl8zX2MzXzJfMV82LnN3Zg0KcXlpZDogYWFvZWZkdHFnZmRlcHhjMnRudjNwaXVjZ2NiNGVvZm4NCnF5cGlkOiBfMjAxMg0KcXlwbGF0Zm9ybTogMC0yDQp4LWZsYXNoLXZlcnNpb246IDEyLDAsMCw3MA0KQWNjZXB0OiAqLyoNClByYWdtYTogbm8tY2FjaGUNCkNhY2hlLUNvbnRyb2w6IG5vLWNhY2hlDQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQpVc2VyLUFnZW50OiBNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA4LjA7IFdpbmRvd3MgTlQgNi4xOyBXT1c2NDsgVHJpZGVudC80LjA7IFNMQ0MyOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuNS4zMDcyOTsgLk5FVCBDTFIgMy4wLjMwNzI5OyBNZWRpYSBDZW50ZXIgUEMgNi4wKS9RWS1QbGF5ZXItV2luZG93cy8yLjAuMTAyDQpIb3N0OiBhcGkuY3VwaWQuaXFpeWkuY29tDQpDb29raWU6IHBwc19jbGllbnRfdmVyMj01LjIuMTUuMjI0MDsgVDAwNDA0PTRlM2FlNDE1YTU4NDc0OGFjOWFhMzE2MjhmMzlkMWU4OyBfcHBzX2l2aT1WazQ5TVRZd05UQTFMYVcvcFBtaFJ6OC9QNlRhcEVlbXVEOC9wTSt3Wmo4dHBMV3gzemd3cGxvL3BHYW9jU1pXVUQweEpsWkRQVDgvUHo4K3BMV3gzemd3cGxvL3BHYW9jU1pXU2owdE1TWldVejFRSmxaRVBTWldWRnRCWFQweU1UYzFKbFpOUFNaV1ZqMDFMakl1TVRVdU1qSTBNQ1pXVlQxb2RIUndPaTh2ZDNkM0xtbHhhWGxwTG1OdmJTOTJYekU1Y25K"} -01393{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":994,"source":"pps.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353138757,"flow_last_seen":1467353138757,"flow_idle_time":7440000,"flow_min_l4_payload_len":1260,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":1260,"midstream":1,"thread_ts_msec":1467353138757,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50463,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"api.cupid.iqiyi.com","url":"api.cupid.iqiyi.com\/track2?a=1&as=1;2,3;4,5&b=1467353138&c=ae87cb3cfdf494aa48dc608909f69250&cv=5.2.15.2240&d=5000000858874&dr=2175&f=4e3ae415a584748ac9aa31628f39d1e8&g=0_aaoefdtqgfdepxc2tnv3piucgcb4eofn&h=&i=qc_100001_100140&iv=0&j=31&k=180932301&kp=4e3ae415a584748ac9aa31628f39d1e8&n=479531000&o=1&p=1000000000381&q=5000000927558&r=c4889e64ad9d9eeb9ff438910850c442&rt=1467353113&s=aea56a808fc92ef360519121948e0f27&sv=4.10.004&u=1&up=&v=5000000859124&ve=1&w=2,3","code":0,"content_type":"","user_agent":"Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\/QY-Player-Windows\/2.0.102"}} +01395{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":994,"source":"pps.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353138757,"flow_last_seen":1467353138757,"flow_idle_time":7440000,"flow_min_l4_payload_len":1260,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":1260,"midstream":1,"thread_ts_msec":1467353138757,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50463,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"api.cupid.iqiyi.com","url":"api.cupid.iqiyi.com\/track2?a=1&as=1;2,3;4,5&b=1467353138&c=ae87cb3cfdf494aa48dc608909f69250&cv=5.2.15.2240&d=5000000858874&dr=2175&f=4e3ae415a584748ac9aa31628f39d1e8&g=0_aaoefdtqgfdepxc2tnv3piucgcb4eofn&h=&i=qc_100001_100140&iv=0&j=31&k=180932301&kp=4e3ae415a584748ac9aa31628f39d1e8&n=479531000&o=1&p=1000000000381&q=5000000927558&r=c4889e64ad9d9eeb9ff438910850c442&rt=1467353113&s=aea56a808fc92ef360519121948e0f27&sv=4.10.004&u=1&up=&v=5000000859124&ve=1&w=2,3","code":0,"content_type":"","user_agent":"Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\/QY-Player-Windows\/2.0.102"}} 00704{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":995,"source":"pps.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":2,"flow_last_seen":1467353138757,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":241,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":241,"pkt_l4_len":207,"thread_ts_msec":1467353138757,"pkt":"TF4M6gNlABxCjnAxCABFAADjA1pAAIAGlRvAqHMIZePIC8UfAFBKp6XxWDmKmFAY\/\/B4OwAAc2RuVjRiR2N1YUhSdGJBPT07IFFDMDA2PXU1NDl2cHoxMGw5ZmthdHVtNGFsdzRicDsgUUMwMDg9MTQ2NjY0NTgxNi4xNDY2NjQ1ODE2LjE0NjY2NDU4MTYuMTsgSG1fbHZ0XzUzYjczNzRhNjNjMzc0ODNlNWRkOTdkNzhkOWJiMzZlPTE0NjY2NDU4MTc7IFFDMDA1PWFhb2VmZHRxZ2ZkZXB4YzJ0bnYzcGl1Y2djYjRlb2ZuDQoNCg=="} 00786{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":996,"source":"pps.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":3,"flow_last_seen":1467353138794,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":306,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":306,"pkt_l4_len":272,"thread_ts_msec":1467353138794,"pkt":"ABxCjnAxTF4M6gNlCABFAAEkTcBAAC8Gm3Rl48gLwKhzCABQxR9YOYqYSqemrFAYSdTGUAAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOC4wDQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA1OjM4IEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgNCkNvbnRlbnQtTGVuZ3RoOiAyDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpDYWNoZS1Db250cm9sOiBuby1jYWNoZQ0KQWNjZXNzLUNvbnRyb2wtQWxsb3ctQ3JlZGVudGlhbHM6IHRydWUNCkNhY2hlLUNvbnRyb2w6IG5vLWNhY2hlDQoNCm9r"} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":997,"source":"pps.pcap","alias":"nDPId-test","flow_id":38,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353138931,"flow_last_seen":1467353138931,"flow_idle_time":7440000,"flow_min_l4_payload_len":653,"flow_max_l4_payload_len":653,"flow_tot_l4_payload_len":653,"flow_avg_l4_payload_len":653,"midstream":1,"thread_ts_msec":1467353138931,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.112.49","src_port":50464,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} @@ -143,7 +143,7 @@ 01099{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1003,"source":"pps.pcap","alias":"nDPId-test","flow_id":41,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353139627,"flow_last_seen":1467353139627,"flow_idle_time":7440000,"flow_min_l4_payload_len":519,"flow_max_l4_payload_len":519,"flow_tot_l4_payload_len":519,"flow_avg_l4_payload_len":519,"midstream":1,"thread_ts_msec":1467353139627,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50469,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"msg.71.am","url":"msg.71.am\/core?t=5&a=2&ra=1&pf=201&p=11&p1=114&p2=3000&sdktp=1&c1=31&r=479531000&aid=180932301&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn&pu=&os=Windows%207&v=5%2E2%2E15%2E2240&krv=2%2E0%2E102&dt=&hu=-1&rn=1467353139&islocal=0&as=0311c5a0d5596063db5944bd76b6cbff&ve=b1f90f8da6fe0258d13616a8070cb997&pe=&vfrm=&chl=&hcdnv=10.0.0.293&tpcd=0&isdrm=1&ht=0","code":0,"content_type":"","user_agent":"QY-Player-Windows\/2.0.102"}} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1004,"source":"pps.pcap","alias":"nDPId-test","flow_id":42,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353139662,"flow_last_seen":1467353139662,"flow_idle_time":7440000,"flow_min_l4_payload_len":370,"flow_max_l4_payload_len":370,"flow_tot_l4_payload_len":370,"flow_avg_l4_payload_len":370,"midstream":1,"thread_ts_msec":1467353139662,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50470,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00947{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1004,"source":"pps.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_last_seen":1467353139662,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":424,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":424,"pkt_l4_len":390,"thread_ts_msec":1467353139662,"pkt":"TF4M6gNlABxCjnAxCABFAAGaA59AAIAG6LXAqHMIymwO7MUmAFBtzkRVA7NFyFAYAQQzoQAAR0VUIC9iP3Q9NSZwZj0yMDEmcD0xMSZwMT0xMTQmYT0zNCZjdD1vbmNsaWNrJnR5cGU9cGMmYXM9JmNsdD1wY19wbGF5X3BsYXllcl9jbGljayZtdj01LjIuMTUuMjI0MCZwdT0mcm49MEZFMTcyRUM0NEM0NEI4NkFFRURFNTRBQTAwNTQxQzQ1NzQwNiZ1PWFhb2VmZHRxZ2ZkZXB4YzJ0bnYzcGl1Y2djYjRlb2ZuJnY9Mi4wLjEwMi4zMDE0NyBIVFRQLzEuMQ0KVXNlci1BZ2VudDogUWl5aSBMaXN0IENsaWVudCBQQyA1LjIuMTUuMjI0MA0KSG9zdDogbXNnLmlxaXlpLmNvbQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwDQpQcmFnbWE6IG5vLWNhY2hlDQpDYWNoZS1Db250cm9sOiBuby1jYWNoZQ0KQ29ubmVjdGlvbjogY2xvc2UNCkFjY2VwdDogKi8qDQoNCg=="} -00968{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1004,"source":"pps.pcap","alias":"nDPId-test","flow_id":42,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353139662,"flow_last_seen":1467353139662,"flow_idle_time":7440000,"flow_min_l4_payload_len":370,"flow_max_l4_payload_len":370,"flow_tot_l4_payload_len":370,"flow_avg_l4_payload_len":370,"midstream":1,"thread_ts_msec":1467353139662,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50470,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"msg.iqiyi.com","url":"msg.iqiyi.com\/b?t=5&pf=201&p=11&p1=114&a=34&ct=onclick&type=pc&as=&clt=pc_play_player_click&mv=5.2.15.2240&pu=&rn=0FE172EC44C44B86AEEDE54AA00541C457406&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn&v=2.0.102.30147","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} +00970{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1004,"source":"pps.pcap","alias":"nDPId-test","flow_id":42,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353139662,"flow_last_seen":1467353139662,"flow_idle_time":7440000,"flow_min_l4_payload_len":370,"flow_max_l4_payload_len":370,"flow_tot_l4_payload_len":370,"flow_avg_l4_payload_len":370,"midstream":1,"thread_ts_msec":1467353139662,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50470,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"msg.iqiyi.com","url":"msg.iqiyi.com\/b?t=5&pf=201&p=11&p1=114&a=34&ct=onclick&type=pc&as=&clt=pc_play_player_click&mv=5.2.15.2240&pu=&rn=0FE172EC44C44B86AEEDE54AA00541C457406&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn&v=2.0.102.30147","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} 00640{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1005,"source":"pps.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":2,"flow_last_seen":1467353139771,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":194,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":194,"pkt_l4_len":160,"thread_ts_msec":1467353139771,"pkt":"ABxCjnAxTF4M6gNlCABFAAC0y0pAADMGbvDKbA7swKhzCABQxSYDs0XIbc5Fx1AYAB\/3XQAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOC4wDQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA1OjM5IEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBjbG9zZQ0KDQo="} 00648{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1006,"source":"pps.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":2,"flow_last_seen":1467353139779,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"thread_ts_msec":1467353139779,"pkt":"ABxCjnAxTF4M6gNlCABFAAC58h9AADMGSCfKbA7bwKhzCABQxSVwL3Su+7knHVAYADbM\/QAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuNC43DQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA1OjM5IEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQoNCg=="} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1007,"source":"pps.pcap","alias":"nDPId-test","flow_id":43,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353139819,"flow_last_seen":1467353139819,"flow_idle_time":7440000,"flow_min_l4_payload_len":898,"flow_max_l4_payload_len":898,"flow_tot_l4_payload_len":898,"flow_avg_l4_payload_len":898,"midstream":1,"thread_ts_msec":1467353139819,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50471,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} @@ -152,7 +152,7 @@ 00648{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1008,"source":"pps.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":2,"flow_last_seen":1467353139866,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"thread_ts_msec":1467353139866,"pkt":"ABxCjnAxTF4M6gNlCABFAAC5KWZAADMGENDKbA7swKhzCABQxSeRl6ZqgeuX\/1AYACHEyQAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOC4wDQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA1OjM5IEdNVA0KQ29udGVudC1UeXBlOiBpbWFnZS9naWYNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQoNCg=="} 00588{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1009,"source":"pps.pcap","alias":"nDPId-test","flow_id":44,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353140628,"flow_last_seen":1467353140628,"flow_idle_time":7440000,"flow_min_l4_payload_len":1046,"flow_max_l4_payload_len":1046,"flow_tot_l4_payload_len":1046,"flow_avg_l4_payload_len":1046,"midstream":1,"thread_ts_msec":1467353140628,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.221","src_port":50474,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 01850{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1009,"source":"pps.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_last_seen":1467353140628,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1100,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1100,"pkt_l4_len":1066,"thread_ts_msec":1467353140628,"pkt":"TF4M6gNlABxCjnAxCABFAAQ+A+YAAIAGJdrAqHMIymwO3cUqAFDSWIZQbAIVvVAYKACmwAAAR0VUIC9iP2MxPTYmczE9MSZtYWNpZD1hYW9lZmR0cWdmZGVweGMydG52M3BpdWNnY2I0ZW9mbiZjaGFubmVsaWQ9MDAwJm51PSZlPTEzNTI1Mjgmc2U9MTI1MzgxMSZyPTUwMDQ5NDYwMCZhZHVpZD1kMDdkZmQzMGYwZWU0ZTQ4YmJjYWYxMjA4Yzc1ODQ3MSZjdG09MTM3NTIxMSZwbGF5c291cmNlPTAwMTAwNDAwMCZ2aWQ9NTYyZTI2Y2FlZDU2OTU5MDAyMTJlYjMyNTkwNzBmOGEmYWxidW1pZD01MDA0OTQ2MDAmcmE9MiZ0ZD0yMjY1MiZzdWNjZXNzaW9uPTQmdHlwZT0xJnZmcm09My0wMDEwMDQwMDAtY19jb3JnaS0wJmJ1Y2tldD1jX2NvcmdpX21haW4mcmF0cD0xJnBsYXltb2RlPTEmaHU9LTEmaHQ9MCZhcD0wJnQ9MjAxJmN0PWNsdF9fcGxfcGxheSZ2ZT0xMzUyNTI4JnBmPTIwMSZwPTExJnAxPTExNCZwMj0xMDExJnU9YWFvZWZkdHFnZmRlcHhjMnRudjNwaXVjZ2NiNGVvZm4mcHU9JnY9Mi4wLjEwMi4zMDE0NyZkZT1hMGVlNzdhNTYzODg5N2JlYmZkODU1NWIzMjcwYmVmNiZtdj01LjIuMTUuMjI0MCZrdj0xMC4wLjAuMjkzJnNvdXJjZTE9bWluaXBsYXllciZzb3VyY2UyPW1pbmlwbGF5ZXImc291cmNlMz0lZTUlYjAlOGYlZTYlOTIlYWQlZTYlOTQlYmUlZTUlOTklYTgmc291cmNlND0lZTUlYjAlOGYlZTYlOTIlYWQlZTYlOTQlYmUmcGxheV9zb3VyY2U9MSZvcHQ9MCZjbHQ9aG9tZWRsJnNjZW5lPTEmcm49MDAwMDAwMDE0NjczNTMxNDAgSFRUUC8xLjENCkFjY2VwdDogKi8qDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUNClVzZXItQWdlbnQ6IE1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDguMDsgV2luZG93cyBOVCA2LjE7IFRyaWRlbnQvNC4wOyBTTENDMjsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjUuMzA3Mjk7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgTWVkaWEgQ2VudGVyIFBDIDYuMDsgQ0lCQTsgQWxleGEgVG9vbGJhcjsgWnVuZSA0LjcpDQpIb3N0OiBtc2cuaXFpeWkuY29tDQpDb25uZWN0aW9uOiBjbG9zZQ0KQ29va2llOiB0YnZlcj1hbHhpLTkuMzk7IGFpZD1kbWVrYzFhUEMzMDA4cA0KDQo="} -01639{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1009,"source":"pps.pcap","alias":"nDPId-test","flow_id":44,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353140628,"flow_last_seen":1467353140628,"flow_idle_time":7440000,"flow_min_l4_payload_len":1046,"flow_max_l4_payload_len":1046,"flow_tot_l4_payload_len":1046,"flow_avg_l4_payload_len":1046,"midstream":1,"thread_ts_msec":1467353140628,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.221","src_port":50474,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"msg.iqiyi.com","url":"msg.iqiyi.com\/b?c1=6&s1=1&macid=aaoefdtqgfdepxc2tnv3piucgcb4eofn&channelid=000&nu=&e=1352528&se=1253811&r=500494600&aduid=d07dfd30f0ee4e48bbcaf1208c758471&ctm=1375211&playsource=001004000&vid=562e26caed5695900212eb3259070f8a&albumid=500494600&ra=2&td=22652&succession=4&type=1&vfrm=3-001004000-c_corgi-0&bucket=c_corgi_main&ratp=1&playmode=1&hu=-1&ht=0&ap=0&t=201&ct=clt__pl_play&ve=1352528&pf=201&p=11&p1=114&p2=1011&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn&pu=&v=2.0.102.30147&de=a0ee77a5638897bebfd8555b3270bef6&mv=5.2.15.2240&kv=10.0.0.293&source1=miniplayer&source2=miniplayer&source3=%e5%b0%8f%e6%92%ad%e6%94%be%e5%99%a8&source4=%e5%b0%8f%e6%92%ad%e6%94%be&play_source=1&opt=0&clt=homedl&scene=1&rn=00000001467353140","code":0,"content_type":"","user_agent":"Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; CIBA; Alexa Toolbar; Zune 4.7)"}} +01641{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1009,"source":"pps.pcap","alias":"nDPId-test","flow_id":44,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353140628,"flow_last_seen":1467353140628,"flow_idle_time":7440000,"flow_min_l4_payload_len":1046,"flow_max_l4_payload_len":1046,"flow_tot_l4_payload_len":1046,"flow_avg_l4_payload_len":1046,"midstream":1,"thread_ts_msec":1467353140628,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.221","src_port":50474,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"msg.iqiyi.com","url":"msg.iqiyi.com\/b?c1=6&s1=1&macid=aaoefdtqgfdepxc2tnv3piucgcb4eofn&channelid=000&nu=&e=1352528&se=1253811&r=500494600&aduid=d07dfd30f0ee4e48bbcaf1208c758471&ctm=1375211&playsource=001004000&vid=562e26caed5695900212eb3259070f8a&albumid=500494600&ra=2&td=22652&succession=4&type=1&vfrm=3-001004000-c_corgi-0&bucket=c_corgi_main&ratp=1&playmode=1&hu=-1&ht=0&ap=0&t=201&ct=clt__pl_play&ve=1352528&pf=201&p=11&p1=114&p2=1011&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn&pu=&v=2.0.102.30147&de=a0ee77a5638897bebfd8555b3270bef6&mv=5.2.15.2240&kv=10.0.0.293&source1=miniplayer&source2=miniplayer&source3=%e5%b0%8f%e6%92%ad%e6%94%be%e5%99%a8&source4=%e5%b0%8f%e6%92%ad%e6%94%be&play_source=1&opt=0&clt=homedl&scene=1&rn=00000001467353140","code":0,"content_type":"","user_agent":"Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; CIBA; Alexa Toolbar; Zune 4.7)"}} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1010,"source":"pps.pcap","alias":"nDPId-test","flow_id":45,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353140655,"flow_last_seen":1467353140655,"flow_idle_time":7440000,"flow_min_l4_payload_len":887,"flow_max_l4_payload_len":887,"flow_tot_l4_payload_len":887,"flow_avg_l4_payload_len":887,"midstream":1,"thread_ts_msec":1467353140655,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50475,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 01635{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1010,"source":"pps.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_last_seen":1467353140655,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":941,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":941,"pkt_l4_len":907,"thread_ts_msec":1467353140655,"pkt":"TF4M6gNlABxCjnAxCABFAAOfA+lAAIAG5mbAqHMIymwO7MUrAFDgGmOz15qFMlAYQTe3tgAAR0VUIC9jcDIuZ2lmP2E9NGUzYWU0MTVhNTg0NzQ4YWM5YWEzMTYyOGYzOWQxZTgmYWk9JmFzPTE6MjoxfDImYXY9NC4xMC4wMDQmYj0yMDQwNzY3MDEmYz02JmN0PTUwMDAwMDA5MjY3OTUmZD0xNTgmZGk9JmRwPTcxMDAwMDAxJmU9NTEyYWI3N2RlN2Y2N2Q0OWYyNGQzNTExNzc4MjIwZDAmZWM9JmVtPSZmaT0mZz0wJmw9TVRFNExqRTJNeTQ0TGprdyZtaz0mbnc9Jm9kPTUwMDAwMDA4NTYzNDQmb2k9JnA9YSZwcD0mcmM9JnJkPSZyaT0mcz0xNDY3MzUzMTM5MDU3JnNoPSZzcT0mc3c9JnQ9c3AmdT0wX2Fhb2VmZHRxZ2ZkZXB4YzJ0bnYzcGl1Y2djYjRlb2ZuJnY9NTAwNDk0NjAwJnZ2PTUuMi4xNS4yMjQwJng9Jnk9cWNfMTAwMDAxXzEwMDE0MCBIVFRQLzEuMQ0KQWNjZXB0LUxhbmd1YWdlOiB6aC1DTg0KUmVmZXJlcjogaHR0cDovL3d3dy5pcWl5aS5jb20vY29tbW9uL2ZsYXNocGxheWVyLzIwMTQwOTI0L01haW5QbGF5ZXJfNV8yXzNfYzNfMl8xXzYuc3dmDQpxeWlkOiBhYW9lZmR0cWdmZGVweGMydG52M3BpdWNnY2I0ZW9mbg0KcXlwaWQ6IF8yMDEyDQpxeXBsYXRmb3JtOiAwLTINCngtZmxhc2gtdmVyc2lvbjogMTIsMCwwLDcwDQpBY2NlcHQ6ICovKg0KUHJhZ21hOiBuby1jYWNoZQ0KQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUNCkNvbm5lY3Rpb246IEtlZXAtQWxpdmUNClVzZXItQWdlbnQ6IE1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDguMDsgV2luZG93cyBOVCA2LjE7IFdPVzY0OyBUcmlkZW50LzQuMDsgU0xDQzI7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy41LjMwNzI5OyAuTkVUIENMUiAzLjAuMzA3Mjk7IE1lZGlhIENlbnRlciBQQyA2LjApL1FZLVBsYXllci1XaW5kb3dzLzIuMC4xMDINCkhvc3Q6IG1zZy43MS5hbQ0KDQo="} 01291{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1010,"source":"pps.pcap","alias":"nDPId-test","flow_id":45,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353140655,"flow_last_seen":1467353140655,"flow_idle_time":7440000,"flow_min_l4_payload_len":887,"flow_max_l4_payload_len":887,"flow_tot_l4_payload_len":887,"flow_avg_l4_payload_len":887,"midstream":1,"thread_ts_msec":1467353140655,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50475,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"msg.71.am","url":"msg.71.am\/cp2.gif?a=4e3ae415a584748ac9aa31628f39d1e8&ai=&as=1:2:1|2&av=4.10.004&b=204076701&c=6&ct=5000000926795&d=158&di=&dp=71000001&e=512ab77de7f67d49f24d3511778220d0&ec=&em=&fi=&g=0&l=MTE4LjE2My44Ljkw&mk=&nw=&od=5000000856344&oi=&p=a&pp=&rc=&rd=&ri=&s=1467353139057&sh=&sq=&sw=&t=sp&u=0_aaoefdtqgfdepxc2tnv3piucgcb4eofn&v=500494600&vv=5.2.15.2240&x=&y=qc_100001_100140","code":0,"content_type":"","user_agent":"Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\/QY-Player-Windows\/2.0.102"}} @@ -163,7 +163,7 @@ 00647{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1013,"source":"pps.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_last_seen":1467353140720,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"thread_ts_msec":1467353140720,"pkt":"ABxCjnAxTF4M6gNlCABFAAC5F1lAADMGIt3KbA7swKhzCABQxSvXmoUy4BpnKlAYACB7oAAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOC4wDQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA1OjQwIEdNVA0KQ29udGVudC1UeXBlOiBpbWFnZS9naWYNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQoNCg=="} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1014,"source":"pps.pcap","alias":"nDPId-test","flow_id":47,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353140755,"flow_last_seen":1467353140755,"flow_idle_time":7440000,"flow_min_l4_payload_len":602,"flow_max_l4_payload_len":602,"flow_tot_l4_payload_len":602,"flow_avg_l4_payload_len":602,"midstream":1,"thread_ts_msec":1467353140755,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.32.39","src_port":50476,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 01258{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1014,"source":"pps.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_last_seen":1467353140755,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":656,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":656,"pkt_l4_len":622,"thread_ts_msec":1467353140755,"pkt":"TF4M6gNlABxCjnAxCABFAAKCA\/NAAIAGOsjAqHMIZeMgJ8UsAFDdytkdPM+rpVAY\/\/BCUgAAR0VUIC92aS81MDA0OTQ2MDAvNTYyZTI2Y2FlZDU2OTU5MDAyMTJlYjMyNTkwNzBmOGEvP3NyYz0xXzExXzExNCBIVFRQLzEuMQ0KSG9zdDogY2FjaGUudmlkZW8uaXFpeWkuY29tDQpDYWNoZS1Db250cm9sOiBuby1jYWNoZQ0KQ29va2llOiBwcHNfY2xpZW50X3ZlcjI9NS4yLjE1LjIyNDA7IFQwMDQwND00ZTNhZTQxNWE1ODQ3NDhhYzlhYTMxNjI4ZjM5ZDFlODsgX3Bwc19pdmk9Vms0OU1UWXdOVEExTGFXL3BQbWhSejgvUDZUYXBFZW11RDgvcE0rd1pqOHRwTFd4M3pnd3Bsby9wR2FvY1NaV1VEMHhKbFpEUFQ4L1B6OCtwTFd4M3pnd3Bsby9wR2FvY1NaV1NqMHRNU1pXVXoxV0psWkVQU1pXVkZ0QlhUMHlNVGMxSmxaTlBTWldWajAxTGpJdU1UVXVNakkwTUNaV1ZUMW9kSFJ3T2k4dmQzZDNMbWx4YVhscExtTnZiUzkyWHpFNWNuSnNkblY0YkdjdWFIUnRiQT09OyBRQzAwNj11NTQ5dnB6MTBsOWZrYXR1bTRhbHc0YnA7IFFDMDA4PTE0NjY2NDU4MTYuMTQ2NjY0NTgxNi4xNDY2NjQ1ODE2LjE7IEhtX2x2dF81M2I3Mzc0YTYzYzM3NDgzZTVkZDk3ZDc4ZDliYjM2ZT0xNDY2NjQ1ODE3OyBRQzAwNT1hYW9lZmR0cWdmZGVweGMydG52M3BpdWNnY2I0ZW9mbg0KDQo="} -00826{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1014,"source":"pps.pcap","alias":"nDPId-test","flow_id":47,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353140755,"flow_last_seen":1467353140755,"flow_idle_time":7440000,"flow_min_l4_payload_len":602,"flow_max_l4_payload_len":602,"flow_tot_l4_payload_len":602,"flow_avg_l4_payload_len":602,"midstream":1,"thread_ts_msec":1467353140755,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.32.39","src_port":50476,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"cache.video.iqiyi.com","url":"cache.video.iqiyi.com\/vi\/500494600\/562e26caed5695900212eb3259070f8a\/?src=1_11_114","code":0,"content_type":"","user_agent":""}} +00828{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1014,"source":"pps.pcap","alias":"nDPId-test","flow_id":47,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353140755,"flow_last_seen":1467353140755,"flow_idle_time":7440000,"flow_min_l4_payload_len":602,"flow_max_l4_payload_len":602,"flow_tot_l4_payload_len":602,"flow_avg_l4_payload_len":602,"midstream":1,"thread_ts_msec":1467353140755,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.32.39","src_port":50476,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"cache.video.iqiyi.com","url":"cache.video.iqiyi.com\/vi\/500494600\/562e26caed5695900212eb3259070f8a\/?src=1_11_114","code":0,"content_type":"","user_agent":""}} 01823{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1015,"source":"pps.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":2,"flow_last_seen":1467353140794,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1078,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1078,"pkt_l4_len":1044,"thread_ts_msec":1467353140794,"pkt":"ABxCjnAxTF4M6gNlCABFAAQovhBAADEGzgRl4yAnwKhzCABQxSw8z6ul3crbd1AQPSRKcgAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54DQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA1OjQwIEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgNClRyYW5zZmVyLUVuY29kaW5nOiBjaHVua2VkDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpFeHBpcmVzOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA1OjM5IEdNVA0KQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUNCkFjY2Vzcy1Db250cm9sLUFsbG93LUNyZWRlbnRpYWxzOiB0cnVlDQoNCmQ0OQ0KeyJjblByZW1UaW1lIjowLCJlZGl0b3JJbmZvIjoiIiwidmlkZW9RaXB1SWQiOjUwMDQ5NDYwMCwicmV3YXJkQWxsb3dlZCI6MCwibnVybCI6IiIsInN1cElkIjowLCJvbmxpbmVTdGF0dXMiOjEsImR0eXBlIjozLCJwdnUiOiIiLCJpc3N1ZVRpbWUiOjIwMTYwNjI1LCJ3cml0ZXIiOiIiLCJpc1RvcENoYXJ0IjowLCJxaXlpUGxheVN0cmF0ZWd5Ijoi5q+P5ZGo5LqU5ZGo5YWtMjA6MDAiLCJ1cCI6IjIwMTYtMDYtMjkgMTk6NDc6MDIiLCJpcExpbWl0IjowLCJ1biI6IiIsImV4Y2x1c2l2ZSI6MSwidm4iOiLjgIrkuIDmtL7mlrnoqIDjgItDLUJsb2Nr6ZW\/5rKZ6K+d44CK6ICB6KGX55qE5ZGz44CLIiwicHR1cmwiOiIiLCJzdGFydFRpbWUiOi0xLCJzdCI6MjAwLCJ0eSI6MjAxNjA2MjUsInNtIjowLCJzaG93Q2hhbm5lbElkIjo2LCJwb3Z1IjoiIiwicHJvZHVjZXJzIjoiIiwiZXRtIjoiIiwic3VwTmFtZSI6IiIsInR2RW5hbWUiOiIiLCJzYyI6MCwiY2MiOjAsIm1kb3duIjowLCJwYW5vIjp7InR5cGUiOjF9LCJtYWluQWN0b3JSb2xlcyI6W10sInN1YktleSI6IjIwNDA3NjcwMSIsImFwaWMiOiJodHRwOlwvXC9waWM1LnFpeWlwaWMuY29tXC9pbWFnZVwvMjAxNjA2MjVcL2Q3XC81OVwvdl8xMTA1ODM2NjZfbV82MDEuanBnIiwiZXMiOjEsInByb2R1Y2VyIjoiIiwiZW5kVGltZSI6LTEsImF1IjoiaHR0cDpcL1wvd3d3LmlxaXlpLmNvbVwvdl8xOXJybGpmM2hnLmh0bWwiLCJjaXJjbGUiOnsidHlwZSI6MiwiaWQiOjIwNQ=="} 01823{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1016,"source":"pps.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":3,"flow_last_seen":1467353140794,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1078,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1078,"pkt_l4_len":1044,"thread_ts_msec":1467353140794,"pkt":"ABxCjnAxTF4M6gNlCABFAAQovhFAADEGzgNl4yAnwKhzCABQxSw8z6+l3crbd1AQPSTsVQAANDczOTQ3fSwiaXNEaXNwbGF5Q2lyY2xlIjoxLCJwYXlNYXJrIjowLCJwbGMiOnsiNCI6eyJjb2EiOjEsImRvd25BbGQiOjF9LCIxMCI6eyJjb2EiOjEsImRvd25BbGQiOjF9LCI1Ijp7ImNvYSI6MSwiZG93bkFsZCI6MX0sIjExIjp7ImNvYSI6MSwiZG93bkFsZCI6MX0sIjEyIjp7ImNvYSI6MSwiZG93bkFsZCI6MX0sIjciOnsiY29hIjoxLCJkb3duQWxkIjoxfSwiMTgiOnsiY29hIjoxLCJkb3duQWxkIjoxfSwiMTMiOnsiY29hIjoxLCJkb3duQWxkIjoxfSwiMTQiOnsiY29hIjoxLCJkb3duQWxkIjoxfSwiOCI6eyJjb2EiOjEsImRvd25BbGQiOjF9LCIxIjp7ImNvYSI6MSwiZG93bkFsZCI6MX0sIjkiOnsiY29hIjoxLCJkb3duQWxkIjoxfSwiNiI6eyJjb2EiOjEsImRvd25BbGQiOjF9LCIxNiI6eyJjb2EiOjEsImRvd25BbGQiOjF9LCIxNSI6eyJjb2EiOjEsImRvd25BbGQiOjF9LCIzIjp7ImNvYSI6MSwiZG93bkFsZCI6MX0sIjE3Ijp7ImNvYSI6MSwiZG93bkFsZCI6MX0sIjIiOnsiY29hIjoxLCJkb3duQWxkIjoxfSwiMjEiOnsiY29hIjoxLCJkb3duQWxkIjoxfSwiMTkiOnsiY29hIjoxLCJkb3duQWxkIjoxfSwiMjAiOnsiY29hIjoxLCJkb3duQWxkIjoxfX0sIm50dmQiOjAsInR2Rm9jdXNlIjoi6ZW\/5rKZ6K+d44CK6ICB6KGX55qE5ZGz44CLIiwiY1R5cGUiOjcsInFpeWlQcm9kdWNlZCI6MSwidm90ZXMiOltdLCJhbGJ1bVFpcHVJZCI6NTAwNDk0NjAwLCJjYXRlZ29yeUtleXdvcmRzIjoi57u86Im6LDUwMDQ5NDYwMCwwLGh0dHA6XC9cL2xpc3QuaXFpeWkuY29tXC93d3dcLzZcLy0tLS0tLS0tLS0tLS0tLS0tLS5odG1sIOWGheWcsCwxNTEsMSxodHRwOlwvXC9saXN0LmlxaXlpLmNvbVwvd3d3XC82XC8xNTEtLS0tLS0tLS0tLS0tLS0tLS0uaHRtbCDlhbblroMsMTYxLDIsaHR0cDpcL1wvbGlzdC5pcWl5aS5jb21cL3d3d1wvNlwvLTE2MS0tLS0tLS0tLS0tLS0tLS0tLmh0bWwg5q2M6IieLDIxMjEsMixodHRwOlwvXC9saXN0LmlxaXlpLmNvbVwvd3d3XC82XC8tMjEyMS0tLS0tLS0tLS0tLQ=="} 00647{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1019,"source":"pps.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":2,"flow_last_seen":1467353140888,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"thread_ts_msec":1467353140888,"pkt":"ABxCjnAxTF4M6gNlCABFAAC5fz1AADMGuwnKbA7bwKhzCABQxSlvvfQ0r4ZCsVAYADyHfQAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuNC43DQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA1OjQwIEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQoNCg=="} @@ -204,16 +204,16 @@ 01209{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1045,"source":"pps.pcap","alias":"nDPId-test","flow_id":56,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353155790,"flow_last_seen":1467353155790,"flow_idle_time":7440000,"flow_min_l4_payload_len":629,"flow_max_l4_payload_len":629,"flow_tot_l4_payload_len":629,"flow_avg_l4_payload_len":629,"midstream":1,"thread_ts_msec":1467353155790,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50487,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"msg.71.am","url":"msg.71.am\/core?t=2&chipid=Intel%28R%29%20Core%28TM%29%20i5%2D2557M%20CPU%20%40%201%2E70GHz&tm=15&ra=1&ishcdn=2&pf=201&p=11&p1=114&p2=3000&sdktp=1&c1=6&r=500494600&aid=502959900&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn&pu=&os=windows&v=5%2E2%2E15%2E2240&krv=2%2E0%2E102&dt=&hu=-1&rn=1467353155&islocal=0&as=d19f64047b641cd6ff096b04fb2a30b5&ve=3cc0c8fa372625e64143144816f3e968&pe=c95d992e29856dc84f2e9907a2e4b282&vfrm=&chl=&hcdnv=10.0.0.293&tpcd=0&isdrm=1&ht=0","code":0,"content_type":"","user_agent":"QY-Player-Windows\/2.0.102"}} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1046,"source":"pps.pcap","alias":"nDPId-test","flow_id":57,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353156641,"flow_last_seen":1467353156641,"flow_idle_time":7440000,"flow_min_l4_payload_len":257,"flow_max_l4_payload_len":257,"flow_tot_l4_payload_len":257,"flow_avg_l4_payload_len":257,"midstream":1,"thread_ts_msec":1467353156641,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50488,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00795{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1046,"source":"pps.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":1,"flow_last_seen":1467353156641,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":311,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":311,"pkt_l4_len":277,"thread_ts_msec":1467353156641,"pkt":"TF4M6gNlABxCjnAxCABFAAEpDsFAAIAGbi7AqHMI3xpqFMU4AFDYI3WbArNbVVAYAQSIDAAAR0VUIC8yMDE2MDYyNS9hNS9iZi80MTNmOTFhZDEwMWU3ODBhNmI2M2Y4MjZlMjhiOTkyMC54bWwgSFRUUC8xLjENClVzZXItQWdlbnQ6IFFZLVBsYXllci1XaW5kb3dzLzIuMC4xMDINCkhvc3Q6IG1ldGEudmlkZW8ucWl5aS5jb20NCkFjY2VwdDogKi8qDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUNCnF5aWQ6YWFvZWZkdHFnZmRlcHhjMnRudjNwaXVjZ2NiNGVvZm4NCnF5cGlkOjUwMDQ5NDYwMF8yMDEyDQpxeXBsYXRmb3JtOjAtMg0KDQo="} -00840{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1046,"source":"pps.pcap","alias":"nDPId-test","flow_id":57,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353156641,"flow_last_seen":1467353156641,"flow_idle_time":7440000,"flow_min_l4_payload_len":257,"flow_max_l4_payload_len":257,"flow_tot_l4_payload_len":257,"flow_avg_l4_payload_len":257,"midstream":1,"thread_ts_msec":1467353156641,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50488,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"meta.video.qiyi.com","url":"meta.video.qiyi.com\/20160625\/a5\/bf\/413f91ad101e780a6b63f826e28b9920.xml","code":0,"content_type":"","user_agent":"QY-Player-Windows\/2.0.102"}} +00834{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1046,"source":"pps.pcap","alias":"nDPId-test","flow_id":57,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353156641,"flow_last_seen":1467353156641,"flow_idle_time":7440000,"flow_min_l4_payload_len":257,"flow_max_l4_payload_len":257,"flow_tot_l4_payload_len":257,"flow_avg_l4_payload_len":257,"midstream":1,"thread_ts_msec":1467353156641,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50488,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"meta.video.qiyi.com","url":"meta.video.qiyi.com\/20160625\/a5\/bf\/413f91ad101e780a6b63f826e28b9920.xml","code":0,"content_type":"","user_agent":"QY-Player-Windows\/2.0.102"}} 02155{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1047,"source":"pps.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":2,"flow_last_seen":1467353156699,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1314,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1314,"pkt_l4_len":1280,"thread_ts_msec":1467353156699,"pkt":"ABxCjnAxTF4M6gNlCABFAAUU\/f1AADgGwwbfGmoUwKhzCABQxTgCs1tV2CN2nFAQAB+1jgAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IFFXUw0KRGF0ZTogRnJpLCAwMSBKdWwgMjAxNiAwNjowNTo1NiBHTVQNCkNvbnRlbnQtVHlwZTogdGV4dC94bWwNClRyYW5zZmVyLUVuY29kaW5nOiBjaHVua2VkDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpMYXN0LU1vZGlmaWVkOiBTYXQsIDI1IEp1biAyMDE2IDA2OjA4OjM2IEdNVA0KRXhwaXJlczogRnJpLCAwMSBKdWwgMjAxNiAwNjowNjo1MCBHTVQNCkNhY2hlLUNvbnRyb2w6IG1heC1hZ2U9MzAwDQpYLUNhY2hlOiBmcm9tIDEwLjEyMS4zNC4xNDANCkNvbnRlbnQtRW5jb2Rpbmc6IGd6aXANClgtQ2FjaGU6IEhJVCBmcm9tIDEwLjEyMS4zMy45OA0KWC1DYWNoZTogRVhQSVJFRCBmcm9tIDIyMy4yNi4xMDYuMjANCg0KNWZlDQofiwgAAAAAAAADhZnrbhs5DIX\/9ykCP8BEFC+SAHf6KIuxM26NzaWtnezl6fewDtIUXdIpUNvjY4n6SJHizPbT3w\/3Ny\/r99Px6fHjhqayufk0f9gejvfraT3PH262h\/uXm8flYf24KTtalr7wbmfrfuyoDO1dZLfXhdbdbj9BusFPbrZf1uPnL+eZrWxvX9\/75b+Od+cvswmuXt76xfPxYT2dl4ev+6fH8\/Hx+en5NNP29v8uu\/yHZcd\/17kXbaXK9vbtin999\/x9OWMtM2mf2Nr29u2Kf\/1yvFuf\/jgvn+cyCv64+v8\/\/6i9vSfYWehwOKyE1ztrl8\/LXq1KWUo9HIYZXv1fv\/yMS7m8oyGt76nv1QfBl2p97WM51P1FWfhue\/vTGrdteb47vtp2GeSHha9yvCwHDMUDQ626qFw0uE5g8PO3PtKf6z+H73DZaf32vD7u15M75d3lHx9fyV\/eg8xy\/7zeHO\/g5s1cJowL+\/za7wK6JqibmaZR4xF4M3MqkM2sqUA3c0sFtpnHBEbhKhqMpAmeCxUdCk4VAwpNFQSa1HIJeNLIJSBac2MJTGtuLYFqvWIuuFabWuI7AtnacwnYcsklgMs1l4AuSyqpoMu5uRV0OTe3gq7k5lbQldzcCroikyUBVUFXLJeAriCyPXMG26+CroxJEx9V0NUyWRL+FXS1pqMw6KrkEtBVyyWgi1ycmcugayWXgK5RuiIGXeOpeHkJ0DHomkxI+rEEdM1yCehazyWga2OSxBYB3Ua5BHRbTeNFQLdJumgB3aaTJiEloNtaLvGMi6jLRgHdTrkEdDvnEtDtV8wF3Q5zkx2goNvhgGQ3KugOOCCTgO7gXAK6Q3MJ6I6WS0B3XDEXdKlcsRd4qdSpZ2sCXyoy4egTbgIFYCqWhpWBMJWea4CYCKeJZB8YGBPVXAPIRHmYGygTXbEZmImu2Oyc6xWbnXO9YrNzrldsds6otxmf5pxRcFONc0bFTTXOGSU31Thn1NxU45xRdFONc0bVzU6RzTnzSFN6c84ozek5zjmjNqca54zinGm6c0Z1bkmG685ZcJrINM4ZxTfVOGeldJ9256yca5yzaq5xztp+07y2WK+9gDdRX59OR++dLu2Cd0vve4JaK7qpoLCCS2Wy8Htn0uHJGipAhNHRUTwH"} 01353{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1048,"source":"pps.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":3,"flow_last_seen":1467353156700,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":721,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":721,"pkt_l4_len":687,"thread_ts_msec":1467353156700,"pkt":"ABxCjnAxTF4M6gNlCABFAALD\/f5AADgGxVbfGmoUwKhzCABQxTgCs2BB2CN2nFAYAB9NTQAAeAj6KkVzGFgBGjLKoHgWsNDOg9EyBWMg4qw3sngWxFvTJslqEW1dOtsIZ\/G2YAiauUTisVZE0efGwzjXWg05LdZ4rAky0eBYc4m1ISOZy2PN0IHWZC6PtYYzQuJG8j0ND\/TECQTGtXRrmc2gXLGqInHIeH+AZh3hH4eENwhVsfKSjAPO1cTSYzk4VwRGT0LHe4TarWqyLm8S6mgVURj6q4IzFzPKNODMJE042ZbgzNQZongucObqtx3iTeOdAgtOFElsMDiz4j7IiGOewZkNmDWZyzNFp1ZHvEUZnLk3hGq8dm8XeCg2YczZ+wUeo3ON9wWDs+AA03qiAWdBguyZBpyFEaoU8\/GeQWCxJqlYwFm0ElwW+tS7BtGB8In5eNsgxoYYisfxnNwQiUliF8\/KHRWxxZwFnLGTCyWxIc55GI5LybrAWQsivsW+EHBWpMMucU7w7kGRWyyJeW8flHELMtOAswKQchyrCs6qvbWEs4Kz2mjW4n2q4IzsMyyJDQVn3LPtqKOhTxWcdXQc7RMNOFtBRUl84T0EvFVRbcO5vIcwFIPOsU8NnJExccMztsd7CARqqdlc4IxwNkRibA84m1Rl7rEGnA1No1kcPwbOptwRi\/E44GyK5JL0auaczVRLvE\/NOTdmsdhm7yG8mHJSC5pz7grS8T5tznl40Y3X3pwzVoX9E669gXMrSszJXODcCF1fS8YBZ9yrRE6I97v3EKimuN8fx2ED54ZUh6iPbQbnJlpQLEON9xDNzxJJTvAeopn2mnDu4Nya74w45js4t45NmNQ47yFa70xJ7u3OefiZN1kXOHesvIxf4\/Dy8OXXvmF7+\/b4wXuLdx\/fPY3AD+9f8Jzp8vDGHzT9Byu2GoeKGgAADQowDQoNCg=="} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1049,"source":"pps.pcap","alias":"nDPId-test","flow_id":58,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353156959,"flow_last_seen":1467353156959,"flow_idle_time":7440000,"flow_min_l4_payload_len":199,"flow_max_l4_payload_len":199,"flow_tot_l4_payload_len":199,"flow_avg_l4_payload_len":199,"midstream":1,"thread_ts_msec":1467353156959,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"119.188.13.188","src_port":50489,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00719{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1049,"source":"pps.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_last_seen":1467353156959,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":253,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":253,"pkt_l4_len":219,"thread_ts_msec":1467353156959,"pkt":"TF4M6gNlABxCjnAxCABFAADvDvNAAIAGMe3AqHMId7wNvMU5AFAa+1ILYx41VVAYAQTDtAAAR0VUIC9rIEhUVFAvMS4xDQpVc2VyLUFnZW50OiBRWS1QbGF5ZXItV2luZG93cy8yLjAuMTAyDQpIb3N0OiBwZGF0YS52aWRlby5xaXlpLmNvbQ0KQWNjZXB0OiAqLyoNCkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQ0KcXlpZDphYW9lZmR0cWdmZGVweGMydG52M3BpdWNnY2I0ZW9mbg0KcXlwaWQ6XzIwMTINCnF5cGxhdGZvcm06MC0yDQoNCg=="} -00790{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1049,"source":"pps.pcap","alias":"nDPId-test","flow_id":58,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353156959,"flow_last_seen":1467353156959,"flow_idle_time":7440000,"flow_min_l4_payload_len":199,"flow_max_l4_payload_len":199,"flow_tot_l4_payload_len":199,"flow_avg_l4_payload_len":199,"midstream":1,"thread_ts_msec":1467353156959,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"119.188.13.188","src_port":50489,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"pdata.video.qiyi.com","url":"pdata.video.qiyi.com\/k","code":0,"content_type":"","user_agent":"QY-Player-Windows\/2.0.102"}} +00784{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1049,"source":"pps.pcap","alias":"nDPId-test","flow_id":58,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353156959,"flow_last_seen":1467353156959,"flow_idle_time":7440000,"flow_min_l4_payload_len":199,"flow_max_l4_payload_len":199,"flow_tot_l4_payload_len":199,"flow_avg_l4_payload_len":199,"midstream":1,"thread_ts_msec":1467353156959,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"119.188.13.188","src_port":50489,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"pdata.video.qiyi.com","url":"pdata.video.qiyi.com\/k","code":0,"content_type":"","user_agent":"QY-Player-Windows\/2.0.102"}} 00955{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1050,"source":"pps.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":2,"flow_last_seen":1467353156998,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":430,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":430,"pkt_l4_len":396,"thread_ts_msec":1467353156998,"pkt":"ABxCjnAxTF4M6gNlCABFAAGgqmFAADQG4c13vA28wKhzCABQxTljHjVVGvtS0lAYAB+FPAAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOS40DQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA1OjU2IEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCkNvbm5lY3Rpb246IGtlZXAtYWxpdmUNCkNvbnRlbnQtTGVuZ3RoOiAyMDQNCkNhY2hlLUNvbnRyb2w6IG5vLWNhY2hlDQoNCnsidCI6IjE0NjczNTMxNTYiLCJtIjoiZWMyZmQ2Njc4YTM1N2MyMDhkNTE4NmIzYzM0MjI0NmJlZTQ0YzUwY2U3MDgzOTNlIiwidSI6ImVjMmZkNjY3OGEzNTdjMjBmNTVhODJlZDYwZjYzZjk2Y2QyMDlhMWQ4OGI3ODQyNSIsImkiOiIyMjAuMTgxLjEwOS4zMyIsImsiOiJlYzJmZDY2NzhhMzU3YzIwNjI1MTY2M2U4NGQ3MDFkOTlkYjQyZTUxY2I5MWM1MzkifQ=="} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1051,"source":"pps.pcap","alias":"nDPId-test","flow_id":59,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353157063,"flow_last_seen":1467353157063,"flow_idle_time":7440000,"flow_min_l4_payload_len":303,"flow_max_l4_payload_len":303,"flow_tot_l4_payload_len":303,"flow_avg_l4_payload_len":303,"midstream":1,"thread_ts_msec":1467353157063,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"119.188.13.188","src_port":50490,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00855{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1051,"source":"pps.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":1,"flow_last_seen":1467353157063,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":357,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":357,"pkt_l4_len":323,"thread_ts_msec":1467353157063,"pkt":"TF4M6gNlABxCjnAxCABFAAFXDwhAAIAGMXDAqHMId7wNvMU6AFAWZyP1RIzmWFAYAQR4owAAR0VUIC8yZWZjOGNkNWZiZTBmNGVlNDk4ZmIxYzJmYzFkZThiNi92aWRlb3MvdjAvMjAxNjA2MjUvYTUvYmYvOGRlOWJiOTQ2OTcyYTg4NTg5ZDE2Njc4NjIyOTIxMzAuZjR2PyZ0bj0xMzc3MTkgSFRUUC8xLjENClVzZXItQWdlbnQ6IFFZLVBsYXllci1XaW5kb3dzLzIuMC4xMDINCkhvc3Q6IHBkYXRhLnZpZGVvLnFpeWkuY29tDQpBY2NlcHQ6ICovKg0KQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlDQpxeWlkOmFhb2VmZHRxZ2ZkZXB4YzJ0bnYzcGl1Y2djYjRlb2ZuDQpxeXBpZDpfMjAxMg0KcXlwbGF0Zm9ybTowLTINCg0K"} -00900{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1051,"source":"pps.pcap","alias":"nDPId-test","flow_id":59,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353157063,"flow_last_seen":1467353157063,"flow_idle_time":7440000,"flow_min_l4_payload_len":303,"flow_max_l4_payload_len":303,"flow_tot_l4_payload_len":303,"flow_avg_l4_payload_len":303,"midstream":1,"thread_ts_msec":1467353157063,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"119.188.13.188","src_port":50490,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"pdata.video.qiyi.com","url":"pdata.video.qiyi.com\/2efc8cd5fbe0f4ee498fb1c2fc1de8b6\/videos\/v0\/20160625\/a5\/bf\/8de9bb946972a88589d1667862292130.f4v?&tn=137719","code":0,"content_type":"","user_agent":"QY-Player-Windows\/2.0.102"}} +00894{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1051,"source":"pps.pcap","alias":"nDPId-test","flow_id":59,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353157063,"flow_last_seen":1467353157063,"flow_idle_time":7440000,"flow_min_l4_payload_len":303,"flow_max_l4_payload_len":303,"flow_tot_l4_payload_len":303,"flow_avg_l4_payload_len":303,"midstream":1,"thread_ts_msec":1467353157063,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"119.188.13.188","src_port":50490,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"pdata.video.qiyi.com","url":"pdata.video.qiyi.com\/2efc8cd5fbe0f4ee498fb1c2fc1de8b6\/videos\/v0\/20160625\/a5\/bf\/8de9bb946972a88589d1667862292130.f4v?&tn=137719","code":0,"content_type":"","user_agent":"QY-Player-Windows\/2.0.102"}} 01021{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1052,"source":"pps.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":2,"flow_last_seen":1467353157103,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":479,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":479,"pkt_l4_len":445,"thread_ts_msec":1467353157103,"pkt":"ABxCjnAxTF4M6gNlCABFAAHRefhAADQGEgZ3vA28wKhzCABQxTpEjOZYFmclJFAYAB\/Y6wAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOS40DQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA1OjU2IEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L3BsYWluDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpDb250ZW50LUxlbmd0aDogMjUyDQpDYWNoZS1Db250cm9sOiBuby1jYWNoZQ0KDQp7InQiOiJPVkVSU0VBfFRXX0hpTmV0LTExOC4xNjMuOC45MCIsInoiOiJ0YWliZWlfb3RoZXIiLCJoIjoiLTcyIiwibCI6Imh0dHA6Ly8yMjMuMjYuMTA2LjY2L3ZpZGVvcy92MC8yMDE2MDYyNS9hNS9iZi84ZGU5YmI5NDY5NzJhODg1ODlkMTY2Nzg2MjI5MjEzMC5mNHY\/a2V5PTA3ZWVmMTgyMWUyMzc5ZDMxMzZmZmUxNjA4MjE4NWJhMiZzcmM9aXFpeWkuY29tJiZ0bj0xMzc3MTkmdXVpZD03NmEzMDg1YS01Nzc2MDg0NC1kZSIsImUiOiIwIn0="} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1053,"source":"pps.pcap","alias":"nDPId-test","flow_id":60,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353157138,"flow_last_seen":1467353157138,"flow_idle_time":7440000,"flow_min_l4_payload_len":372,"flow_max_l4_payload_len":372,"flow_tot_l4_payload_len":372,"flow_avg_l4_payload_len":372,"midstream":1,"thread_ts_msec":1467353157138,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.66","src_port":50491,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00947{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1053,"source":"pps.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":1,"flow_last_seen":1467353157138,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":426,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":426,"pkt_l4_len":392,"thread_ts_msec":1467353157138,"pkt":"TF4M6gNlABxCjnAxCABFAAGcDxlAAIAGbTXAqHMI3xpqQsU7AFAuAjEcSma44VAYAQTWMgAAR0VUIC92aWRlb3MvdjAvMjAxNjA2MjUvYTUvYmYvOGRlOWJiOTQ2OTcyYTg4NTg5ZDE2Njc4NjIyOTIxMzAuZjR2P2tleT0wN2VlZjE4MjFlMjM3OWQzMTM2ZmZlMTYwODIxODViYTImc3JjPWlxaXlpLmNvbSYmdG49MTM3NzE5JnV1aWQ9NzZhMzA4NWEtNTc3NjA4NDQtZGUgSFRUUC8xLjENClJhbmdlOiBieXRlcz0wLTQwOTU5DQpVc2VyLUFnZW50OiBRWS1QbGF5ZXItV2luZG93cy8yLjAuMTAyDQpIb3N0OiAyMjMuMjYuMTA2LjY2DQpBY2NlcHQ6ICovKg0KQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlDQpxeWlkOmFhb2VmZHRxZ2ZkZXB4YzJ0bnYzcGl1Y2djYjRlb2ZuDQpxeXBpZDo1MDA0OTQ2MDBfMjAxMg0KcXlwbGF0Zm9ybTowLTINCg0K"} @@ -223,7 +223,7 @@ 01059{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":1055,"source":"pps.pcap","alias":"nDPId-test","flow_id":60,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1467353157138,"flow_last_seen":1467353157142,"flow_idle_time":7440000,"flow_min_l4_payload_len":372,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":2892,"flow_avg_l4_payload_len":964,"midstream":1,"thread_ts_msec":1467353157142,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.66","src_port":50491,"dst_port":80,"l4_proto":"tcp","ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}}},"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"223.26.106.66","url":"223.26.106.66\/videos\/v0\/20160625\/a5\/bf\/8de9bb946972a88589d1667862292130.f4v?key=07eef1821e2379d3136ffe16082185ba2&src=iqiyi.com&&tn=137719&uuid=76a3085a-57760844-de","code":0,"content_type":"","user_agent":"QY-Player-Windows\/2.0.102"}} 00582{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1080,"source":"pps.pcap","alias":"nDPId-test","flow_id":61,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353157433,"flow_last_seen":1467353157433,"flow_idle_time":7440000,"flow_min_l4_payload_len":335,"flow_max_l4_payload_len":335,"flow_tot_l4_payload_len":335,"flow_avg_l4_payload_len":335,"midstream":1,"thread_ts_msec":1467353157433,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.13.3","src_port":50492,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00900{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1080,"source":"pps.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":1,"flow_last_seen":1467353157433,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":389,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":389,"pkt_l4_len":355,"thread_ts_msec":1467353157433,"pkt":"TF4M6gNlABxCjnAxCABFAAF3D2lAAIAGOZbAqHMIb84NA8U8AFD\/xaF06zAEllAYAQRGTAAAR0VUIC8yZWZjOGNkNWZiZTBmNGVlNDk4ZmIxYzJmYzFkZThiNi92aWRlb3MvdjAvMjAxNjA2MjUvYTUvYmYvOGRlOWJiOTQ2OTcyYTg4NTg5ZDE2Njc4NjIyOTIxMzAuZjR2P3F5aWQ9YWFvZWZkdHFnZmRlcHhjMnRudjNwaXVjZ2NiNGVvZm4mcXlwaWQ9MjAxMiBIVFRQLzEuMQ0KSG9zdDogcGRhdGEudmlkZW8ucWl5aS5jb20NCkFjY2VwdDogKi8qDQpBY2NlcHQtTGFuZ3VhZ2U6IHpoLWNuDQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQpVc2VyLUFnZW50OiBIQ0ROQ2xpZW50X1dJTlBDO2xpYmN1cmwvNy4yNi4wIE9wZW5TU0wvMS4wLjFnIHpsaWIvMS4yLjU7UUsvMTAuMC4wLjI5Mw0KDQo="} -00985{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1080,"source":"pps.pcap","alias":"nDPId-test","flow_id":61,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353157433,"flow_last_seen":1467353157433,"flow_idle_time":7440000,"flow_min_l4_payload_len":335,"flow_max_l4_payload_len":335,"flow_tot_l4_payload_len":335,"flow_avg_l4_payload_len":335,"midstream":1,"thread_ts_msec":1467353157433,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.13.3","src_port":50492,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"pdata.video.qiyi.com","url":"pdata.video.qiyi.com\/2efc8cd5fbe0f4ee498fb1c2fc1de8b6\/videos\/v0\/20160625\/a5\/bf\/8de9bb946972a88589d1667862292130.f4v?qyid=aaoefdtqgfdepxc2tnv3piucgcb4eofn&qypid=2012","code":0,"content_type":"","user_agent":"HCDNClient_WINPC;libcurl\/7.26.0 OpenSSL\/1.0.1g zlib\/1.2.5;QK\/10.0.0.293"}} +00979{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1080,"source":"pps.pcap","alias":"nDPId-test","flow_id":61,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353157433,"flow_last_seen":1467353157433,"flow_idle_time":7440000,"flow_min_l4_payload_len":335,"flow_max_l4_payload_len":335,"flow_tot_l4_payload_len":335,"flow_avg_l4_payload_len":335,"midstream":1,"thread_ts_msec":1467353157433,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.13.3","src_port":50492,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"pdata.video.qiyi.com","url":"pdata.video.qiyi.com\/2efc8cd5fbe0f4ee498fb1c2fc1de8b6\/videos\/v0\/20160625\/a5\/bf\/8de9bb946972a88589d1667862292130.f4v?qyid=aaoefdtqgfdepxc2tnv3piucgcb4eofn&qypid=2012","code":0,"content_type":"","user_agent":"HCDNClient_WINPC;libcurl\/7.26.0 OpenSSL\/1.0.1g zlib\/1.2.5;QK\/10.0.0.293"}} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1081,"source":"pps.pcap","alias":"nDPId-test","flow_id":62,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353157468,"flow_last_seen":1467353157468,"flow_idle_time":7440000,"flow_min_l4_payload_len":892,"flow_max_l4_payload_len":892,"flow_tot_l4_payload_len":892,"flow_avg_l4_payload_len":892,"midstream":1,"thread_ts_msec":1467353157468,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50493,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 01643{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1081,"source":"pps.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":1,"flow_last_seen":1467353157468,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":946,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":946,"pkt_l4_len":912,"thread_ts_msec":1467353157468,"pkt":"TF4M6gNlABxCjnAxCABFAAOkD3JAAIAG2tjAqHMIymwO7MU9AFA84A6MMfAazlAYQTez3QAAR0VUIC9jcDIuZ2lmP2E9NGUzYWU0MTVhNTg0NzQ4YWM5YWEzMTYyOGYzOWQxZTgmYWk9JmFzPTE6MjM6MjN8NDUmYXY9NC4xMC4wMDQmYj0xODA5MzIzMDEmYz0zMSZjdD01MDAwMDAwOTI3NTU4JmQ9MjE3NSZkaT0mZHA9NzEwMDAwMDEmZT1jNDg4OWU2NGFkOWQ5ZWViOWZmNDM4OTEwODUwYzQ0MiZlYz0mZW09JmZpPSZnPTAmbD1NVEU0TGpFMk15NDRMamt3Jm1rPSZudz0mb2Q9NTAwMDAwMDg1ODg3NCZvaT0mcD1hJnBwPSZyYz0mcmQ9JnJpPSZzPTE0NjczNTMxNTcwNDYmc2g9JnNxPSZzdz0mdD0zcSZ1PTBfYWFvZWZkdHFnZmRlcHhjMnRudjNwaXVjZ2NiNGVvZm4mdj00Nzk1MzEwMDAmdnY9NS4yLjE1LjIyNDAmeD0meT1xY18xMDAwMDFfMTAwMTQwIEhUVFAvMS4xDQpBY2NlcHQtTGFuZ3VhZ2U6IHpoLUNODQpSZWZlcmVyOiBodHRwOi8vd3d3LmlxaXlpLmNvbS9jb21tb24vZmxhc2hwbGF5ZXIvMjAxNDA5MjQvTWFpblBsYXllcl81XzJfM19jM18yXzFfNi5zd2YNCnF5aWQ6IGFhb2VmZHRxZ2ZkZXB4YzJ0bnYzcGl1Y2djYjRlb2ZuDQpxeXBpZDogXzIwMTINCnF5cGxhdGZvcm06IDAtMg0KeC1mbGFzaC12ZXJzaW9uOiAxMiwwLDAsNzANCkFjY2VwdDogKi8qDQpQcmFnbWE6IG5vLWNhY2hlDQpDYWNoZS1Db250cm9sOiBuby1jYWNoZQ0KQ29ubmVjdGlvbjogS2VlcC1BbGl2ZQ0KVXNlci1BZ2VudDogTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgOC4wOyBXaW5kb3dzIE5UIDYuMTsgV09XNjQ7IFRyaWRlbnQvNC4wOyBTTENDMjsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjUuMzA3Mjk7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgTWVkaWEgQ2VudGVyIFBDIDYuMCkvUVktUGxheWVyLVdpbmRvd3MvMi4wLjEwMg0KSG9zdDogbXNnLjcxLmFtDQoNCg=="} 01296{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1081,"source":"pps.pcap","alias":"nDPId-test","flow_id":62,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353157468,"flow_last_seen":1467353157468,"flow_idle_time":7440000,"flow_min_l4_payload_len":892,"flow_max_l4_payload_len":892,"flow_tot_l4_payload_len":892,"flow_avg_l4_payload_len":892,"midstream":1,"thread_ts_msec":1467353157468,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50493,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"msg.71.am","url":"msg.71.am\/cp2.gif?a=4e3ae415a584748ac9aa31628f39d1e8&ai=&as=1:23:23|45&av=4.10.004&b=180932301&c=31&ct=5000000927558&d=2175&di=&dp=71000001&e=c4889e64ad9d9eeb9ff438910850c442&ec=&em=&fi=&g=0&l=MTE4LjE2My44Ljkw&mk=&nw=&od=5000000858874&oi=&p=a&pp=&rc=&rd=&ri=&s=1467353157046&sh=&sq=&sw=&t=3q&u=0_aaoefdtqgfdepxc2tnv3piucgcb4eofn&v=479531000&vv=5.2.15.2240&x=&y=qc_100001_100140","code":0,"content_type":"","user_agent":"Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\/QY-Player-Windows\/2.0.102"}} @@ -250,7 +250,7 @@ 00647{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1109,"source":"pps.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":2,"flow_last_seen":1467353165410,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"thread_ts_msec":1467353165410,"pkt":"ABxCjnAxTF4M6gNlCABFAAC5NehAADMGBE7KbA7swKhzCABQxT9xQcd9Us+DmFAYACAMewAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOC4wDQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA2OjA0IEdNVA0KQ29udGVudC1UeXBlOiBpbWFnZS9naWYNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQoNCg=="} 00588{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1110,"source":"pps.pcap","alias":"nDPId-test","flow_id":67,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353165456,"flow_last_seen":1467353165456,"flow_idle_time":7440000,"flow_min_l4_payload_len":1260,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":1260,"midstream":1,"thread_ts_msec":1467353165456,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50496,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 02137{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1110,"source":"pps.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":1,"flow_last_seen":1467353165456,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1314,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1314,"pkt_l4_len":1280,"thread_ts_msec":1467353165456,"pkt":"TF4M6gNlABxCjnAxCABFAAUUGh1AAIAGeifAqHMIZePIC8VAAFBgEsEemWlGj1AQ\/\/DZSAAAR0VUIC90cmFjazI\/YT0wJmFzPTE7MiwzOzQsNSZiPTE0NjczNTMxNjUmYz05NjY1NDJjODJhNTY5NGQwZTk0M2Q1MGQ1ZmNmNWE1NSZjdj01LjIuMTUuMjI0MCZkPTUwMDAwMDA4NTQ5MzQmZHI9MjE3NSZmPTRlM2FlNDE1YTU4NDc0OGFjOWFhMzE2MjhmMzlkMWU4Jmc9MF9hYW9lZmR0cWdmZGVweGMydG52M3BpdWNnY2I0ZW9mbiZoPSZpPXFjXzEwMDAwMV8xMDAxNDAmaXY9MCZqPTMxJms9MTgwOTMyMzAxJmtwPTRlM2FlNDE1YTU4NDc0OGFjOWFhMzE2MjhmMzlkMWU4Jm49NDc5NTMxMDAwJm89MSZwPTEwMDAwMDAwMDAzODEmcT01MDAwMDAwOTIzNDQ3JnI9YzQ4ODllNjRhZDlkOWVlYjlmZjQzODkxMDg1MGM0NDImcnQ9MTQ2NzM1MzExMyZzPThlZGI2OTRjOGM4Y2NhOTIzZDNlYWU2NjIyZjlhZWU2JnN2PTQuMTAuMDA0JnU9MSZ1cD0mdj01MDAwMDAwODU0ODU4JnZlPTEmdz00LDUgSFRUUC8xLjENCkFjY2VwdC1MYW5ndWFnZTogemgtQ04NClJlZmVyZXI6IGh0dHA6Ly93d3cuaXFpeWkuY29tL2NvbW1vbi9mbGFzaHBsYXllci8yMDE0MDkyNC9NYWluUGxheWVyXzVfMl8zX2MzXzJfMV82LnN3Zg0KcXlpZDogYWFvZWZkdHFnZmRlcHhjMnRudjNwaXVjZ2NiNGVvZm4NCnF5cGlkOiBfMjAxMg0KcXlwbGF0Zm9ybTogMC0yDQp4LWZsYXNoLXZlcnNpb246IDEyLDAsMCw3MA0KQWNjZXB0OiAqLyoNClByYWdtYTogbm8tY2FjaGUNCkNhY2hlLUNvbnRyb2w6IG5vLWNhY2hlDQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQpVc2VyLUFnZW50OiBNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA4LjA7IFdpbmRvd3MgTlQgNi4xOyBXT1c2NDsgVHJpZGVudC80LjA7IFNMQ0MyOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuNS4zMDcyOTsgLk5FVCBDTFIgMy4wLjMwNzI5OyBNZWRpYSBDZW50ZXIgUEMgNi4wKS9RWS1QbGF5ZXItV2luZG93cy8yLjAuMTAyDQpIb3N0OiBhcGkuY3VwaWQuaXFpeWkuY29tDQpDb29raWU6IHBwc19jbGllbnRfdmVyMj01LjIuMTUuMjI0MDsgVDAwNDA0PTRlM2FlNDE1YTU4NDc0OGFjOWFhMzE2MjhmMzlkMWU4OyBfcHBzX2l2aT1WazQ5TVRZd05UQTFMYVcvcFBtaFJ6OC9QNlRhcEVlbXVEOC9wTSt3Wmo4dHBMV3gzemd3cGxvL3BHYW9jU1pXVUQweEpsWkRQVDgvUHo4K3BMV3gzemd3cGxvL3BHYW9jU1pXU2owdE1TWldVejFXSmxaRVBTWldWRnRCWFQweU1UYzFKbFpOUFNaV1ZqMDFMakl1TVRVdU1qSTBNQ1pXVlQxb2RIUndPaTh2ZDNkM0xtbHhhWGxwTG1OdmJTOTJYekU1Y25K"} -01394{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1110,"source":"pps.pcap","alias":"nDPId-test","flow_id":67,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353165456,"flow_last_seen":1467353165456,"flow_idle_time":7440000,"flow_min_l4_payload_len":1260,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":1260,"midstream":1,"thread_ts_msec":1467353165456,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50496,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"api.cupid.iqiyi.com","url":"api.cupid.iqiyi.com\/track2?a=0&as=1;2,3;4,5&b=1467353165&c=966542c82a5694d0e943d50d5fcf5a55&cv=5.2.15.2240&d=5000000854934&dr=2175&f=4e3ae415a584748ac9aa31628f39d1e8&g=0_aaoefdtqgfdepxc2tnv3piucgcb4eofn&h=&i=qc_100001_100140&iv=0&j=31&k=180932301&kp=4e3ae415a584748ac9aa31628f39d1e8&n=479531000&o=1&p=1000000000381&q=5000000923447&r=c4889e64ad9d9eeb9ff438910850c442&rt=1467353113&s=8edb694c8c8cca923d3eae6622f9aee6&sv=4.10.004&u=1&up=&v=5000000854858&ve=1&w=4,5","code":0,"content_type":"","user_agent":"Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\/QY-Player-Windows\/2.0.102"}} +01396{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1110,"source":"pps.pcap","alias":"nDPId-test","flow_id":67,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353165456,"flow_last_seen":1467353165456,"flow_idle_time":7440000,"flow_min_l4_payload_len":1260,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":1260,"midstream":1,"thread_ts_msec":1467353165456,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50496,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"api.cupid.iqiyi.com","url":"api.cupid.iqiyi.com\/track2?a=0&as=1;2,3;4,5&b=1467353165&c=966542c82a5694d0e943d50d5fcf5a55&cv=5.2.15.2240&d=5000000854934&dr=2175&f=4e3ae415a584748ac9aa31628f39d1e8&g=0_aaoefdtqgfdepxc2tnv3piucgcb4eofn&h=&i=qc_100001_100140&iv=0&j=31&k=180932301&kp=4e3ae415a584748ac9aa31628f39d1e8&n=479531000&o=1&p=1000000000381&q=5000000923447&r=c4889e64ad9d9eeb9ff438910850c442&rt=1467353113&s=8edb694c8c8cca923d3eae6622f9aee6&sv=4.10.004&u=1&up=&v=5000000854858&ve=1&w=4,5","code":0,"content_type":"","user_agent":"Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\/QY-Player-Windows\/2.0.102"}} 00705{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1111,"source":"pps.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":2,"flow_last_seen":1467353165456,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":241,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":241,"pkt_l4_len":207,"thread_ts_msec":1467353165456,"pkt":"TF4M6gNlABxCjnAxCABFAADjGh5AAIAGflfAqHMIZePIC8VAAFBgEsYKmWlGj1AY\/\/BFbwAAc2RuVjRiR2N1YUhSdGJBPT07IFFDMDA2PXU1NDl2cHoxMGw5ZmthdHVtNGFsdzRicDsgUUMwMDg9MTQ2NjY0NTgxNi4xNDY2NjQ1ODE2LjE0NjY2NDU4MTYuMTsgSG1fbHZ0XzUzYjczNzRhNjNjMzc0ODNlNWRkOTdkNzhkOWJiMzZlPTE0NjY2NDU4MTc7IFFDMDA1PWFhb2VmZHRxZ2ZkZXB4YzJ0bnYzcGl1Y2djYjRlb2ZuDQoNCg=="} 00788{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1112,"source":"pps.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":3,"flow_last_seen":1467353165492,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":306,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":306,"pkt_l4_len":272,"thread_ts_msec":1467353165492,"pkt":"ABxCjnAxTF4M6gNlCABFAAEkdU5AAC8Gc+Zl48gLwKhzCABQxUCZaUaPYBLGxVAYP\/ygXgAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOC4wDQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA2OjA1IEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgNCkNvbnRlbnQtTGVuZ3RoOiAyDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpDYWNoZS1Db250cm9sOiBuby1jYWNoZQ0KQWNjZXNzLUNvbnRyb2wtQWxsb3ctQ3JlZGVudGlhbHM6IHRydWUNCkNhY2hlLUNvbnRyb2w6IG5vLWNhY2hlDQoNCm9r"} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1113,"source":"pps.pcap","alias":"nDPId-test","flow_id":68,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353165563,"flow_last_seen":1467353165563,"flow_idle_time":7440000,"flow_min_l4_payload_len":950,"flow_max_l4_payload_len":950,"flow_tot_l4_payload_len":950,"flow_avg_l4_payload_len":950,"midstream":1,"thread_ts_msec":1467353165563,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.112.49","src_port":50497,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} @@ -267,11 +267,11 @@ 00643{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1121,"source":"pps.pcap","alias":"nDPId-test","flow_id":70,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353166729,"flow_last_seen":1467353166729,"flow_idle_time":180000,"flow_min_l4_payload_len":123,"flow_max_l4_payload_len":123,"flow_tot_l4_payload_len":123,"flow_avg_l4_payload_len":123,"midstream":0,"thread_ts_msec":1467353166729,"l3_proto":"ip4","src_ip":"192.168.5.63","dst_ip":"239.255.255.250","src_port":60976,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1122,"source":"pps.pcap","alias":"nDPId-test","flow_id":71,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353167288,"flow_last_seen":1467353167288,"flow_idle_time":7440000,"flow_min_l4_payload_len":640,"flow_max_l4_payload_len":640,"flow_tot_l4_payload_len":640,"flow_avg_l4_payload_len":640,"midstream":1,"thread_ts_msec":1467353167288,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.110.220.15","src_port":50498,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 01311{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1122,"source":"pps.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":1,"flow_last_seen":1467353167288,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":694,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":694,"pkt_l4_len":660,"thread_ts_msec":1467353167288,"pkt":"TF4M6gNlABxCjnAxCABFAAKoG9BAAIAGqFHAqHMIJG7cD8VCAFB9qW\/gOgaPJFAY\/\/DRFwAAR0VUIC90bXBzdGF0cy5naWY\/dHlwZT1yZWNjdHBsYXkyMDEyMTIyNiZ1c3JhY3Q9c2hvdyZwcHVpZD0tMSZ1aWQ9YWFvZWZkdHFnZmRlcHhjMnRudjNwaXVjZ2NiNGVvZm4mZXZlbnRfaWQ9NGIwODY4OTIwYjBmODI4NTMyMGE5ZTAwZWUwMzY5ZTUmY2lkPTMxJmJrdD1wcHNfY196ZWJyYV9tYWluX2RlZmF1bHQmYXJlYT1wcHNfY196ZWJyYSZwbGF0Zm9ybT0yMDEyJmFsYnVtbGlzdD00NzA2OTQ1MDAsNDcxNTkxMzAwLDQ2NTY0MTAwMCw0NzI4ODcxMDAsNDcxNzg4MTAwLDQ3Mzc0NjMwMCw0NzE5NDgzMDAsNDczNjk0NjAwLDQ3MjE4OTUwMCZhaWQ9NDc5NTMxMDAwJnNvdXJjZT0wLDEsMSwxLDEsMSwxLDEsMSZfPTE0NjczNTMxNjcwODcgSFRUUC8xLjENCkFjY2VwdDogKi8qDQpSZWZlcmVyOiBodHRwOi8vdm9kZ3VpZGUucHBzLmlxaXlpLmNvbS9wYWdlLnBocD92ZXJzaW9uPTUuMi4xNS4yMjQwDQpBY2NlcHQtTGFuZ3VhZ2U6IHpoLVRXDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUNClVzZXItQWdlbnQ6IE1vemlsbGEvNS4wIChjb21wYXRpYmxlOyBNU0lFIDkuMDsgV2luZG93cyBOVCA2LjE7IFRyaWRlbnQvNS4wKQ0KSG9zdDogbXNnLnZpZGVvLnFpeWkuY29tDQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQoNCg=="} -01180{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1122,"source":"pps.pcap","alias":"nDPId-test","flow_id":71,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353167288,"flow_last_seen":1467353167288,"flow_idle_time":7440000,"flow_min_l4_payload_len":640,"flow_max_l4_payload_len":640,"flow_tot_l4_payload_len":640,"flow_avg_l4_payload_len":640,"midstream":1,"thread_ts_msec":1467353167288,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.110.220.15","src_port":50498,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"msg.video.qiyi.com","url":"msg.video.qiyi.com\/tmpstats.gif?type=recctplay20121226&usract=show&ppuid=-1&uid=aaoefdtqgfdepxc2tnv3piucgcb4eofn&event_id=4b0868920b0f8285320a9e00ee0369e5&cid=31&bkt=pps_c_zebra_main_default&area=pps_c_zebra&platform=2012&albumlist=470694500,471591300,465641000,472887100,471788100,473746300,471948300,473694600,472189500&aid=479531000&source=0,1,1,1,1,1,1,1,1&_=1467353167087","code":0,"content_type":"","user_agent":"Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident\/5.0)"}} +01174{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1122,"source":"pps.pcap","alias":"nDPId-test","flow_id":71,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353167288,"flow_last_seen":1467353167288,"flow_idle_time":7440000,"flow_min_l4_payload_len":640,"flow_max_l4_payload_len":640,"flow_tot_l4_payload_len":640,"flow_avg_l4_payload_len":640,"midstream":1,"thread_ts_msec":1467353167288,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.110.220.15","src_port":50498,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"msg.video.qiyi.com","url":"msg.video.qiyi.com\/tmpstats.gif?type=recctplay20121226&usract=show&ppuid=-1&uid=aaoefdtqgfdepxc2tnv3piucgcb4eofn&event_id=4b0868920b0f8285320a9e00ee0369e5&cid=31&bkt=pps_c_zebra_main_default&area=pps_c_zebra&platform=2012&albumlist=470694500,471591300,465641000,472887100,471788100,473746300,471948300,473694600,472189500&aid=479531000&source=0,1,1,1,1,1,1,1,1&_=1467353167087","code":0,"content_type":"","user_agent":"Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident\/5.0)"}} 00647{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1123,"source":"pps.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":2,"flow_last_seen":1467353167373,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"thread_ts_msec":1467353167373,"pkt":"ABxCjnAxTF4M6gNlCABFAAC5WoJAAC4GvY4kbtwPwKhzCABQxUI6Bo8kfalyYFAYPAD9ZAAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOC4wDQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA2OjA2IEdNVA0KQ29udGVudC1UeXBlOiBpbWFnZS9naWYNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQoNCg=="} 00587{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1125,"source":"pps.pcap","alias":"nDPId-test","flow_id":72,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353170523,"flow_last_seen":1467353170523,"flow_idle_time":7440000,"flow_min_l4_payload_len":1043,"flow_max_l4_payload_len":1043,"flow_tot_l4_payload_len":1043,"flow_avg_l4_payload_len":1043,"midstream":1,"thread_ts_msec":1467353170523,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.76","src_port":50499,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 01846{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1125,"source":"pps.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_last_seen":1467353170523,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1097,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1097,"pkt_l4_len":1063,"thread_ts_msec":1467353170523,"pkt":"TF4M6gNlABxCjnAxCABFAAQ7HjFAAIAGHsHAqHMIb84WTMVDAFDdQoxSQH15t1AYQTfZKwAAR0VUIC9iP3Q9NSZwZj0yMDEmcD0xMSZwMT0xMTQmcm49MTQ2NzM1MzE2NzIyMSZhPTM0JmNsdD10dmcyMDE1X2JhaWtlQl9jb21tZW50X3Nob3cmdHlwZT1wYyZyZWY9bm9yZWYmdXJsPWh0dHAlM0EvL3ZvZGd1aWRlLnBwcy5pcWl5aS5jb20vcGFnZS5waHAlM0Z2ZXJzaW9uJTNENS4yLjE1LjIyNDAlMjNjbGFzcyUzRDIwMDAwMzcxOSUyNTI0JTI1MjQlMjUyNCUyNTI0MTgwOTMyMzAxJTI2ZW50aXR5aWQlM0Q0Nzk1MzEwMDAlMjZiYWlrZWlkJTNEMjAzMjI5NDkwJnU9YWFvZWZkdHFnZmRlcHhjMnRudjNwaXVjZ2NiNGVvZm4gSFRUUC8xLjENCkFjY2VwdDogKi8qDQpSZWZlcmVyOiBodHRwOi8vdm9kZ3VpZGUucHBzLmlxaXlpLmNvbS9wYWdlLnBocD92ZXJzaW9uPTUuMi4xNS4yMjQwDQpBY2NlcHQtTGFuZ3VhZ2U6IHpoLVRXDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUNClVzZXItQWdlbnQ6IE1vemlsbGEvNS4wIChjb21wYXRpYmxlOyBNU0lFIDkuMDsgV2luZG93cyBOVCA2LjE7IFRyaWRlbnQvNS4wKQ0KSG9zdDogbXNnLmlxaXlpLmNvbQ0KQ29ubmVjdGlvbjogS2VlcC1BbGl2ZQ0KQ29va2llOiBwcHNfY2xpZW50X3ZlcjI9NS4yLjE1LjIyNDA7IFQwMDQwND00ZTNhZTQxNWE1ODQ3NDhhYzlhYTMxNjI4ZjM5ZDFlODsgX3Bwc19pdmk9Vms0OU1UWXdOVEExTGFXL3BQbWhSejgvUDZUYXBFZW11RDgvcE0rd1pqOHRwTFd4M3pnd3Bsby9wR2FvY1NaV1VEMHhKbFpEUFQ4L1B6OCtwTFd4M3pnd3Bsby9wR2FvY1NaV1NqMHRNU1pXVXoxV0psWkVQU1pXVkZ0QlhUMHlNVGMxSmxaTlBTWldWajAxTGpJdU1UVXVNakkwTUNaV1ZUMW9kSFJ3T2k4dmQzZDNMbWx4YVhscExtTnZiUzkyWHpFNWNuSnNkblY0YkdjdWFIUnRiQT09OyBRQzAwNj11NTQ5dnB6MTBsOWZrYXR1bTRhbHc0YnA7IFFDMDA4PTE0NjY2NDU4MTYuMTQ2NjY0NTgxNi4xNDY2NjQ1ODE2LjE7IEhtX2x2dF81M2I3Mzc0YTYzYzM3NDgzZTVkZDk3ZDc4ZDliYjM2ZT0xNDY2NjQ1ODE3OyBRQzAwNT1hYW9lZmR0cWdmZGVweGMydG52M3BpdWNnY2I0ZW9mbg0KDQo="} -01114{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1125,"source":"pps.pcap","alias":"nDPId-test","flow_id":72,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353170523,"flow_last_seen":1467353170523,"flow_idle_time":7440000,"flow_min_l4_payload_len":1043,"flow_max_l4_payload_len":1043,"flow_tot_l4_payload_len":1043,"flow_avg_l4_payload_len":1043,"midstream":1,"thread_ts_msec":1467353170523,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.76","src_port":50499,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"msg.iqiyi.com","url":"msg.iqiyi.com\/b?t=5&pf=201&p=11&p1=114&rn=1467353167221&a=34&clt=tvg2015_baikeB_comment_show&type=pc&ref=noref&url=http%3A\/\/vodguide.pps.iqiyi.com\/page.php%3Fversion%3D5.2.15.2240%23class%3D200003719%2524%2524%2524%2524180932301%26entityid%3D479531000%26baikeid%3D203229490&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn","code":0,"content_type":"","user_agent":"Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident\/5.0)"}} +01116{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1125,"source":"pps.pcap","alias":"nDPId-test","flow_id":72,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353170523,"flow_last_seen":1467353170523,"flow_idle_time":7440000,"flow_min_l4_payload_len":1043,"flow_max_l4_payload_len":1043,"flow_tot_l4_payload_len":1043,"flow_avg_l4_payload_len":1043,"midstream":1,"thread_ts_msec":1467353170523,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.76","src_port":50499,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"msg.iqiyi.com","url":"msg.iqiyi.com\/b?t=5&pf=201&p=11&p1=114&rn=1467353167221&a=34&clt=tvg2015_baikeB_comment_show&type=pc&ref=noref&url=http%3A\/\/vodguide.pps.iqiyi.com\/page.php%3Fversion%3D5.2.15.2240%23class%3D200003719%2524%2524%2524%2524180932301%26entityid%3D479531000%26baikeid%3D203229490&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn","code":0,"content_type":"","user_agent":"Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident\/5.0)"}} 00648{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1126,"source":"pps.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":2,"flow_last_seen":1467353171307,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"thread_ts_msec":1467353171307,"pkt":"ABxCjnAxTF4M6gNlCABFAAC5FgtAADMGd2lvzhZMwKhzCABQxUNAfXm33UKQZVAYACEI\/gAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOC4wDQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA2OjEwIEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQoNCg=="} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1127,"source":"pps.pcap","alias":"nDPId-test","flow_id":73,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353172446,"flow_last_seen":1467353172446,"flow_idle_time":7440000,"flow_min_l4_payload_len":235,"flow_max_l4_payload_len":235,"flow_tot_l4_payload_len":235,"flow_avg_l4_payload_len":235,"midstream":1,"thread_ts_msec":1467353172446,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"23.41.133.163","src_port":50500,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00767{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1127,"source":"pps.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":1,"flow_last_seen":1467353172446,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":289,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":289,"pkt_l4_len":255,"thread_ts_msec":1467353172446,"pkt":"TF4M6gNlABxCjnAxCABFAAETH7ZAAIAGCbLAqHMIFymFo8VEAFBenvyU0fNBYlAYAQQxqAAAR0VUIC9wY2EzLWc1LmNybCBIVFRQLzEuMQ0KQ29ubmVjdGlvbjogS2VlcC1BbGl2ZQ0KQWNjZXB0OiAqLyoNCklmLU1vZGlmaWVkLVNpbmNlOiBUaHUsIDI0IE1hciAyMDE2IDE3OjQwOjA1IEdNVA0KSWYtTm9uZS1NYXRjaDogIjE3MjE5NjllNzMyYmNmZGRhNGQ4NWMxNjM5MGViYTcwOjE0NTg4NDI1OTciDQpVc2VyLUFnZW50OiBNaWNyb3NvZnQtQ3J5cHRvQVBJLzYuMQ0KSG9zdDogczEuc3ltY2IuY29tDQoNCg=="} @@ -309,7 +309,7 @@ 00643{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1144,"source":"pps.pcap","alias":"nDPId-test","flow_id":80,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353187172,"flow_last_seen":1467353187172,"flow_idle_time":180000,"flow_min_l4_payload_len":133,"flow_max_l4_payload_len":133,"flow_tot_l4_payload_len":133,"flow_avg_l4_payload_len":133,"midstream":0,"thread_ts_msec":1467353187172,"l3_proto":"ip4","src_ip":"192.168.5.28","dst_ip":"239.255.255.250","src_port":60023,"dst_port":1900,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1146,"source":"pps.pcap","alias":"nDPId-test","flow_id":81,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353189325,"flow_last_seen":1467353189325,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353189325,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50505,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00643{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1146,"source":"pps.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":1,"flow_last_seen":1467353189325,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":198,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":198,"pkt_l4_len":164,"thread_ts_msec":1467353189325,"pkt":"TF4M6gNlABxCjnAxCABFAAC4LaNAAIAGT77AqHMI3xpqE8VJAFB9cer6SbS1WFAYQTc4sgAAR0VUIC9leHQvY29tbW9uL3Fpc3UyL2Rvd25sb2FkZXIuaW5pIEhUVFAvMS4xDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANClVzZXItQWdlbnQ6IERvd25sb2FkZXINCkhvc3Q6IHN0YXRpYy5xaXlpLmNvbQ0KQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUNCg0K"} -00796{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1146,"source":"pps.pcap","alias":"nDPId-test","flow_id":81,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353189325,"flow_last_seen":1467353189325,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353189325,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50505,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"static.qiyi.com","url":"static.qiyi.com\/ext\/common\/qisu2\/downloader.ini","code":0,"content_type":"","user_agent":"Downloader"}} +00790{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1146,"source":"pps.pcap","alias":"nDPId-test","flow_id":81,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353189325,"flow_last_seen":1467353189325,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353189325,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50505,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"static.qiyi.com","url":"static.qiyi.com\/ext\/common\/qisu2\/downloader.ini","code":0,"content_type":"","user_agent":"Downloader"}} 01135{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1147,"source":"pps.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":2,"flow_last_seen":1467353189328,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":566,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":566,"pkt_l4_len":532,"thread_ts_msec":1467353189328,"pkt":"ABxCjnAxTF4M6gNlCABFAAIolNRAADgGLx3fGmoTwKhzCABQxUlJtLVYfXHrilAYAB9+agAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IFFXUw0KRGF0ZTogRnJpLCAwMSBKdWwgMjAxNiAwNjowNjoyOCBHTVQNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtDQpDb250ZW50LUxlbmd0aDogMTcwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpFeHBpcmVzOiBGcmksIDAxIEp1bCAyMDE2IDA2OjM1OjQzIEdNVA0KQ2FjaGUtQ29udHJvbDogbWF4LWFnZT0zNjAwDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1PcmlnaW46ICoNClgtQ2FjaGU6IEhJVCBmcm9tIDEwLjEyMS4zMy45OA0KWC1DYWNoZTogSElUIGZyb20gMjIzLjI2LjEwNi4xOQ0KQWNjZXB0LVJhbmdlczogYnl0ZXMNCg0KW0NvbnRyb2xdDQphcHA9ZWd1aSxla3JuLG5vZDMya3VpLG5vZDMya3JuDQpjb3VudD0xDQpjMD1Eb3dubG9hZEhlbHBlcg0KW0Rvd25sb2FkZXJdDQpEb3dubG9hZEhlbHBlcj1odHRwOi8vc3RhdGljLnFpeWkuY29tL2V4dC9jb21tb24vcWlzdTIvRG93bmxvYWRIZWxwZXIuZGxsO1N0YXJ0O1FJWUk="} 00651{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1148,"source":"pps.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":3,"flow_last_seen":1467353189360,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":202,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":202,"pkt_l4_len":168,"thread_ts_msec":1467353189360,"pkt":"TF4M6gNlABxCjnAxCABFAAC8LbBAAIAGT63AqHMI3xpqE8VJAFB9ceuKSbS3WFAYQLejygAAR0VUIC9leHQvY29tbW9uL3Fpc3UyL0Rvd25sb2FkSGVscGVyLmRsbCBIVFRQLzEuMQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwDQpVc2VyLUFnZW50OiBEb3dubG9hZGVyDQpIb3N0OiBzdGF0aWMucWl5aS5jb20NCkNhY2hlLUNvbnRyb2w6IG5vLWNhY2hlDQoNCg=="} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1149,"source":"pps.pcap","alias":"nDPId-test","flow_id":82,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353189363,"flow_last_seen":1467353189363,"flow_idle_time":7440000,"flow_min_l4_payload_len":892,"flow_max_l4_payload_len":892,"flow_tot_l4_payload_len":892,"flow_avg_l4_payload_len":892,"midstream":1,"thread_ts_msec":1467353189363,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50504,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} @@ -325,7 +325,7 @@ 01084{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1397,"source":"pps.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":3,"flow_last_seen":1467353189909,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":525,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":525,"pkt_l4_len":491,"thread_ts_msec":1467353189909,"pkt":"AQBef\/\/6cBiLE+IdCABFAAH\/I6cAAAER3n7AqAUm7\/\/\/+gdsB2wB6x3GTk9USUZZICogSFRUUC8xLjENCkhvc3Q6MjM5LjI1NS4yNTUuMjUwOjE5MDANCk5UOnVybjpzY2hlbWFzLXVwbnAtb3JnOmRldmljZTpNZWRpYVNlcnZlcjoxDQpOVFM6c3NkcDphbGl2ZQ0KTG9jYXRpb246aHR0cDovLzE5Mi4xNjguNS4zODoyODY5L3VwbnBob3N0L3VkaGlzYXBpLmRsbD9jb250ZW50PXV1aWQ6MmY2ODhlY2UtYzBiMS00MTA0LWI5ZTUtY2JjZWU1MDNlNmI0DQpVU046dXVpZDoyZjY4OGVjZS1jMGIxLTQxMDQtYjllNS1jYmNlZTUwM2U2YjQ6OnVybjpzY2hlbWFzLXVwbnAtb3JnOmRldmljZTpNZWRpYVNlcnZlcjoxDQpDYWNoZS1Db250cm9sOm1heC1hZ2U9OTAwDQpTZXJ2ZXI6TWljcm9zb2Z0LVdpbmRvd3MvNi4yIFVQblAvMS4wIFVQblAtRGV2aWNlLUhvc3QvMS4wDQpPUFQ6Imh0dHA6Ly9zY2hlbWFzLnVwbnAub3JnL3VwbnAvMS8wLyI7IG5zPTAxDQowMS1OTFM6MDAyODViYzNjM2JhMjA3MDA3ZTFjM2I3NjIxYzg0NzYNCg0K"} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1399,"source":"pps.pcap","alias":"nDPId-test","flow_id":85,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353190040,"flow_last_seen":1467353190040,"flow_idle_time":7440000,"flow_min_l4_payload_len":158,"flow_max_l4_payload_len":158,"flow_tot_l4_payload_len":158,"flow_avg_l4_payload_len":158,"midstream":1,"thread_ts_msec":1467353190040,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50507,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00664{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1399,"source":"pps.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_last_seen":1467353190040,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":212,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":212,"pkt_l4_len":178,"thread_ts_msec":1467353190040,"pkt":"TF4M6gNlABxCjnAxCABFAADGLkBAAIAGTxPAqHMI3xpqE8VLAFDaxGl\/7FKS9VAYQTcFigAAR0VUIC9leHQvY29tbW9uL3Fpc3UyL2Rvd25sb2FkaGVscGVyLmluaSBIVFRQLzEuMQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwDQpVc2VyLUFnZW50OiBEb3dubG9hZEhlbHBlcl9ydW54eA0KSG9zdDogc3RhdGljLnFpeWkuY29tDQpDYWNoZS1Db250cm9sOiBuby1jYWNoZQ0KDQo="} -00810{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1399,"source":"pps.pcap","alias":"nDPId-test","flow_id":85,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353190040,"flow_last_seen":1467353190040,"flow_idle_time":7440000,"flow_min_l4_payload_len":158,"flow_max_l4_payload_len":158,"flow_tot_l4_payload_len":158,"flow_avg_l4_payload_len":158,"midstream":1,"thread_ts_msec":1467353190040,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50507,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"static.qiyi.com","url":"static.qiyi.com\/ext\/common\/qisu2\/downloadhelper.ini","code":0,"content_type":"","user_agent":"DownloadHelper_runxx"}} +00804{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1399,"source":"pps.pcap","alias":"nDPId-test","flow_id":85,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353190040,"flow_last_seen":1467353190040,"flow_idle_time":7440000,"flow_min_l4_payload_len":158,"flow_max_l4_payload_len":158,"flow_tot_l4_payload_len":158,"flow_avg_l4_payload_len":158,"midstream":1,"thread_ts_msec":1467353190040,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50507,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"static.qiyi.com","url":"static.qiyi.com\/ext\/common\/qisu2\/downloadhelper.ini","code":0,"content_type":"","user_agent":"DownloadHelper_runxx"}} 01802{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1400,"source":"pps.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":2,"flow_last_seen":1467353190044,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1063,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1063,"pkt_l4_len":1029,"thread_ts_msec":1467353190044,"pkt":"ABxCjnAxTF4M6gNlCABFAAQZtrxAADgGC0TfGmoTwKhzCABQxUvsUpL12sRqHVAYAB9YnAAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IFFXUw0KRGF0ZTogRnJpLCAwMSBKdWwgMjAxNiAwNjowNjoyOSBHTVQNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtDQpDb250ZW50LUxlbmd0aDogNjY3DQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpFeHBpcmVzOiBGcmksIDAxIEp1bCAyMDE2IDA2OjE3OjMwIEdNVA0KQ2FjaGUtQ29udHJvbDogbWF4LWFnZT0zNjAwDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1PcmlnaW46ICoNClgtQ2FjaGU6IEhJVCBmcm9tIDEwLjEyMS4zMy45Nw0KWC1DYWNoZTogSElUIGZyb20gMjIzLjI2LjEwNi4xOQ0KQWNjZXB0LVJhbmdlczogYnl0ZXMNCg0KW0NvbnRyb2xdDQpjb3VudD02DQpjMD1DaGVja0NsaWVudA0KYzE9UVlBZ2VudA0KYzI9bWFzZmxhZw0KYzM9bWFzYXV0bw0KYzQ9bWFzYmxvZw0KYzU9Q29va2llQ2xlYXINCltEb3dubG9hZGVyXQ0KQ2hlY2tDbGllbnQ9aHR0cDovL21iZGFwcC5pcWl5aS5jb20vai9vdC9DaGVja0NsaWVudC56aXA7U3RhcnQ7OTdEQzFBMTJCQzMyMkNERjRCQjE5MjNDNEVGMTRFMUINClFZQWdlbnQ9aHR0cDovL21iZGFwcC5pcWl5aS5jb20vai9vdC9RWUFnZW50LnppcDtTdGFydEFnZW50OzRDRDQxOTkyNjI5ODBBRjY5RDA3OThEREFBNDJGM0M5DQptYXNmbGFnPWh0dHA6Ly9tYmRhcHAuaXFpeWkuY29tL2ovb3QvbWFzZmxhZy56aXA7U3RhcnQ7RTNGRDlCMjEzMEFCQTIxNTc1QjRGNDk2RDg5Q0FGOTINCm1hc2F1dG89aHR0cDovL21iZGFwcC5pcWl5aS5jb20vai9vdC9tYXNhdXRvLnppcDtTdGFydDtEMTQ3M0E5Mjg2MjBENjZGMzM0QjI4RUYxRjk0QjA3OA0KbWFzYmxvZz1odHRwOi8vbWJkYXBwLmlxaXlpLmNvbS9qL290L21hc2Jsb2cuemlwO1N0YXJ0O0JGRENCNTM1QzNFRUIwMkZEREI5NjFEMDVBNTIzQjI2DQpDb29raWVDbGVhcj1odHRwOi8vbWJkYXBwLmlxaXlpLmNvbS9qL290L0Nvb2tpZUNsZWFyLnppcDtTdGFydDtGMzlBRDlFOTgzREJCMzA5MkYxQzNDNDIwRjJBNDgyQQ=="} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1402,"source":"pps.pcap","alias":"nDPId-test","flow_id":86,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353190110,"flow_last_seen":1467353190110,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":145,"flow_tot_l4_payload_len":145,"flow_avg_l4_payload_len":145,"midstream":1,"thread_ts_msec":1467353190110,"l3_proto":"ip4","src_ip":"202.108.14.219","dst_ip":"192.168.115.8","src_port":80,"dst_port":50506,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00647{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1402,"source":"pps.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":1,"flow_last_seen":1467353190110,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"thread_ts_msec":1467353190110,"pkt":"ABxCjnAxTF4M6gNlCABFAAC5kJVAADMGqbHKbA7bwKhzCABQxUpzStvEq5YvP1AYADaqqAAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuNC43DQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA2OjI5IEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQoNCg=="} @@ -335,33 +335,33 @@ 00647{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1406,"source":"pps.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":2,"flow_last_seen":1467353190235,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"thread_ts_msec":1467353190235,"pkt":"ABxCjnAxTF4M6gNlCABFAAC5FPVAADMGJVLKbA7bwKhzCABQxHdtLPk6vNGSM1AYANYfVAAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuNC43DQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA2OjI5IEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQoNCg=="} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1407,"source":"pps.pcap","alias":"nDPId-test","flow_id":88,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353190634,"flow_last_seen":1467353190634,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353190634,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50508,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00644{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1407,"source":"pps.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":1,"flow_last_seen":1467353190634,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":198,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":198,"pkt_l4_len":164,"thread_ts_msec":1467353190634,"pkt":"TF4M6gNlABxCjnAxCABFAAC4LnBAAIAGTvHAqHMI3xpqE8VMAFCjClS\/APxWfFAYQTf8ogAAR0VUIC9leHQvY29tbW9uL3Fpc3UyL1FZQWdlbnQuaW5pIEhUVFAvMS4xDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANClVzZXItQWdlbnQ6IFFZQWdlbnRfcnVueHgNCkhvc3Q6IHN0YXRpYy5xaXlpLmNvbQ0KQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUNCg0K"} -00796{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1407,"source":"pps.pcap","alias":"nDPId-test","flow_id":88,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353190634,"flow_last_seen":1467353190634,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353190634,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50508,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"static.qiyi.com","url":"static.qiyi.com\/ext\/common\/qisu2\/QYAgent.ini","code":0,"content_type":"","user_agent":"QYAgent_runxx"}} +00790{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1407,"source":"pps.pcap","alias":"nDPId-test","flow_id":88,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353190634,"flow_last_seen":1467353190634,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353190634,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50508,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"static.qiyi.com","url":"static.qiyi.com\/ext\/common\/qisu2\/QYAgent.ini","code":0,"content_type":"","user_agent":"QYAgent_runxx"}} 00940{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1408,"source":"pps.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":2,"flow_last_seen":1467353190638,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":420,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":420,"pkt_l4_len":386,"thread_ts_msec":1467353190638,"pkt":"ABxCjnAxTF4M6gNlCABFAAGWcOxAADgGU5ffGmoTwKhzCABQxUwA\/FZ8owpVT1AYAB8JQAAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IFFXUw0KRGF0ZTogRnJpLCAwMSBKdWwgMjAxNiAwNjowNjozMCBHTVQNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtDQpDb250ZW50LUxlbmd0aDogMjUNCkNvbm5lY3Rpb246IGtlZXAtYWxpdmUNCkV4cGlyZXM6IEZyaSwgMDEgSnVsIDIwMTYgMDY6MzA6MDcgR01UDQpDYWNoZS1Db250cm9sOiBtYXgtYWdlPTM2MDANCkFjY2Vzcy1Db250cm9sLUFsbG93LU9yaWdpbjogKg0KWC1DYWNoZTogSElUIGZyb20gMTAuMTIxLjMzLjk3DQpYLUNhY2hlOiBISVQgZnJvbSAyMjMuMjYuMTA2LjE5DQpBY2NlcHQtUmFuZ2VzOiBieXRlcw0KDQpbUVlBZ2VudF0NCnY9MA0KcD0xMDANCmU9"} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1409,"source":"pps.pcap","alias":"nDPId-test","flow_id":89,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353190892,"flow_last_seen":1467353190892,"flow_idle_time":7440000,"flow_min_l4_payload_len":109,"flow_max_l4_payload_len":109,"flow_tot_l4_payload_len":109,"flow_avg_l4_payload_len":109,"midstream":1,"thread_ts_msec":1467353190892,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.38.219.107","src_port":50509,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00600{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1409,"source":"pps.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":1,"flow_last_seen":1467353190892,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":163,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":163,"pkt_l4_len":129,"thread_ts_msec":1467353190892,"pkt":"TF4M6gNlABxCjnAxCABFAACVLoRAAIAGUpzAqHMIaibba8VNAFAdei0\/k1iI9FAYQTd0xwAAR0VUIC9jaXR5anNvbiBIVFRQLzEuMQ0KVXNlci1BZ2VudDogUVlBZ2VudF9ydW54eA0KSG9zdDogaXBsb2NhdGlvbi5nZW8ucWl5aS5jb20NCkNhY2hlLUNvbnRyb2w6IG5vLWNhY2hlDQoNCg=="} -00790{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1409,"source":"pps.pcap","alias":"nDPId-test","flow_id":89,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353190892,"flow_last_seen":1467353190892,"flow_idle_time":7440000,"flow_min_l4_payload_len":109,"flow_max_l4_payload_len":109,"flow_tot_l4_payload_len":109,"flow_avg_l4_payload_len":109,"midstream":1,"thread_ts_msec":1467353190892,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.38.219.107","src_port":50509,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"iplocation.geo.qiyi.com","url":"iplocation.geo.qiyi.com\/cityjson","code":0,"content_type":"","user_agent":"QYAgent_runxx"}} +00784{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1409,"source":"pps.pcap","alias":"nDPId-test","flow_id":89,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353190892,"flow_last_seen":1467353190892,"flow_idle_time":7440000,"flow_min_l4_payload_len":109,"flow_max_l4_payload_len":109,"flow_tot_l4_payload_len":109,"flow_avg_l4_payload_len":109,"midstream":1,"thread_ts_msec":1467353190892,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.38.219.107","src_port":50509,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"iplocation.geo.qiyi.com","url":"iplocation.geo.qiyi.com\/cityjson","code":0,"content_type":"","user_agent":"QYAgent_runxx"}} 01043{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1410,"source":"pps.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":2,"flow_last_seen":1467353190978,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":497,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":497,"pkt_l4_len":463,"thread_ts_msec":1467353190978,"pkt":"ABxCjnAxTF4M6gNlCABFAAHjK+5AADIGoeRqJttrwKhzCABQxU2TWIj0HXotrFAYAOXEmAAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG9wZW5yZXN0eQ0KRGF0ZTogRnJpLCAwMSBKdWwgMjAxNiAwNjowNjozMCBHTVQNCkNvbnRlbnQtVHlwZTogdGV4dC9odG1sO2NoYXJzZXQ9dXRmLTgNClRyYW5zZmVyLUVuY29kaW5nOiBjaHVua2VkDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpDb250ZW50LVR5cGU6IGNoYXJzZXQ9dXRmLTgNCg0KZjINCnZhciByZXR1cm5JcENpdHkgPXsiY29kZSI6IkEwMDAwMCIsICJkYXRhIjogeyJpcCI6IjExOC4xNjMuOC45MCIsICJpc3AiOiLkuK3ljY7nlLXkv6EiLCAiY291bnRyeSI6IuS4reWbveWkp+mZhiIsICJwcm92aW5jZSI6IuWPsOa5viIsICJjaXR5IjoiTm9uZSIsICJpc3BfaWQiOjY5LCAiY291bnRyeV9pZCI6NDgsICJwcm92aW5jZV9pZCI6MjI4LCAiY2l0eV9pZCI6MjI4MDAwLCAibG9jYXRpb25faWQiOjY5MjI4MDAwfX0KDQo="} 00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1411,"source":"pps.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":3,"flow_last_seen":1467353190978,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":25,"thread_ts_msec":1467353190978,"pkt":"ABxCjnAxTF4M6gNlCABFAAAtK+9AADIGo5lqJttrwKhzCABQxU2TWIqvHXotrFAYAOXCuQAAMA0KDQoA"} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1413,"source":"pps.pcap","alias":"nDPId-test","flow_id":90,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191500,"flow_last_seen":1467353191500,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353191500,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50766,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00643{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1413,"source":"pps.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":1,"flow_last_seen":1467353191500,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":198,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":198,"pkt_l4_len":164,"thread_ts_msec":1467353191500,"pkt":"TF4M6gNlABxCjnAxCABFAAC4L9BAAIAGTZDAqHMI3xpqFMZOAFCUEYDiYZCIJlAYQTcJ9QAAR0VUIC9leHQvY29tbW9uL3Fpc3UyL21hc2ZsYWcuaW5pIEhUVFAvMS4xDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANClVzZXItQWdlbnQ6IG1hc2ZsYWdfcnVueHgNCkhvc3Q6IHN0YXRpYy5xaXlpLmNvbQ0KQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUNCg0K"} -00796{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1413,"source":"pps.pcap","alias":"nDPId-test","flow_id":90,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191500,"flow_last_seen":1467353191500,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353191500,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50766,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"static.qiyi.com","url":"static.qiyi.com\/ext\/common\/qisu2\/masflag.ini","code":0,"content_type":"","user_agent":"masflag_runxx"}} +00790{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1413,"source":"pps.pcap","alias":"nDPId-test","flow_id":90,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191500,"flow_last_seen":1467353191500,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353191500,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50766,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"static.qiyi.com","url":"static.qiyi.com\/ext\/common\/qisu2\/masflag.ini","code":0,"content_type":"","user_agent":"masflag_runxx"}} 01040{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1414,"source":"pps.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":2,"flow_last_seen":1467353191505,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":493,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":493,"pkt_l4_len":459,"thread_ts_msec":1467353191505,"pkt":"ABxCjnAxTF4M6gNlCABFAAHfpuJAADgGHVffGmoUwKhzCABQxk5hkIgmlBGBclAYAB+\/UwAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IFFXUw0KRGF0ZTogRnJpLCAwMSBKdWwgMjAxNiAwNjowNjozMSBHTVQNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtDQpDb250ZW50LUxlbmd0aDogOTgNCkNvbm5lY3Rpb246IGtlZXAtYWxpdmUNCkV4cGlyZXM6IEZyaSwgMDEgSnVsIDIwMTYgMDY6MTI6MTAgR01UDQpDYWNoZS1Db250cm9sOiBtYXgtYWdlPTM2MDANCkFjY2Vzcy1Db250cm9sLUFsbG93LU9yaWdpbjogKg0KWC1DYWNoZTogSElUIGZyb20gMTAuMTIxLjMzLjk3DQpYLUNhY2hlOiBISVQgZnJvbSAyMjMuMjYuMTA2LjIwDQpBY2NlcHQtUmFuZ2VzOiBieXRlcw0KDQpbbWFzZmxhZ10NCnY9Mg0KcD00MA0KZT2xsb6pL8nPuqMNCmFwcD1maWRkbGVyLHdpcmVzaGFyayxIdHRwV2F0Y2gsSHR0cFdhdGNoIFN0dWRpbyxIdHRwQW5hbHl6ZXINCg=="} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1415,"source":"pps.pcap","alias":"nDPId-test","flow_id":91,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191521,"flow_last_seen":1467353191521,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353191521,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50767,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00643{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1415,"source":"pps.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":1,"flow_last_seen":1467353191521,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":198,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":198,"pkt_l4_len":164,"thread_ts_msec":1467353191521,"pkt":"TF4M6gNlABxCjnAxCABFAAC4L9RAAIAGTYzAqHMI3xpqFMZPAFCekgJEnvl6klAYQTcvHQAAR0VUIC9leHQvY29tbW9uL3Fpc3UyL21hc2F1dG8uaW5pIEhUVFAvMS4xDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANClVzZXItQWdlbnQ6IG1hc2F1dG9fcnVueHgNCkhvc3Q6IHN0YXRpYy5xaXlpLmNvbQ0KQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUNCg0K"} -00796{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1415,"source":"pps.pcap","alias":"nDPId-test","flow_id":91,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191521,"flow_last_seen":1467353191521,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353191521,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50767,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"static.qiyi.com","url":"static.qiyi.com\/ext\/common\/qisu2\/masauto.ini","code":0,"content_type":"","user_agent":"masauto_runxx"}} +00790{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1415,"source":"pps.pcap","alias":"nDPId-test","flow_id":91,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191521,"flow_last_seen":1467353191521,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353191521,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50767,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"static.qiyi.com","url":"static.qiyi.com\/ext\/common\/qisu2\/masauto.ini","code":0,"content_type":"","user_agent":"masauto_runxx"}} 01086{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1416,"source":"pps.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":2,"flow_last_seen":1467353191524,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":526,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":526,"pkt_l4_len":492,"thread_ts_msec":1467353191524,"pkt":"ABxCjnAxTF4M6gNlCABFAAIAVHFAADgGb6ffGmoUwKhzCABQxk+e+XqSnpIC1FAYAB\/e1QAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IFFXUw0KRGF0ZTogRnJpLCAwMSBKdWwgMjAxNiAwNjowNjozMSBHTVQNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtDQpDb250ZW50LUxlbmd0aDogMTMwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpFeHBpcmVzOiBGcmksIDAxIEp1bCAyMDE2IDA2OjUwOjIzIEdNVA0KQ2FjaGUtQ29udHJvbDogbWF4LWFnZT0zNjAwDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1PcmlnaW46ICoNClgtQ2FjaGU6IEhJVCBmcm9tIDEwLjEyMS4zMy45Nw0KWC1DYWNoZTogSElUIGZyb20gMjIzLjI2LjEwNi4yMA0KQWNjZXB0LVJhbmdlczogYnl0ZXMNCg0KW21hc2F1dG9dDQp2PTENCnA9MQ0KZT2xsb6pL8nPuqMvuePW3S\/J7tvaDQpzPb2ty9Uv1eO9rS\/JvbarL7rTxM8NCmFwcD1maWRkbGVyLHdpcmVzaGFyayxIdHRwV2F0Y2gsSHR0cFdhdGNoIFN0dWRpbyxIdHRwQW5hbHl6ZXINCg=="} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1417,"source":"pps.pcap","alias":"nDPId-test","flow_id":92,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191538,"flow_last_seen":1467353191538,"flow_idle_time":7440000,"flow_min_l4_payload_len":210,"flow_max_l4_payload_len":210,"flow_tot_l4_payload_len":210,"flow_avg_l4_payload_len":210,"midstream":1,"thread_ts_msec":1467353191538,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.110.220.15","src_port":50765,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00734{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1417,"source":"pps.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":1,"flow_last_seen":1467353191538,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":264,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":264,"pkt_l4_len":230,"thread_ts_msec":1467353191538,"pkt":"TF4M6gNlABxCjnAxCABFAAD6L9ZAAIAGlfnAqHMIJG7cD8ZNAFCivUMktEgQ8FAY\/\/DARAAAR0VUIC90bXBzdGF0cy5naWY\/bWV0aG9kPXFpdWJpdGVyJm9zPXdpbmRvd3MtNi4xLjc2MDFfc3AxJnV1aWQ9MzUwQzNGMUFDNzVENDBiYzkwRDYwMkRBNEU2N0E3MkQmc29mdHZlcnNpb249MS4wLjAuMSZzb3VyY2U9cHBzJnRhc2t0eXBlPWdldHRhc2tpbmZvIEhUVFAvMS4xDQpVc2VyLUFnZW50OiBRSVlpQW5nZW50DQpIb3N0OiBtc2cudmlkZW8ucWl5aS5jb20NCg0K"} -00910{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1417,"source":"pps.pcap","alias":"nDPId-test","flow_id":92,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191538,"flow_last_seen":1467353191538,"flow_idle_time":7440000,"flow_min_l4_payload_len":210,"flow_max_l4_payload_len":210,"flow_tot_l4_payload_len":210,"flow_avg_l4_payload_len":210,"midstream":1,"thread_ts_msec":1467353191538,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.110.220.15","src_port":50765,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"msg.video.qiyi.com","url":"msg.video.qiyi.com\/tmpstats.gif?method=qiubiter&os=windows-6.1.7601_sp1&uuid=350C3F1AC75D40bc90D602DA4E67A72D&softversion=1.0.0.1&source=pps&tasktype=gettaskinfo","code":0,"content_type":"","user_agent":"QIYiAngent"}} +00904{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1417,"source":"pps.pcap","alias":"nDPId-test","flow_id":92,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191538,"flow_last_seen":1467353191538,"flow_idle_time":7440000,"flow_min_l4_payload_len":210,"flow_max_l4_payload_len":210,"flow_tot_l4_payload_len":210,"flow_avg_l4_payload_len":210,"midstream":1,"thread_ts_msec":1467353191538,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.110.220.15","src_port":50765,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"msg.video.qiyi.com","url":"msg.video.qiyi.com\/tmpstats.gif?method=qiubiter&os=windows-6.1.7601_sp1&uuid=350C3F1AC75D40bc90D602DA4E67A72D&softversion=1.0.0.1&source=pps&tasktype=gettaskinfo","code":0,"content_type":"","user_agent":"QIYiAngent"}} 00647{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1418,"source":"pps.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":3,"flow_last_seen":1467353191556,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"thread_ts_msec":1467353191556,"pkt":"TF4M6gNlABxCjnAxCABFAAC5L9hAAIAGTYfAqHMI3xpqFMZPAFCekgLUnvl8alAYQMHSJwAAR0VUIC9leHQvY29tbW9uL3Fpc3UyL21hc3JlY29tLmluaSBIVFRQLzEuMQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwDQpVc2VyLUFnZW50OiBtYXNhdXRvX3J1bnh4DQpIb3N0OiBzdGF0aWMucWl5aS5jb20NCkNhY2hlLUNvbnRyb2w6IG5vLWNhY2hlDQoNCg=="} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1423,"source":"pps.pcap","alias":"nDPId-test","flow_id":93,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191604,"flow_last_seen":1467353191604,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353191604,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50768,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00643{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1423,"source":"pps.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":1,"flow_last_seen":1467353191604,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":198,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":198,"pkt_l4_len":164,"thread_ts_msec":1467353191604,"pkt":"TF4M6gNlABxCjnAxCABFAAC4L+lAAIAGTXjAqHMI3xpqE8ZQAFAEnujgm7SOJVAYQTfnOwAAR0VUIC9leHQvY29tbW9uL3Fpc3UyL21hc2Jsb2cuaW5pIEhUVFAvMS4xDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANClVzZXItQWdlbnQ6IG1hc2Jsb2dfcnVueHgNCkhvc3Q6IHN0YXRpYy5xaXlpLmNvbQ0KQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUNCg0K"} -00796{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1423,"source":"pps.pcap","alias":"nDPId-test","flow_id":93,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191604,"flow_last_seen":1467353191604,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353191604,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50768,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"static.qiyi.com","url":"static.qiyi.com\/ext\/common\/qisu2\/masblog.ini","code":0,"content_type":"","user_agent":"masblog_runxx"}} +00790{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1423,"source":"pps.pcap","alias":"nDPId-test","flow_id":93,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191604,"flow_last_seen":1467353191604,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":1,"thread_ts_msec":1467353191604,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50768,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"static.qiyi.com","url":"static.qiyi.com\/ext\/common\/qisu2\/masblog.ini","code":0,"content_type":"","user_agent":"masblog_runxx"}} 00648{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1424,"source":"pps.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":2,"flow_last_seen":1467353191606,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"thread_ts_msec":1467353191606,"pkt":"ABxCjnAxTF4M6gNlCABFAAC5GMJAAC4G\/04kbtwPwKhzCABQxk20SBDwor1D9lAYPLgN5wAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOC4wDQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA2OjMxIEdNVA0KQ29udGVudC1UeXBlOiBpbWFnZS9naWYNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQoNCg=="} 01085{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1426,"source":"pps.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":2,"flow_last_seen":1467353191608,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":526,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":526,"pkt_l4_len":492,"thread_ts_msec":1467353191608,"pkt":"ABxCjnAxTF4M6gNlCABFAAIApFFAADgGH8jfGmoTwKhzCABQxlCbtI4lBJ7pcFAYAB996wAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IFFXUw0KRGF0ZTogRnJpLCAwMSBKdWwgMjAxNiAwNjowNjozMSBHTVQNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtDQpDb250ZW50LUxlbmd0aDogMTMwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpFeHBpcmVzOiBGcmksIDAxIEp1bCAyMDE2IDA2OjE3OjQzIEdNVA0KQ2FjaGUtQ29udHJvbDogbWF4LWFnZT0zNjAwDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1PcmlnaW46ICoNClgtQ2FjaGU6IEhJVCBmcm9tIDEwLjEyMS4zMy45Nw0KWC1DYWNoZTogSElUIGZyb20gMjIzLjI2LjEwNi4xOQ0KQWNjZXB0LVJhbmdlczogYnl0ZXMNCg0KW21hc2Jsb2ddDQp2PTENCnA9MQ0KZT2xsb6pL8nPuqMvuePW3S\/J7tvaDQpzPb2ty9Uv1eO9rS\/JvbarL7rTxM8NCmFwcD1maWRkbGVyLHdpcmVzaGFyayxIdHRwV2F0Y2gsSHR0cFdhdGNoIFN0dWRpbyxIdHRwQW5hbHl6ZXINCg=="} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1427,"source":"pps.pcap","alias":"nDPId-test","flow_id":94,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191688,"flow_last_seen":1467353191688,"flow_idle_time":7440000,"flow_min_l4_payload_len":550,"flow_max_l4_payload_len":550,"flow_tot_l4_payload_len":550,"flow_avg_l4_payload_len":550,"midstream":1,"thread_ts_msec":1467353191688,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50769,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 01190{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1427,"source":"pps.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":1,"flow_last_seen":1467353191688,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":604,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":604,"pkt_l4_len":570,"thread_ts_msec":1467353191688,"pkt":"TF4M6gNlABxCjnAxCABFAAJOL\/RAAIAGZxbAqHMIZePIC8ZRAFCkQ4vBOJoXClAY\/\/Dn4QAAR0VUIC9jY3MgSFRUUC8xLjENClVzZXItQWdlbnQ6IENvb2tpZUNsZWFyX3J1bnh4DQpIb3N0OiBhcGkuY3VwaWQuaXFpeWkuY29tDQpDb29raWU6IHBwc19jbGllbnRfdmVyMj01LjIuMTUuMjI0MDsgVDAwNDA0PTRlM2FlNDE1YTU4NDc0OGFjOWFhMzE2MjhmMzlkMWU4OyBfcHBzX2l2aT1WazQ5TVRZd05UQTFMYVcvcFBtaFJ6OC9QNlRhcEVlbXVEOC9wTSt3Wmo4dHBMV3gzemd3cGxvL3BHYW9jU1pXVUQweEpsWkRQVDgvUHo4K3BMV3gzemd3cGxvL3BHYW9jU1pXU2owdE1TWldVejFXSmxaRVBTWldWRnRCWFQweU1UYzFKbFpOUFNaV1ZqMDFMakl1TVRVdU1qSTBNQ1pXVlQxb2RIUndPaTh2ZDNkM0xtbHhhWGxwTG1OdmJTOTJYekU1Y25Kc2RuVjRiR2N1YUhSdGJBPT07IFFDMDA2PXU1NDl2cHoxMGw5ZmthdHVtNGFsdzRicDsgUUMwMDg9MTQ2NjY0NTgxNi4xNDY2NjQ1ODE2LjE0NjY2NDU4MTYuMTsgSG1fbHZ0XzUzYjczNzRhNjNjMzc0ODNlNWRkOTdkNzhkOWJiMzZlPTE0NjY2NDU4MTc7IFFDMDA1PWFhb2VmZHRxZ2ZkZXB4YzJ0bnYzcGl1Y2djYjRlb2ZuDQoNCg=="} -00781{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1427,"source":"pps.pcap","alias":"nDPId-test","flow_id":94,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191688,"flow_last_seen":1467353191688,"flow_idle_time":7440000,"flow_min_l4_payload_len":550,"flow_max_l4_payload_len":550,"flow_tot_l4_payload_len":550,"flow_avg_l4_payload_len":550,"midstream":1,"thread_ts_msec":1467353191688,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50769,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"api.cupid.iqiyi.com","url":"api.cupid.iqiyi.com\/ccs","code":0,"content_type":"","user_agent":"CookieClear_runxx"}} +00783{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1427,"source":"pps.pcap","alias":"nDPId-test","flow_id":94,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353191688,"flow_last_seen":1467353191688,"flow_idle_time":7440000,"flow_min_l4_payload_len":550,"flow_max_l4_payload_len":550,"flow_tot_l4_payload_len":550,"flow_avg_l4_payload_len":550,"midstream":1,"thread_ts_msec":1467353191688,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50769,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"api.cupid.iqiyi.com","url":"api.cupid.iqiyi.com\/ccs","code":0,"content_type":"","user_agent":"CookieClear_runxx"}} 00767{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1428,"source":"pps.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":2,"flow_last_seen":1467353191722,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":291,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":291,"pkt_l4_len":257,"thread_ts_msec":1467353191722,"pkt":"ABxCjnAxTF4M6gNlCABFAAEVyyVAAC8GHh5l48gLwKhzCABQxlE4mhcKpEON51AYPCgsNwAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOC4wDQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA2OjMxIEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2pzb247IGNoYXJzZXQ9dXRmLTgNCkNvbnRlbnQtTGVuZ3RoOiAxMQ0KQ29ubmVjdGlvbjoga2VlcC1hbGl2ZQ0KQWNjZXNzLUNvbnRyb2wtQWxsb3ctQ3JlZGVudGlhbHM6IHRydWUNCkNhY2hlLUNvbnRyb2w6IG5vLWNhY2hlDQoNCnsiciI6ZmFsc2V9"} 00619{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1430,"source":"pps.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":2,"flow_last_seen":1467353192820,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":175,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":175,"pkt_l4_len":141,"thread_ts_msec":1467353192820,"pkt":"AQBef\/\/6SNIkYwreCABFAAChDkwAAAER9TTAqAUp7\/\/\/+sTGB2wAjdbrTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDoyMzkuMjU1LjI1NS4yNTA6MTkwMA0KU1Q6dXJuOnNjaGVtYXMtdXBucC1vcmc6ZGV2aWNlOkludGVybmV0R2F0ZXdheURldmljZToxDQpNYW46InNzZHA6ZGlzY292ZXIiDQpNWDozDQoNCg=="} 00619{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1437,"source":"pps.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":3,"flow_last_seen":1467353193179,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":175,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":175,"pkt_l4_len":141,"thread_ts_msec":1467353193179,"pkt":"AQBef\/\/6jHNut5ODCABFAAChAo0AAAERAQHAqAUc7\/\/\/+up3B2wAjbFHTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDoyMzkuMjU1LjI1NS4yNTA6MTkwMA0KU1Q6dXJuOnNjaGVtYXMtdXBucC1vcmc6ZGV2aWNlOkludGVybmV0R2F0ZXdheURldmljZToxDQpNYW46InNzZHA6ZGlzY292ZXIiDQpNWDozDQoNCg=="} @@ -371,7 +371,7 @@ 01296{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1443,"source":"pps.pcap","alias":"nDPId-test","flow_id":95,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353195852,"flow_last_seen":1467353195852,"flow_idle_time":7440000,"flow_min_l4_payload_len":892,"flow_max_l4_payload_len":892,"flow_tot_l4_payload_len":892,"flow_avg_l4_payload_len":892,"midstream":1,"thread_ts_msec":1467353195852,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50771,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"msg.71.am","url":"msg.71.am\/cp2.gif?a=4e3ae415a584748ac9aa31628f39d1e8&ai=&as=1:45:23|45&av=4.10.004&b=180932301&c=31&ct=5000000923447&d=2175&di=&dp=71000001&e=c4889e64ad9d9eeb9ff438910850c442&ec=&em=&fi=&g=0&l=MTE4LjE2My44Ljkw&mk=&nw=&od=5000000854934&oi=&p=a&pp=&rc=&rd=&ri=&s=1467353195054&sh=&sq=&sw=&t=sp&u=0_aaoefdtqgfdepxc2tnv3piucgcb4eofn&v=479531000&vv=5.2.15.2240&x=&y=qc_100001_100140","code":0,"content_type":"","user_agent":"Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\/QY-Player-Windows\/2.0.102"}} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1444,"source":"pps.pcap","alias":"nDPId-test","flow_id":96,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353195855,"flow_last_seen":1467353195855,"flow_idle_time":7440000,"flow_min_l4_payload_len":345,"flow_max_l4_payload_len":345,"flow_tot_l4_payload_len":345,"flow_avg_l4_payload_len":345,"midstream":1,"thread_ts_msec":1467353195855,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.111.70","src_port":50772,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00913{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1444,"source":"pps.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":1,"flow_last_seen":1467353195855,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":399,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":399,"pkt_l4_len":365,"thread_ts_msec":1467353195855,"pkt":"TF4M6gNlABxCjnAxCABFAAGBMjFAAIAGqNHAqHMIe31vRsZUAFDL+rP6wuI4bVAY\/\/CsBQAAR0VUIC9hcGlzL3VyYy9zZXRyYz9ja3VpZD1hYW9lZmR0cWdmZGVweGMydG52M3BpdWNnY2I0ZW9mbiZ0dklkPTQ3OTUzMTAwMCZ2aWRlb1BsYXlUaW1lPS0xJmFkZHRpbWU9MTQ2NzM1MzE5NSZ0ZXJtaW5hbElkPTEyJnZUeXBlPTAmY29tPTImcHBzVHZpZFR5cGU9MiZhZ2VudF90eXBlPTMwIEhUVFAvMS4xDQpVc2VyLUFnZW50OiBRaXlpIExpc3QgQ2xpZW50IFBDIDUuMi4xNS4yMjQwDQpIb3N0OiBubC5yY2QuaXFpeWkuY29tDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANClByYWdtYTogbm8tY2FjaGUNCkNhY2hlLUNvbnRyb2w6IG5vLWNhY2hlDQpDb25uZWN0aW9uOiBjbG9zZQ0KQWNjZXB0OiAqLyoNCg0K"} -00948{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1444,"source":"pps.pcap","alias":"nDPId-test","flow_id":96,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353195855,"flow_last_seen":1467353195855,"flow_idle_time":7440000,"flow_min_l4_payload_len":345,"flow_max_l4_payload_len":345,"flow_tot_l4_payload_len":345,"flow_avg_l4_payload_len":345,"midstream":1,"thread_ts_msec":1467353195855,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.111.70","src_port":50772,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"nl.rcd.iqiyi.com","url":"nl.rcd.iqiyi.com\/apis\/urc\/setrc?ckuid=aaoefdtqgfdepxc2tnv3piucgcb4eofn&tvId=479531000&videoPlayTime=-1&addtime=1467353195&terminalId=12&vType=0&com=2&ppsTvidType=2&agent_type=30","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} +00950{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1444,"source":"pps.pcap","alias":"nDPId-test","flow_id":96,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353195855,"flow_last_seen":1467353195855,"flow_idle_time":7440000,"flow_min_l4_payload_len":345,"flow_max_l4_payload_len":345,"flow_tot_l4_payload_len":345,"flow_avg_l4_payload_len":345,"midstream":1,"thread_ts_msec":1467353195855,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.111.70","src_port":50772,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"nl.rcd.iqiyi.com","url":"nl.rcd.iqiyi.com\/apis\/urc\/setrc?ckuid=aaoefdtqgfdepxc2tnv3piucgcb4eofn&tvId=479531000&videoPlayTime=-1&addtime=1467353195&terminalId=12&vType=0&com=2&ppsTvidType=2&agent_type=30","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} 00647{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1446,"source":"pps.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":2,"flow_last_seen":1467353195956,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"thread_ts_msec":1467353195956,"pkt":"ABxCjnAxTF4M6gNlCABFAAC5xWxAADMGdMnKbA7swKhzCABQxlNWUKyA6k+aDlAYACCSWwAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOC4wDQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA2OjM1IEdNVA0KQ29udGVudC1UeXBlOiBpbWFnZS9naWYNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQoNCg=="} 00749{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1448,"source":"pps.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":2,"flow_last_seen":1467353195998,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":275,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":275,"pkt_l4_len":241,"thread_ts_msec":1467353195998,"pkt":"ABxCjnAxTF4M6gNlCABFAAEFPIVAAC8G7\/l7fW9GwKhzCABQxlTC4jhty\/q1U1AYPLjA5wAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IFRlbmdpbmUNCkRhdGU6IEZyaSwgMDEgSnVsIDIwMTYgMDY6MDY6MzUgR01UDQpDb250ZW50LVR5cGU6IHRleHQvcGxhaW47Y2hhcnNldD1VVEYtOA0KQ29udGVudC1MZW5ndGg6IDI5DQpDb25uZWN0aW9uOiBjbG9zZQ0KQWNjZXNzLUNvbnRyb2wtQWxsb3ctQ3JlZGVudGlhbHM6IHRydWUNCg0KeyJkYXRhIjp0cnVlLCJjb2RlIjoiQTAwMDAwIn0="} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1450,"source":"pps.pcap","alias":"nDPId-test","flow_id":97,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196104,"flow_last_seen":1467353196104,"flow_idle_time":7440000,"flow_min_l4_payload_len":865,"flow_max_l4_payload_len":865,"flow_tot_l4_payload_len":865,"flow_avg_l4_payload_len":865,"midstream":1,"thread_ts_msec":1467353196104,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.221","src_port":50773,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} @@ -380,22 +380,22 @@ 00648{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1453,"source":"pps.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":2,"flow_last_seen":1467353196204,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"thread_ts_msec":1467353196204,"pkt":"ABxCjnAxTF4M6gNlCABFAAC53kZAADMGW\/7KbA7dwKhzCABQxlVvFI02dnYq8FAYAA859QAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuNC43DQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA2OjM1IEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQoNCg=="} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1454,"source":"pps.pcap","alias":"nDPId-test","flow_id":98,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196348,"flow_last_seen":1467353196348,"flow_idle_time":7440000,"flow_min_l4_payload_len":345,"flow_max_l4_payload_len":345,"flow_tot_l4_payload_len":345,"flow_avg_l4_payload_len":345,"midstream":1,"thread_ts_msec":1467353196348,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.111.70","src_port":50775,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00914{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1454,"source":"pps.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":1,"flow_last_seen":1467353196348,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":399,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":399,"pkt_l4_len":365,"thread_ts_msec":1467353196348,"pkt":"TF4M6gNlABxCjnAxCABFAAGBMltAAIAGqKfAqHMIe31vRsZXAFCyDhiCAe\/eKVAY\/\/B8ngAAR0VUIC9hcGlzL3VyYy9zZXRyYz9ja3VpZD1hYW9lZmR0cWdmZGVweGMydG52M3BpdWNnY2I0ZW9mbiZ0dklkPTQ3OTUzMTAwMCZ2aWRlb1BsYXlUaW1lPS0xJmFkZHRpbWU9MTQ2NzM1MzE5NSZ0ZXJtaW5hbElkPTEyJnZUeXBlPTAmY29tPTImcHBzVHZpZFR5cGU9MiZhZ2VudF90eXBlPTMwIEhUVFAvMS4xDQpVc2VyLUFnZW50OiBRaXlpIExpc3QgQ2xpZW50IFBDIDUuMi4xNS4yMjQwDQpIb3N0OiBubC5yY2QuaXFpeWkuY29tDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANClByYWdtYTogbm8tY2FjaGUNCkNhY2hlLUNvbnRyb2w6IG5vLWNhY2hlDQpDb25uZWN0aW9uOiBjbG9zZQ0KQWNjZXB0OiAqLyoNCg0K"} -00948{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1454,"source":"pps.pcap","alias":"nDPId-test","flow_id":98,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196348,"flow_last_seen":1467353196348,"flow_idle_time":7440000,"flow_min_l4_payload_len":345,"flow_max_l4_payload_len":345,"flow_tot_l4_payload_len":345,"flow_avg_l4_payload_len":345,"midstream":1,"thread_ts_msec":1467353196348,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.111.70","src_port":50775,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"nl.rcd.iqiyi.com","url":"nl.rcd.iqiyi.com\/apis\/urc\/setrc?ckuid=aaoefdtqgfdepxc2tnv3piucgcb4eofn&tvId=479531000&videoPlayTime=-1&addtime=1467353195&terminalId=12&vType=0&com=2&ppsTvidType=2&agent_type=30","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} +00950{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1454,"source":"pps.pcap","alias":"nDPId-test","flow_id":98,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196348,"flow_last_seen":1467353196348,"flow_idle_time":7440000,"flow_min_l4_payload_len":345,"flow_max_l4_payload_len":345,"flow_tot_l4_payload_len":345,"flow_avg_l4_payload_len":345,"midstream":1,"thread_ts_msec":1467353196348,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.111.70","src_port":50775,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"nl.rcd.iqiyi.com","url":"nl.rcd.iqiyi.com\/apis\/urc\/setrc?ckuid=aaoefdtqgfdepxc2tnv3piucgcb4eofn&tvId=479531000&videoPlayTime=-1&addtime=1467353195&terminalId=12&vType=0&com=2&ppsTvidType=2&agent_type=30","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1455,"source":"pps.pcap","alias":"nDPId-test","flow_id":99,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196393,"flow_last_seen":1467353196393,"flow_idle_time":7440000,"flow_min_l4_payload_len":533,"flow_max_l4_payload_len":533,"flow_tot_l4_payload_len":533,"flow_avg_l4_payload_len":533,"midstream":1,"thread_ts_msec":1467353196393,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50774,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 01165{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1455,"source":"pps.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":1,"flow_last_seen":1467353196393,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":587,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":587,"pkt_l4_len":553,"thread_ts_msec":1467353196393,"pkt":"TF4M6gNlABxCjnAxCABFAAI9Ml9AAIAGuWPAqHMIymwO28ZWAFBrRx\/mc\/0Jh1AYAQRafgAAR0VUIC9jb3JlP3Q9MTEmY3Q9YWRlbmQmcmVzZXQ9MCZyYT0xJnBmPTIwMSZwPTExJnAxPTExNCZwMj0zMDAwJnNka3RwPTEmYzE9MzEmcj00Nzk1MzEwMDAmYWlkPTE4MDkzMjMwMSZ1PWFhb2VmZHRxZ2ZkZXB4YzJ0bnYzcGl1Y2djYjRlb2ZuJnB1PSZvcz1XaW5kb3dzJTIwNyZ2PTUlMkUyJTJFMTUlMkUyMjQwJmtydj0yJTJFMCUyRTEwMiZkdD0maHU9LTEmcm49MTQ2NzM1MzE5NSZpc2xvY2FsPTAmYXM9MDMxMWM1YTBkNTU5NjA2M2RiNTk0NGJkNzZiNmNiZmYmdmU9YjFmOTBmOGRhNmZlMDI1OGQxMzYxNmE4MDcwY2I5OTcmcGU9JnZmcm09JmNobD0maGNkbnY9MTAuMC4wLjI5MyZ0cGNkPTAmaXNkcm09MSZodD0wIEhUVFAvMS4xDQpVc2VyLUFnZW50OiBRWS1QbGF5ZXItV2luZG93cy8yLjAuMTAyDQpIb3N0OiBtc2cuNzEuYW0NCkFjY2VwdDogKi8qDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUNCnF5aWQ6YWFvZWZkdHFnZmRlcHhjMnRudjNwaXVjZ2NiNGVvZm4NCnF5cGlkOl8yMDEyDQpxeXBsYXRmb3JtOjAtMg0KDQo="} 01113{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1455,"source":"pps.pcap","alias":"nDPId-test","flow_id":99,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196393,"flow_last_seen":1467353196393,"flow_idle_time":7440000,"flow_min_l4_payload_len":533,"flow_max_l4_payload_len":533,"flow_tot_l4_payload_len":533,"flow_avg_l4_payload_len":533,"midstream":1,"thread_ts_msec":1467353196393,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50774,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"msg.71.am","url":"msg.71.am\/core?t=11&ct=adend&reset=0&ra=1&pf=201&p=11&p1=114&p2=3000&sdktp=1&c1=31&r=479531000&aid=180932301&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn&pu=&os=Windows%207&v=5%2E2%2E15%2E2240&krv=2%2E0%2E102&dt=&hu=-1&rn=1467353195&islocal=0&as=0311c5a0d5596063db5944bd76b6cbff&ve=b1f90f8da6fe0258d13616a8070cb997&pe=&vfrm=&chl=&hcdnv=10.0.0.293&tpcd=0&isdrm=1&ht=0","code":0,"content_type":"","user_agent":"QY-Player-Windows\/2.0.102"}} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1456,"source":"pps.pcap","alias":"nDPId-test","flow_id":100,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196441,"flow_last_seen":1467353196441,"flow_idle_time":7440000,"flow_min_l4_payload_len":340,"flow_max_l4_payload_len":340,"flow_tot_l4_payload_len":340,"flow_avg_l4_payload_len":340,"midstream":1,"thread_ts_msec":1467353196441,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50776,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00908{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1456,"source":"pps.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":1,"flow_last_seen":1467353196441,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":394,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":394,"pkt_l4_len":360,"thread_ts_msec":1467353196441,"pkt":"TF4M6gNlABxCjnAxCABFAAF8MmRAAIAGDUzAqHMIb84WTcZYAFAHr7sEMj+LIFAYAQTIFgAAR0VUIC9iP3Q9MTEmcGY9MjAxJnA9MTEmcDE9MTE0JnMxPTAmY3Q9MTQwODE5X2Fkc3luJmFkc3luPTEmYnJpbmZvPUlFX0lFOV85LjAuODExMi4xNjQyMV8xJm9zPVdpbmRvd3MlMjA3JnJuPTE5MjUyJnU9YWFvZWZkdHFnZmRlcHhjMnRudjNwaXVjZ2NiNGVvZm4mdj01LjIuMTUuMjI0MCBIVFRQLzEuMQ0KVXNlci1BZ2VudDogUWl5aSBMaXN0IENsaWVudCBQQyA1LjIuMTUuMjI0MA0KSG9zdDogbXNnLmlxaXlpLmNvbQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwDQpQcmFnbWE6IG5vLWNhY2hlDQpDYWNoZS1Db250cm9sOiBuby1jYWNoZQ0KQ29ubmVjdGlvbjogY2xvc2UNCkFjY2VwdDogKi8qDQoNCg=="} -00938{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1456,"source":"pps.pcap","alias":"nDPId-test","flow_id":100,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196441,"flow_last_seen":1467353196441,"flow_idle_time":7440000,"flow_min_l4_payload_len":340,"flow_max_l4_payload_len":340,"flow_tot_l4_payload_len":340,"flow_avg_l4_payload_len":340,"midstream":1,"thread_ts_msec":1467353196441,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50776,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"msg.iqiyi.com","url":"msg.iqiyi.com\/b?t=11&pf=201&p=11&p1=114&s1=0&ct=140819_adsyn&adsyn=1&brinfo=IE_IE9_9.0.8112.16421_1&os=Windows%207&rn=19252&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn&v=5.2.15.2240","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} +00940{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1456,"source":"pps.pcap","alias":"nDPId-test","flow_id":100,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196441,"flow_last_seen":1467353196441,"flow_idle_time":7440000,"flow_min_l4_payload_len":340,"flow_max_l4_payload_len":340,"flow_tot_l4_payload_len":340,"flow_avg_l4_payload_len":340,"midstream":1,"thread_ts_msec":1467353196441,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50776,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"msg.iqiyi.com","url":"msg.iqiyi.com\/b?t=11&pf=201&p=11&p1=114&s1=0&ct=140819_adsyn&adsyn=1&brinfo=IE_IE9_9.0.8112.16421_1&os=Windows%207&rn=19252&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn&v=5.2.15.2240","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} 00648{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1457,"source":"pps.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":2,"flow_last_seen":1467353196523,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"thread_ts_msec":1467353196523,"pkt":"ABxCjnAxTF4M6gNlCABFAAC5bd1AADMGzGnKbA7bwKhzCABQxlZz\/QmHa0ch+1AYADbMuQAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuNC43DQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA2OjM1IEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQoNCg=="} 00641{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1458,"source":"pps.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":2,"flow_last_seen":1467353196535,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":194,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":194,"pkt_l4_len":160,"thread_ts_msec":1467353196535,"pkt":"ABxCjnAxTF4M6gNlCABFAAC07BRAADMGoWNvzhZNwKhzCABQxlgyP4sgB6+8WFAYAB\/IEQAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOC4wDQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA2OjM2IEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBjbG9zZQ0KDQo="} 00588{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1459,"source":"pps.pcap","alias":"nDPId-test","flow_id":101,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196740,"flow_last_seen":1467353196740,"flow_idle_time":7440000,"flow_min_l4_payload_len":1132,"flow_max_l4_payload_len":1132,"flow_tot_l4_payload_len":1132,"flow_avg_l4_payload_len":1132,"midstream":1,"thread_ts_msec":1467353196740,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50777,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 01967{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1459,"source":"pps.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":1,"flow_last_seen":1467353196740,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1186,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1186,"pkt_l4_len":1152,"thread_ts_msec":1467353196740,"pkt":"TF4M6gNlABxCjnAxCABFAASUMuBAAIAGCbjAqHMIb84WTcZZAFAJ9c2nhBlkGlAYAQR8TQAAR0VUIC9iP3BmPTIwMSZwPTExJnAxPTExNCZhcD0wJnNvdXJjZTE9bGlzdCZzb3VyY2UyPW9ubGluZV9sJnQ9MTEmY3Q9cGNfX2FkX3BsYXkmYWxidW1faWQ9MTgwOTMyMzAxJmMxPTQ3OTUzMTAwMCZjbHQ9aG9tZWRsJmNuPTE2MDUwNS0lRTYlQUQlQTMlRTclODklODclRUYlQkMlOUElRTklODMlOTElRTYlODElQkElRTYlQUMlQTclRTUlQjclQjQlRTQlQkElOEMlRTYlQUMlQTElRTUlQkQlOTIlRTYlOUQlQTUlRTUlOEYlOEQlRTklODAlODYlRTglQTIlQUQtJUU0JUJCJThBJUU2JTk5JTlBODAlRTUlOTAlOEUlRTglODQlQjElRTUlOEYlQTMlRTclQTclODAmY3B1dXNlPTMyLjgmZGU9MzJlNjU0ZmE1N2JlOTBlYzYzOGM0NmRkZmRkNjY3NTcmZGxsdj1hcHB2JTNENS4wLjAuMTAwMyU3Q29sdiUzRDUuMC4wLjExMDEmZXQ9MCZmdD0yMTc1Jmh0PTAmaHU9LTEma3Y9MTAuMC4wLjI5MyZsYW5nPSZtZW1waHk9NjUmbWVtdmlyPTEyMCZtdD0wJm12PTUuMi4xNS4yMjQwJnAyPTEwMTEmcGU9JnBvcHQ9MCZwdD0wJnB0eXBlPTEmcHU9JnI9NDc5NTMxMDAwJnJfaWQ9NDc5NTMxMDAwJnJhPTEmcm49MjA1MjYmc2Nobl9pZD0yMDAwMDM3MTklMjQlMjQlMjQlMjQxODA5MzIzMDEmc2Nobl9uYW1lPSVFNyVCQiVCQyVFOCU4OSVCQSVFNSVBOCVCMSVFNCVCOSU5MCUyNCUyNCUyNCUyNCVFNCVCQiU4QSVFNiU5OSU5QTgwJUU1JTkwJThFJUU4JTg0JUIxJUU1JThGJUEzJUU3JUE3JTgwJnNwdD0xNDY3MzUzMTk2JnN0YWdlPTImc3RpbWU9MCZ0dmlkPTQ3OTUzMTAwMCZ1PWFhb2VmZHRxZ2ZkZXB4YzJ0bnYzcGl1Y2djYjRlb2ZuJnVwbG9hZF9pZD0mdXJsPWh0dHAlM0ElMkYlMkZ3d3cuaXFpeWkuY29tJTJGdl8xOXJybHZ1eGxnLmh0bWwmdj0yLjAuMTAyLjMwMTQ3JnZlPTMzMzgyNWNkZjQ4NmNjOTRiNmQyOTU2ZjRkZTZkNGNiJnZpZD0yYjk0NzI5ZTNhOTIwYjIxMTk4ODZjNWM2NzdhZTlkYiBIVFRQLzEuMQ0KVXNlci1BZ2VudDogUWl5aSBMaXN0IENsaWVudCBQQyA1LjIuMTUuMjI0MA0KSG9zdDogbXNnLmlxaXlpLmNvbQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwDQpQcmFnbWE6IG5vLWNhY2hlDQpDYWNoZS1Db250cm9sOiBuby1jYWNoZQ0KQ29ubmVjdGlvbjogY2xvc2UNCkFjY2VwdDogKi8qDQoNCg=="} -01734{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1459,"source":"pps.pcap","alias":"nDPId-test","flow_id":101,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196740,"flow_last_seen":1467353196740,"flow_idle_time":7440000,"flow_min_l4_payload_len":1132,"flow_max_l4_payload_len":1132,"flow_tot_l4_payload_len":1132,"flow_avg_l4_payload_len":1132,"midstream":1,"thread_ts_msec":1467353196740,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50777,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"msg.iqiyi.com","url":"msg.iqiyi.com\/b?pf=201&p=11&p1=114&ap=0&source1=list&source2=online_l&t=11&ct=pc__ad_play&album_id=180932301&c1=479531000&clt=homedl&cn=160505-%E6%AD%A3%E7%89%87%EF%BC%9A%E9%83%91%E6%81%BA%E6%AC%A7%E5%B7%B4%E4%BA%8C%E6%AC%A1%E5%BD%92%E6%9D%A5%E5%8F%8D%E9%80%86%E8%A2%AD-%E4%BB%8A%E6%99%9A80%E5%90%8E%E8%84%B1%E5%8F%A3%E7%A7%80&cpuuse=32.8&de=32e654fa57be90ec638c46ddfdd66757&dllv=appv%3D5.0.0.1003%7Colv%3D5.0.0.1101&et=0&ft=2175&ht=0&hu=-1&kv=10.0.0.293&lang=&memphy=65&memvir=120&mt=0&mv=5.2.15.2240&p2=1011&pe=&popt=0&pt=0&ptype=1&pu=&r=479531000&r_id=479531000&ra=1&rn=20526&schn_id=200003719%24%24%24%24180932301&schn_name=%E7%BB%BC%E8%89%BA%E5%A8%B1%E4%B9%90%24%24%24%24%E4%BB%8A%E6%99%9A80%E5%90%8E%E8%84%B1%E5%8F%A3%E7%A7%80&spt=1467353196&stage=2&stime=0&tvid=479531000&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn&upload_id=&url=http%3A%2F%2Fwww.iqiyi.com%2Fv_19rrlvuxlg.html&v=2.0.102.30147&ve=333825cdf486cc94b6d2956f4de6d4cb&vid=2b94729e3a920b2119886c5c677ae9db","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} +01736{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1459,"source":"pps.pcap","alias":"nDPId-test","flow_id":101,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196740,"flow_last_seen":1467353196740,"flow_idle_time":7440000,"flow_min_l4_payload_len":1132,"flow_max_l4_payload_len":1132,"flow_tot_l4_payload_len":1132,"flow_avg_l4_payload_len":1132,"midstream":1,"thread_ts_msec":1467353196740,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50777,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"msg.iqiyi.com","url":"msg.iqiyi.com\/b?pf=201&p=11&p1=114&ap=0&source1=list&source2=online_l&t=11&ct=pc__ad_play&album_id=180932301&c1=479531000&clt=homedl&cn=160505-%E6%AD%A3%E7%89%87%EF%BC%9A%E9%83%91%E6%81%BA%E6%AC%A7%E5%B7%B4%E4%BA%8C%E6%AC%A1%E5%BD%92%E6%9D%A5%E5%8F%8D%E9%80%86%E8%A2%AD-%E4%BB%8A%E6%99%9A80%E5%90%8E%E8%84%B1%E5%8F%A3%E7%A7%80&cpuuse=32.8&de=32e654fa57be90ec638c46ddfdd66757&dllv=appv%3D5.0.0.1003%7Colv%3D5.0.0.1101&et=0&ft=2175&ht=0&hu=-1&kv=10.0.0.293&lang=&memphy=65&memvir=120&mt=0&mv=5.2.15.2240&p2=1011&pe=&popt=0&pt=0&ptype=1&pu=&r=479531000&r_id=479531000&ra=1&rn=20526&schn_id=200003719%24%24%24%24180932301&schn_name=%E7%BB%BC%E8%89%BA%E5%A8%B1%E4%B9%90%24%24%24%24%E4%BB%8A%E6%99%9A80%E5%90%8E%E8%84%B1%E5%8F%A3%E7%A7%80&spt=1467353196&stage=2&stime=0&tvid=479531000&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn&upload_id=&url=http%3A%2F%2Fwww.iqiyi.com%2Fv_19rrlvuxlg.html&v=2.0.102.30147&ve=333825cdf486cc94b6d2956f4de6d4cb&vid=2b94729e3a920b2119886c5c677ae9db","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} 00640{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1460,"source":"pps.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":2,"flow_last_seen":1467353196835,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":194,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":194,"pkt_l4_len":160,"thread_ts_msec":1467353196835,"pkt":"ABxCjnAxTF4M6gNlCABFAAC0DHtAADMGgP1vzhZNwKhzCABQxlmEGWQaCfXSE1AYACGFOQAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOC4wDQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA2OjM2IEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBjbG9zZQ0KDQo="} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1461,"source":"pps.pcap","alias":"nDPId-test","flow_id":102,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196856,"flow_last_seen":1467353196856,"flow_idle_time":7440000,"flow_min_l4_payload_len":249,"flow_max_l4_payload_len":249,"flow_tot_l4_payload_len":249,"flow_avg_l4_payload_len":249,"midstream":1,"thread_ts_msec":1467353196856,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50778,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00785{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1461,"source":"pps.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":1,"flow_last_seen":1467353196856,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":303,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":303,"pkt_l4_len":269,"thread_ts_msec":1467353196856,"pkt":"TF4M6gNlABxCjnAxCABFAAEhMu5AAIAGSgnAqHMI3xpqFMZaAFCbMnrue8hN51AYAQSXSQAAR0VUIC9wcmVpbWFnZS8yMDE2MDUwNi9mMC8xZi92XzExMDM1OTk5OF9tXzYxMV8xNjBfOTBfMS5qcGc\/bm89MSBIVFRQLzEuMQ0KVXNlci1BZ2VudDogUWl5aSBMaXN0IENsaWVudCBQQyA1LjIuMTUuMjI0MA0KSG9zdDogcHJlaW1hZ2UxLnFpeWlwaWMuY29tDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANClByYWdtYTogbm8tY2FjaGUNCkNhY2hlLUNvbnRyb2w6IG5vLWNhY2hlDQpDb25uZWN0aW9uOiBjbG9zZQ0KQWNjZXB0OiAqLyoNCg0K"} -00859{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1461,"source":"pps.pcap","alias":"nDPId-test","flow_id":102,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196856,"flow_last_seen":1467353196856,"flow_idle_time":7440000,"flow_min_l4_payload_len":249,"flow_max_l4_payload_len":249,"flow_tot_l4_payload_len":249,"flow_avg_l4_payload_len":249,"midstream":1,"thread_ts_msec":1467353196856,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50778,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"preimage1.qiyipic.com","url":"preimage1.qiyipic.com\/preimage\/20160506\/f0\/1f\/v_110359998_m_611_160_90_1.jpg?no=1","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} +00861{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1461,"source":"pps.pcap","alias":"nDPId-test","flow_id":102,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353196856,"flow_last_seen":1467353196856,"flow_idle_time":7440000,"flow_min_l4_payload_len":249,"flow_max_l4_payload_len":249,"flow_tot_l4_payload_len":249,"flow_avg_l4_payload_len":249,"midstream":1,"thread_ts_msec":1467353196856,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50778,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"preimage1.qiyipic.com","url":"preimage1.qiyipic.com\/preimage\/20160506\/f0\/1f\/v_110359998_m_611_160_90_1.jpg?no=1","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} 02154{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1462,"source":"pps.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":2,"flow_last_seen":1467353196917,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1314,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1314,"pkt_l4_len":1280,"thread_ts_msec":1467353196917,"pkt":"ABxCjnAxTF4M6gNlCABFAAUUDjVAADgGss\/fGmoUwKhzCABQxlp7yE3nmzJ751AQAB9cGQAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IFFXUw0KRGF0ZTogRnJpLCAwMSBKdWwgMjAxNiAwNjowNjozNiBHTVQNCkNvbnRlbnQtVHlwZTogaW1hZ2UvanBlZw0KQ29udGVudC1MZW5ndGg6IDY2MTIxMQ0KQ29ubmVjdGlvbjogY2xvc2UNCkV4cGlyZXM6IEZyaSwgMDUgTWF5IDIwMTcgMTc6MzU6NTUgR01UDQpDYWNoZS1Db250cm9sOiBtYXgtYWdlPTMxNTM2MDAwDQpBY2NlcHQtUmFuZ2VzOiBieXRlcw0KTGFzdC1Nb2RpZmllZDogVGh1LCAwNSBNYXkgMjAxNiAxNjoyMzo1NSBHTVQNClgtQ2FjaGU6IGZyb20gMTI3LjAuMC4xDQpBZ2U6IDQ4ODM0NDENClZpYTogaHR0cC8xLjEgUVRTIChRVFMgW2NIcyBmIF0pDQpYLUNhY2hlOiBmcm9tIDEwLjIyMS4zMi4yMTYNClgtQ2FjaGU6IE1JU1MgZnJvbSAyMjMuMjYuMTA2LjIwDQoNCv\/Y\/+AAEEpGSUYAAQEAAAEAAQAA\/9sAQwADAgIDAgIDAwMDBAMDBAUIBQUEBAUKBwcGCAwKDAwLCgsLDQ4SEA0OEQ4LCxAWEBETFBUVFQwPFxgWFBgSFBUU\/9sAQwEDBAQFBAUJBQUJFA0LDRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU\/\/4AC3FpeWkxLjAuM\/\/AABEIA4QGQAMBIgACEQEDEQH\/xAAeAAACAwADAQEBAAAAAAAAAAAGBwQFCAIDCQABCv\/EAHAQAAEDAwMCAwUEBAoDCgcAIwECAwQFBhEAEiEHMRMiQQgUUWFxFSMygUKRobEJFiQzUmJywdHwJYLhFzRDc5KywsTS1CY1U2Oiw\/EYNkR0g4aTlKSz01RWZGZ1doSjtBknRUZVhZWWxdW14jdXZf\/EAB0BAAIDAQEBAQEAAAAAAAAAAAUGAwQHAgEIAAn\/xABKEQACAQMDAQUEBwYFAwQBAQkBAgMABBEFEiExBhMiQVEUYXGRIzKBobHB0QcVJELh8DM0UmJyFiXxJjU2Q4KSF0RTc6LCY7LS\/9oADAMBAAIRAxEAPwDytAyeNWtFoU6vyTFgRlSXcbsJ9B8fl+eqxHqdN32eupf+5vW5UmPVHaHUHUpMapNHCmlDdxnBxnP7NTSEouRRHT4I7mdYpW2g0MdQukl49JKsmm3fb0+gS3BuZ97aKUPpwDubWPK4MKHKVEc6GfB+71qP21vapV7RkmgxSmNKRQ8iNNSkh8JU22lxLigdq962\/E4T5c4BOs+RYyXt+9GvEJIzXtxb9zIY85++q2mvKhvb0f6yf6Q1fvM+8sb2vwajqp2x9KEaMLI6f1e5vG9xjq92\/SfdVsZCvmo9z8k5+mpopSG2jmvYSyHaelDtuyUwH0vLXs82ngvqqxcNDk0eP4PljJZU\/wCH5nMjBx9B66X\/AFL6K3H04lNe+x25cNxhuQ3JiKK0bVDI3DgpPxyPz0GUyqzaa9vjp93WrCfER6D4jRLayjnijVvclPAKOG4EOlTUKQvwv6qv0vppy2vUkLpxXv3o2+XSltd5ittlC0KkPf8ACSZPJ47AZ9NGTdbjURtq"} 02161{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1463,"source":"pps.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":3,"flow_last_seen":1467353196917,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1314,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1314,"pkt_l4_len":1280,"thread_ts_msec":1467353196917,"pkt":"ABxCjnAxTF4M6gNlCABFAAUUDjZAADgGss7fGmoUwKhzCABQxlp7yFLTmzJ751AQAB+1AQAAFHWnfu3ebsPmflqKi8LbOppt0aSln8a0oQnzOKX6fXTzo\/s7tX30MrdPrafdJ9wOpqEVa0+eCttATGWR8cDKh8HCNIf2Y7kse++qsW3Z9ZRJmISqRHhlv7ua8gbtu88KwMqCRndtPwwr0FYe3t6IW8WfGaEajdpKO6T7a8f7q6eXHYM73S46PKpTyVFtK32z4SyP6Dn4VD6HUejUGdXqrT6VTI\/vdSmvtxYrHiJaC1rVtGVnhKfUlR4AJ16QVv3OsV+5oM2OzU4HhtpejSW0raWT2G05\/CnHPx0obh9myNSbjod09Pap\/FmsUupt1BtqSFvxFhIVlBSDuGc4POMZxg6\/XEcyITHyaXYrUM4B6Gst3D0dv22KjesSo2u6f4mtIdrsiFKafZjNrwULQrI8Tck7ylIyACVAaiTOjt7U2gUet1O2pFNpVZYVKp8lx5twPNBIWVHYo+Gdp3bV4OAT6a0xfk3q\/SqN1XjzmEVOHe7qXEyae+XGKY3w2pLbYTkbmQG1KIB8iTyd2lNevUKq1roxZ9hNOOsfYa1eNIShLQeSlstNIGw5O1CnASr8W7nOlh7u7jOGFMEOl2hfEkoApQO9P60p+VHRCeW9Ec2SG0srUtlWCdqwE+U4B4Vj8OhesUp+lSlx5aPCeR+JH6Q5wQfgc8YOmdXrjbcYne5Ux2lTJLiXHJbVVkuLOM\/i3K8xIJGVZ+Whhi7ZNK97Rs94XJTtcddcO4\/iJyfiSrOdXLa6mdvGK5v7Kygi320m41QWoypc57\/iT+8apK8zsqsv\/jDpm2pcKnrVl09bSdkbwvvd310AXb\/41P8AxaP3aMQybnNCnTFuDTCmX\/AehhjDIbSAPKnVJGrkeoyvd4EUynsZ2oT6D4nPH5n5aB6xc36KEI3fQaNvZ9v2pWncEydBmyKVU3Ep92qEfylsjdxnHGd37OdCJbRljMvU0q6Zo8N7cql0+1T5129VKLc\/Syqil3Xa9Qt6Y4kqZEyPtQ+njzNODyuDBTkpJxuGdLxuRMrLm2NCed3f0Ua2H7T3WGX7SU6g\/bURj3OhpKYcnGJKkqabS6HFA7Vblo8TAAx2ydKmO5DpLKWocZKNv6WdWraPwBzwa8vLeGwmMKDcR6HNLKkWS6k+LPgSD8vTRRGTIZ2tQ6a6P7RGNXc64okVKlPvo+m7QlVup7Dfkjqb\/I6u7iPOh+55T9XirgVKTSfPK4\/qJc1El3vLmJU2xD\/1lk6Cn788Zwq2hav62Tr4Xw5t8qUj\/V1x3j\/y8VaEMnklWFQg1yY2l9X3TKzhPwOO\/wCrOulNLqCW9q5pS38E5xrn\/HR+bQfdURl+9Ik+MiUCQkp27S3t7ZJwd2dc7URUalWIrlTZe+yVFXiOKSdnrjJHzx664DsR1oitrcEgAYqJ4K4v4Xx+rXwlFKfM\/wDs0YdYLVi2\/R6VPpjS\/DlZS67HytltSOVZVk4J3JIB+fOlYZC9vm8356mTGM1O9q8bbSc1bSFNq3bXV7tdLCXHlbfHA4yVHOAB+v8AdqvebmNspfcQUtr7HXFp7wVbtxV6HUrHCHb1qxDGAw39KNZfTyrU1Q94TGRmImaFLfH8yr8Kvz+HfUumWDVqp44YfiL8BxDToEgJCFKKgkHPx2q5Hw510nqOxJTJT\/Fqmp8SP7sOM+HyrCx\/X8xyeO6vUjFt"} 00587{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1601,"source":"pps.pcap","alias":"nDPId-test","flow_id":103,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353197131,"flow_last_seen":1467353197131,"flow_idle_time":180000,"flow_min_l4_payload_len":133,"flow_max_l4_payload_len":133,"flow_tot_l4_payload_len":133,"flow_avg_l4_payload_len":133,"midstream":0,"thread_ts_msec":1467353197131,"l3_proto":"ip4","src_ip":"192.168.115.1","dst_ip":"239.255.255.250","src_port":50945,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} @@ -405,18 +405,18 @@ 00609{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1687,"source":"pps.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":3,"flow_last_seen":1467353197271,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":167,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":167,"pkt_l4_len":133,"thread_ts_msec":1467353197271,"pkt":"AQBef\/\/6dNArkea6CABFAACZc\/4AAAERIbLAqHMB7\/\/\/+scBB2wAhQmdTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDoyMzkuMjU1LjI1NS4yNTA6MTkwMA0KU1Q6dXJuOnNjaGVtYXMtdXBucC1vcmc6ZGV2aWNlOk1lZGlhUmVuZGVyZXI6MQ0KTWFuOiJzc2RwOmRpc2NvdmVyIg0KTVg6Mw0KDQo="} 00588{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1995,"source":"pps.pcap","alias":"nDPId-test","flow_id":104,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353197951,"flow_last_seen":1467353197951,"flow_idle_time":7440000,"flow_min_l4_payload_len":1260,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":1260,"midstream":1,"thread_ts_msec":1467353197951,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50779,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 02136{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1995,"source":"pps.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_last_seen":1467353197951,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1314,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1314,"pkt_l4_len":1280,"thread_ts_msec":1467353197951,"pkt":"TF4M6gNlABxCjnAxCABFAAUUM2tAAIAGCK3AqHMIb84WTcZbAFDJCjAgTd\/tYVAQAQRxYwAAR0VUIC9iP3BmPTIwMSZwPTExJnAxPTExNCZhcD0wJnNvdXJjZTE9bGlzdCZzb3VyY2UyPW9ubGluZV9sJnQ9MjAxJmN0PWNsdF9fcGxfcGxheSZhbGJ1bV9pZD0xODA5MzIzMDEmYzE9NDc5NTMxMDAwJmNsdD1ob21lZGwmY249MTYwNTA1LSVFNiVBRCVBMyVFNyU4OSU4NyVFRiVCQyU5QSVFOSU4MyU5MSVFNiU4MSVCQSVFNiVBQyVBNyVFNSVCNyVCNCVFNCVCQSU4QyVFNiVBQyVBMSVFNSVCRCU5MiVFNiU5RCVBNSVFNSU4RiU4RCVFOSU4MCU4NiVFOCVBMiVBRC0lRTQlQkIlOEElRTYlOTklOUE4MCVFNSU5MCU4RSVFOCU4NCVCMSVFNSU4RiVBMyVFNyVBNyU4MCZjcHV1c2U9MTQuMSZkZT0zMmU2NTRmYTU3YmU5MGVjNjM4YzQ2ZGRmZGQ2Njc1NyZkbGx2PWFwcHYlM0Q1LjAuMC4xMDAzJTdDb2x2JTNENS4wLjAuMTEwMSZldD0wJmZ0PTIxNzUmaHQ9MCZodT0tMSZpc2RtPTAmaXNsb2NhbD0wJmt2PTEwLjAuMC4yOTMmbGFuZz0mbWVtcGh5PTY3Jm1lbXZpcj0xMjEmbXQ9MCZtdj01LjIuMTUuMjI0MCZwMj0xMDExJnBlPSZwb3B0PTAmcHQ9MiZwdHlwZT0xJnB1PSZyPTQ3OTUzMTAwMCZyX2lkPTQ3OTUzMTAwMCZyYT0xJnJuPTIzOTg3JnNjaG5faWQ9MjAwMDAzNzE5JTI0JTI0JTI0JTI0MTgwOTMyMzAxJnNjaG5fbmFtZT0lRTclQkIlQkMlRTglODklQkElRTUlQTglQjElRTQlQjklOTAlMjQlMjQlMjQlMjQlRTQlQkIlOEElRTYlOTklOUE4MCVFNSU5MCU4RSVFOCU4NCVCMSVFNSU4RiVBMyVFNyVBNyU4MCZzcHQ9MTQ2NzM1MzE5NyZzdGltZT0wJnR2aWQ9NDc5NTMxMDAwJnU9YWFvZWZkdHFnZmRlcHhjMnRudjNwaXVjZ2NiNGVvZm4mdXBsb2FkX2lkPSZ1cmw9aHR0cCUzQSUyRiUyRnd3dy5pcWl5aS5jb20lMkZ2XzE5cnJsdnV4bGcuaHRtbCZ2PTIuMC4xMDIuMzAxNDcmdmU9MzMzODI1Y2RmNDg2Y2M5NGI2ZDI5NTZmNGRlNmQ0Y2ImdmlkPTJiOTQ3MjllM2E5MjBiMjExOTg4NmM1YzY3N2FlOWRiJm1zZz1NWHcwZkFkUUFGSURVZ0ZSU0FCNmR3TmtCUUptZlhWM2RubGhZbmxJQlhUVnh5NGFPTDBBZEM2UVdSYURTS0IxY29kZGkxT3J0aUF6TmYzSDhwZUN2MUwlMkZSMiUyQjZUWUZEVXptSXA5b29TJTJGc3FRME50aEpLVDNBSHRDSkg2SmFLSGQxS2RwTDZwRVJ5bTBKM0FOUWxWUzluQWx3bGw2ciUyQjNMVzlpbXVHd2ZoNCUzRCBIVFRQLzEuMQ0KVXNlci1BZ2VudDogUWl5aSBMaXN0IENsaWVudCBQQyA1LjIuMTUuMjI0MA0KSG9zdDogbXNnLmlxaXlpLmNvbQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwDQpQcmFnbWE6"} -01932{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1995,"source":"pps.pcap","alias":"nDPId-test","flow_id":104,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353197951,"flow_last_seen":1467353197951,"flow_idle_time":7440000,"flow_min_l4_payload_len":1260,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":1260,"midstream":1,"thread_ts_msec":1467353197951,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50779,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"msg.iqiyi.com","url":"msg.iqiyi.com\/b?pf=201&p=11&p1=114&ap=0&source1=list&source2=online_l&t=201&ct=clt__pl_play&album_id=180932301&c1=479531000&clt=homedl&cn=160505-%E6%AD%A3%E7%89%87%EF%BC%9A%E9%83%91%E6%81%BA%E6%AC%A7%E5%B7%B4%E4%BA%8C%E6%AC%A1%E5%BD%92%E6%9D%A5%E5%8F%8D%E9%80%86%E8%A2%AD-%E4%BB%8A%E6%99%9A80%E5%90%8E%E8%84%B1%E5%8F%A3%E7%A7%80&cpuuse=14.1&de=32e654fa57be90ec638c46ddfdd66757&dllv=appv%3D5.0.0.1003%7Colv%3D5.0.0.1101&et=0&ft=2175&ht=0&hu=-1&isdm=0&islocal=0&kv=10.0.0.293&lang=&memphy=67&memvir=121&mt=0&mv=5.2.15.2240&p2=1011&pe=&popt=0&pt=2&ptype=1&pu=&r=479531000&r_id=479531000&ra=1&rn=23987&schn_id=200003719%24%24%24%24180932301&schn_name=%E7%BB%BC%E8%89%BA%E5%A8%B1%E4%B9%90%24%24%24%24%E4%BB%8A%E6%99%9A80%E5%90%8E%E8%84%B1%E5%8F%A3%E7%A7%80&spt=1467353197&stime=0&tvid=479531000&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn&upload_id=&url=http%3A%2F%2Fwww.iqiyi.com%2Fv_19rrlvuxlg.html&v=2.0.102.30147&ve=333825cdf486cc94b6d2956f4de6d4cb&vid=2b94729e3a920b2119886c5c677ae9db&msg=MXw0fAdQAFIDUgFRSAB6dwNkBQJmfXV3dnlhYnlIBXTVxy4aOL0AdC6QWRaDSKB1coddi1OrtiAzNf3H8peCv1L%2FR2%2B6TYFDUzmIp9ooS%2FsqQ0NthJKT3AHtCJH6JaKHd1KdpL6pERym0J3ANQlVS9nAlwll6r%2B3LW9imuGwfh4%3D","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} +01934{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1995,"source":"pps.pcap","alias":"nDPId-test","flow_id":104,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353197951,"flow_last_seen":1467353197951,"flow_idle_time":7440000,"flow_min_l4_payload_len":1260,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1260,"flow_avg_l4_payload_len":1260,"midstream":1,"thread_ts_msec":1467353197951,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50779,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"msg.iqiyi.com","url":"msg.iqiyi.com\/b?pf=201&p=11&p1=114&ap=0&source1=list&source2=online_l&t=201&ct=clt__pl_play&album_id=180932301&c1=479531000&clt=homedl&cn=160505-%E6%AD%A3%E7%89%87%EF%BC%9A%E9%83%91%E6%81%BA%E6%AC%A7%E5%B7%B4%E4%BA%8C%E6%AC%A1%E5%BD%92%E6%9D%A5%E5%8F%8D%E9%80%86%E8%A2%AD-%E4%BB%8A%E6%99%9A80%E5%90%8E%E8%84%B1%E5%8F%A3%E7%A7%80&cpuuse=14.1&de=32e654fa57be90ec638c46ddfdd66757&dllv=appv%3D5.0.0.1003%7Colv%3D5.0.0.1101&et=0&ft=2175&ht=0&hu=-1&isdm=0&islocal=0&kv=10.0.0.293&lang=&memphy=67&memvir=121&mt=0&mv=5.2.15.2240&p2=1011&pe=&popt=0&pt=2&ptype=1&pu=&r=479531000&r_id=479531000&ra=1&rn=23987&schn_id=200003719%24%24%24%24180932301&schn_name=%E7%BB%BC%E8%89%BA%E5%A8%B1%E4%B9%90%24%24%24%24%E4%BB%8A%E6%99%9A80%E5%90%8E%E8%84%B1%E5%8F%A3%E7%A7%80&spt=1467353197&stime=0&tvid=479531000&u=aaoefdtqgfdepxc2tnv3piucgcb4eofn&upload_id=&url=http%3A%2F%2Fwww.iqiyi.com%2Fv_19rrlvuxlg.html&v=2.0.102.30147&ve=333825cdf486cc94b6d2956f4de6d4cb&vid=2b94729e3a920b2119886c5c677ae9db&msg=MXw0fAdQAFIDUgFRSAB6dwNkBQJmfXV3dnlhYnlIBXTVxy4aOL0AdC6QWRaDSKB1coddi1OrtiAzNf3H8peCv1L%2FR2%2B6TYFDUzmIp9ooS%2FsqQ0NthJKT3AHtCJH6JaKHd1KdpL6pERym0J3ANQlVS9nAlwll6r%2B3LW9imuGwfh4%3D","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} 00548{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1996,"source":"pps.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":2,"flow_last_seen":1467353197951,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":124,"pkt_l4_len":90,"thread_ts_msec":1467353197951,"pkt":"TF4M6gNlABxCjnAxCABFAABuM2xAAIAGDVLAqHMIb84WTcZbAFDJCjUMTd\/tYVAYAQQaAAAAIG5vLWNhY2hlDQpDYWNoZS1Db250cm9sOiBuby1jYWNoZQ0KQ29ubmVjdGlvbjogY2xvc2UNCkFjY2VwdDogKi8qDQoNCg=="} 00640{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1997,"source":"pps.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":3,"flow_last_seen":1467353198052,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":194,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":194,"pkt_l4_len":160,"thread_ts_msec":1467353198052,"pkt":"ABxCjnAxTF4M6gNlCABFAAC0gHZAADMGDQJvzhZNwKhzCABQxltN3+1hyQo1UlAYACMO1AAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IG5naW54LzEuOC4wDQpEYXRlOiBGcmksIDAxIEp1bCAyMDE2IDA2OjA2OjM3IEdNVA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCkNvbnRlbnQtTGVuZ3RoOiAwDQpDb25uZWN0aW9uOiBjbG9zZQ0KDQo="} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1998,"source":"pps.pcap","alias":"nDPId-test","flow_id":105,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353198532,"flow_last_seen":1467353198532,"flow_idle_time":7440000,"flow_min_l4_payload_len":249,"flow_max_l4_payload_len":249,"flow_tot_l4_payload_len":249,"flow_avg_l4_payload_len":249,"midstream":1,"thread_ts_msec":1467353198532,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50780,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00786{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1998,"source":"pps.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":1,"flow_last_seen":1467353198532,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":303,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":303,"pkt_l4_len":269,"thread_ts_msec":1467353198532,"pkt":"TF4M6gNlABxCjnAxCABFAAEhM5pAAIAGSV3AqHMI3xpqFMZcAFDCryK2CgBK\/VAYAQQ7tAAAR0VUIC9wcmVpbWFnZS8yMDE2MDUwNi9mMC8xZi92XzExMDM1OTk5OF9tXzYxMV8xNjBfOTBfMi5qcGc\/bm89MiBIVFRQLzEuMQ0KVXNlci1BZ2VudDogUWl5aSBMaXN0IENsaWVudCBQQyA1LjIuMTUuMjI0MA0KSG9zdDogcHJlaW1hZ2UxLnFpeWlwaWMuY29tDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANClByYWdtYTogbm8tY2FjaGUNCkNhY2hlLUNvbnRyb2w6IG5vLWNhY2hlDQpDb25uZWN0aW9uOiBjbG9zZQ0KQWNjZXB0OiAqLyoNCg0K"} -00859{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1998,"source":"pps.pcap","alias":"nDPId-test","flow_id":105,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353198532,"flow_last_seen":1467353198532,"flow_idle_time":7440000,"flow_min_l4_payload_len":249,"flow_max_l4_payload_len":249,"flow_tot_l4_payload_len":249,"flow_avg_l4_payload_len":249,"midstream":1,"thread_ts_msec":1467353198532,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50780,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"preimage1.qiyipic.com","url":"preimage1.qiyipic.com\/preimage\/20160506\/f0\/1f\/v_110359998_m_611_160_90_2.jpg?no=2","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} +00861{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1998,"source":"pps.pcap","alias":"nDPId-test","flow_id":105,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353198532,"flow_last_seen":1467353198532,"flow_idle_time":7440000,"flow_min_l4_payload_len":249,"flow_max_l4_payload_len":249,"flow_tot_l4_payload_len":249,"flow_avg_l4_payload_len":249,"midstream":1,"thread_ts_msec":1467353198532,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50780,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"preimage1.qiyipic.com","url":"preimage1.qiyipic.com\/preimage\/20160506\/f0\/1f\/v_110359998_m_611_160_90_2.jpg?no=2","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} 02166{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1999,"source":"pps.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":2,"flow_last_seen":1467353198595,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1314,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1314,"pkt_l4_len":1280,"thread_ts_msec":1467353198595,"pkt":"ABxCjnAxTF4M6gNlCABFAAUUAJVAADgGwG\/fGmoUwKhzCABQxlwKAEr9wq8jr1AQAB\/+YwAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IFFXUw0KRGF0ZTogRnJpLCAwMSBKdWwgMjAxNiAwNjowNjozOCBHTVQNCkNvbnRlbnQtVHlwZTogaW1hZ2UvanBlZw0KQ29udGVudC1MZW5ndGg6IDY4MDQ1Mw0KQ29ubmVjdGlvbjogY2xvc2UNCkV4cGlyZXM6IEZyaSwgMDUgTWF5IDIwMTcgMTc6MzU6NTYgR01UDQpDYWNoZS1Db250cm9sOiBtYXgtYWdlPTMxNTM2MDAwDQpBY2NlcHQtUmFuZ2VzOiBieXRlcw0KTGFzdC1Nb2RpZmllZDogVGh1LCAwNSBNYXkgMjAxNiAxNjoyMzo1NSBHTVQNClgtQ2FjaGU6IGZyb20gMTI3LjAuMC4xDQpBZ2U6IDQ4ODM0NDINClZpYTogaHR0cC8xLjEgUVRTIChRVFMgW2NIcyBmIF0pDQpYLUNhY2hlOiBmcm9tIDEwLjIyMS4zMi4yMTYNClgtQ2FjaGU6IE1JU1MgZnJvbSAyMjMuMjYuMTA2LjIwDQoNCv\/Y\/+AAEEpGSUYAAQEAAAEAAQAA\/9sAQwADAgIDAgIDAwMDBAMDBAUIBQUEBAUKBwcGCAwKDAwLCgsLDQ4SEA0OEQ4LCxAWEBETFBUVFQwPFxgWFBgSFBUU\/9sAQwEDBAQFBAUJBQUJFA0LDRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU\/\/4AC3FpeWkxLjAuM\/\/AABEIA4QGQAMBIgACEQEDEQH\/xAAeAAACAwADAQEBAAAAAAAAAAAGBwQFCAIDCQABCv\/EAG8QAAEDAwMCBAMEBAgGDQUCHwECAwQFBhEAEiEHMQgTIkEUUWEVMnGBI0KRoQkWJFJyscHRJTNigsPwFyY0Q3OSssLE0tTh8TVThqKz0xg2RGODhIWTo6S0J1RkdHWURnYZN0VVVmVmlZbF4tUp\/8QAHQEAAgMBAQEBAQAAAAAAAAAABQYDBAcCAQgACf\/EAEcRAAIBAwMBBgMGAwcEAQMCBwECAwAEEQUSITEGEyJBUWEUcYEjMpGhsdEVweEHJDNCUmLwFiVy8SY0Q1NzNYKyosJjg9L\/2gAMAwEAAhEDEQA\/APMptJVH130SjzK1ODEJhT7nfaPYfU\/36sLbZpa5kcVlcxmmZPnLp7aFPYwcbQogZzjufnpudML6tTppWVy7NuK4oNWd+7OqUFmN5GAcbVNvOHnPOQB9dazqvexW8bxLlgK902GK6uRDM20HzpX9Quk14dJ6+mm3hbs635Lw8xn4xrah5PHqbX91wcpyUk9+dVO39FrVXio8T1teJOo0iFdEycw1Qk4p82j0xuVIUFNoS8h5S32knctsODaDjdjSXTR+mhR\/8EV3\/wCdb0Q\/9O132ZlLRu0gOSfSoNQiW2mMQOflzSwqSfu64U5Pq0xp1E6YHG+6LuT\/AOjUX\/t+umJROmSVei6rsV+Nsxv+36hlUfxbf5VSDjZ0oKmp\/Qq120RP8lV+OjiVR+nKm1brouhH\/ozGP\/T9fU2j9O0x1eXdVzrTnv8AxYj8f\/R+j\/fKmqCTB+6fKoi+UxQFTU+pz8TqJKZP2n+f9+mRBo\/Tncry7suVfJ\/\/AAYYH\/T9R36H02+L3Ku250q+"} 02175{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2000,"source":"pps.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":3,"flow_last_seen":1467353198595,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":1314,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1314,"pkt_l4_len":1280,"thread_ts_msec":1467353198595,"pkt":"ABxCjnAxTF4M6gNlCABFAAUUAJZAADgGwG7fGmoUwKhzCABQxlwKAE\/pwq8jr1AQAB8TPwAAQtiP\/X8fofczLJZRL\/v\/AJ10rgMaH2Gf0Z1VVRnTPjUywEtnbclzqH\/4txv+36rp9H6bKz5tz3WP6Nsxj\/0\/TXrE0cmn7QD09DVaNjvoBpjfp1znU2VIcOxhxTO3cpxDZUEjnvgfQ9\/kdMGm0bpqlI2XLdrn\/o5FH\/T9HQ6yUG2uklRsGHVriXDly3XBJfo0UFplaUZbSBKJGVpWo+rH6Q8ZJ0lao8w0NVtwc5GeOMfOiVqYmnxKcCg6odBbrtWm0V+ox2Gm6o0XGFCU2spISpRQ4kEqaWEDdtWEn8+Nc5fQi6E7EFMNCluIaAMtGQpRwnPJ4ORydHnUzrNSes\/2KupyKzGZp0NDO+PSY6nZDqRtLrizKHcfvJ1Uzn6DNoUaGmnXP5aWkJakx7dYSp1KVbgorEkhWT3Iz31Qgve0ENiqumF8sjyo+kejk5Lkmq1fhC6hU9DqlM0xzccFLc9ClcKAPGP8odtLOv2vPs6vzKPUUoTMiq2u+UrekH6Ht+zTeVVqHU0T0NWpcm6WzjezbzSVoHqTvQQ7nPqwT+3Vr0XtGkXqK5FtuDc9TktNIVML8unxEoQd4QEl1RGSQc89wNRaRfTWzCa7P2a+f1qneLaFMW2S1Z3nt418lHoT+Gtf0\/wxVG94D1sU62a09IhOtMeWu5qQlYdU0h0cc7glDyCvafzJ1lao0ldLnTYT6C29FecYcRuC9qkKKVDI4OCDyANaFpeo2mrXEq27ZIFBGR41BcYodQCY6tSKJSJlZnCPBjqfe+8Up9h+P9+rC3GqUufH+2lzG6Zk+caelCnsYONoUQO+O5+em50yvu0umdZVMs64rip1Wd5TOqMNmP5GAcbVNuuHnPO4AfXSjqxlggSSJcsBRTTYYrq5EMzbQfOlb1E6TXh0kryKbeFuz7flPArZ+MaKUPp49Ta\/uuD1J5ST351UJb9OtW+KrxO2z4lKjR4d0TZzTVCTtp02jU5qTIUFtoS8l5a32knctsLG1JxuxnSURR+mpSn\/AA\/d6f8A5QxD\/wBN1x2ZlLJIzqck+lQ6hCLeXuwQcenNLCop241wgJ3uaZU2i9MDjfct3J\/9HIh\/6frpi0bpilz0XPdh\/G2ov\/b9cygfxbd5VSD+DFA0xH6PUijJ\/krn46NplG6cKbO66LpH4WzGP\/T9cqZSOnaWHPKue6Fc\/wD7Mxh\/0\/R8TKmqB8H7p8jUJbKYoCpbf6RzPz\/t1Ekt\/wCESPqNMaDRunO9zy7nuhfz\/wBrMf8A7frpfofTb4w7rqugOZ7fxZjH9\/x+hlzMr2US\/wC\/+ddK\/iPFDjDPp1VVNs86aLFM6fBO1Nx3Qf8A0cjf9v1XzaN02P8Ajbmuwf0bai\/9v026vPFLp+1c9PQ1DGWDcil9SmztPOu6bTZMhYUhhxTIG5TiW1KCRz3wD\/qNHtOpHTNI\/RXDdzv\/AKOxU\/8ATjo5HWShW10lqVgw6ncTkOXLecTJk0mNlthaEZbAEknJWlajzj1n3J0l6o8x0RVtwc5GeOMfOiFr3bT4mOBQhUOgl1WpTaK\/UY0dpuqtFxgolNrUkhKlFDiAoqaVtGcLA\/brnK6FXQnCFIhoUtxLQCpSM7lHCQRk98jv20ddTes1M60fYqqm9WIrNOhts741LjqdkOgbS64syR3H7yc6qZ0mhzKDFi\/ZdylkMIQ1"} 00747{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2456,"source":"pps.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":2,"flow_last_seen":1467353199417,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":275,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":275,"pkt_l4_len":241,"thread_ts_msec":1467353199417,"pkt":"ABxCjnAxTF4M6gNlCABFAAEF4D5AADEGSkB7fW9GwKhzCABQxlcB794psg4Z21AYPLiOgAAASFRUUC8xLjEgMjAwIE9LDQpTZXJ2ZXI6IFRlbmdpbmUNCkRhdGU6IEZyaSwgMDEgSnVsIDIwMTYgMDY6MDY6MzggR01UDQpDb250ZW50LVR5cGU6IHRleHQvcGxhaW47Y2hhcnNldD1VVEYtOA0KQ29udGVudC1MZW5ndGg6IDI5DQpDb25uZWN0aW9uOiBjbG9zZQ0KQWNjZXNzLUNvbnRyb2wtQWxsb3ctQ3JlZGVudGlhbHM6IHRydWUNCg0KeyJkYXRhIjp0cnVlLCJjb2RlIjoiQTAwMDAwIn0="} 00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2545,"source":"pps.pcap","alias":"nDPId-test","flow_id":106,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353200271,"flow_last_seen":1467353200271,"flow_idle_time":7440000,"flow_min_l4_payload_len":249,"flow_max_l4_payload_len":249,"flow_tot_l4_payload_len":249,"flow_avg_l4_payload_len":249,"midstream":1,"thread_ts_msec":1467353200271,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50781,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00785{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2545,"source":"pps.pcap","alias":"nDPId-test","flow_id":106,"flow_packet_id":1,"flow_last_seen":1467353200271,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":303,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":303,"pkt_l4_len":269,"thread_ts_msec":1467353200271,"pkt":"TF4M6gNlABxCjnAxCABFAAEhNFdAAIAGSKDAqHMI3xpqFMZdAFCAFVM2Sak8SVAYAQQb1wAAR0VUIC9wcmVpbWFnZS8yMDE2MDUwNi9mMC8xZi92XzExMDM1OTk5OF9tXzYxMV8xNjBfOTBfMy5qcGc\/bm89MyBIVFRQLzEuMQ0KVXNlci1BZ2VudDogUWl5aSBMaXN0IENsaWVudCBQQyA1LjIuMTUuMjI0MA0KSG9zdDogcHJlaW1hZ2UxLnFpeWlwaWMuY29tDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANClByYWdtYTogbm8tY2FjaGUNCkNhY2hlLUNvbnRyb2w6IG5vLWNhY2hlDQpDb25uZWN0aW9uOiBjbG9zZQ0KQWNjZXB0OiAqLyoNCg0K"} -00859{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2545,"source":"pps.pcap","alias":"nDPId-test","flow_id":106,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353200271,"flow_last_seen":1467353200271,"flow_idle_time":7440000,"flow_min_l4_payload_len":249,"flow_max_l4_payload_len":249,"flow_tot_l4_payload_len":249,"flow_avg_l4_payload_len":249,"midstream":1,"thread_ts_msec":1467353200271,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50781,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"},"http": {"hostname":"preimage1.qiyipic.com","url":"preimage1.qiyipic.com\/preimage\/20160506\/f0\/1f\/v_110359998_m_611_160_90_3.jpg?no=3","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} +00861{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2545,"source":"pps.pcap","alias":"nDPId-test","flow_id":106,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353200271,"flow_last_seen":1467353200271,"flow_idle_time":7440000,"flow_min_l4_payload_len":249,"flow_max_l4_payload_len":249,"flow_tot_l4_payload_len":249,"flow_avg_l4_payload_len":249,"midstream":1,"thread_ts_msec":1467353200271,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50781,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"},"http": {"hostname":"preimage1.qiyipic.com","url":"preimage1.qiyipic.com\/preimage\/20160506\/f0\/1f\/v_110359998_m_611_160_90_3.jpg?no=3","code":0,"content_type":"","user_agent":"Qiyi List Client PC 5.2.15.2240"}} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2550,"source":"pps.pcap","alias":"nDPId-test","flow_id":107,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353202192,"flow_last_seen":1467353202192,"flow_idle_time":7440000,"flow_min_l4_payload_len":154,"flow_max_l4_payload_len":154,"flow_tot_l4_payload_len":154,"flow_avg_l4_payload_len":154,"midstream":1,"thread_ts_msec":1467353202192,"l3_proto":"ip4","src_ip":"77.234.41.35","dst_ip":"192.168.115.8","src_port":80,"dst_port":49174,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00661{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2550,"source":"pps.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":1,"flow_last_seen":1467353202192,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":208,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":208,"pkt_l4_len":174,"thread_ts_msec":1467353202192,"pkt":"ABxCjnAxTF4M6gNlCABFKADCuCpAADIG5SVN6ikjwKhzCABQwBY\/zyZ9xn1A6VAYAAIAJQAASFRUUC8xLjEgMjAwIE9LDQpDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQ0KUHJhZ21hOiBuby1jYWNoZQ0KQ2FjaGUtY29udHJvbDogbm8tY2FjaGUNCkNvbm5lY3Rpb246IGtlZXAtYWxpdmUNClRyYW5zZmVyLUVuY29kaW5nOiBjaHVua2VkDQoNCg=="} 00749{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2550,"source":"pps.pcap","alias":"nDPId-test","flow_id":107,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353202192,"flow_last_seen":1467353202192,"flow_idle_time":7440000,"flow_min_l4_payload_len":154,"flow_max_l4_payload_len":154,"flow_tot_l4_payload_len":154,"flow_avg_l4_payload_len":154,"midstream":1,"thread_ts_msec":1467353202192,"l3_proto":"ip4","src_ip":"77.234.41.35","dst_ip":"192.168.115.8","src_port":80,"dst_port":49174,"l4_proto":"tcp","ndpi": {"flow_risk": {"4": {"risk":"Binary Application Transfer","severity":"Severe","risk_score": {"total":250,"client":225,"server":25}}},"proto":"Unknown","breed":"Unrated","category":"Download"}} @@ -443,26 +443,26 @@ 00598{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":33,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136838,"flow_idle_time":180000,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":90,"flow_avg_l4_payload_len":45,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"220.130.154.23","src_port":22793,"dst_port":35941,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00583{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":33,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136838,"flow_idle_time":180000,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":90,"flow_avg_l4_payload_len":45,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"220.130.154.23","src_port":22793,"dst_port":35941,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00682{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":55,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":1467353152692,"flow_last_seen":1467353167734,"flow_idle_time":180000,"flow_min_l4_payload_len":133,"flow_max_l4_payload_len":133,"flow_tot_l4_payload_len":798,"flow_avg_l4_payload_len":133,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.5.57","dst_ip":"239.255.255.250","src_port":59648,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} -00685{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":57,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":1467353156641,"flow_last_seen":1467353156700,"flow_idle_time":7440000,"flow_min_l4_payload_len":257,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":2184,"flow_avg_l4_payload_len":728,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50488,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} +00679{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":57,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":1467353156641,"flow_last_seen":1467353156700,"flow_idle_time":7440000,"flow_min_l4_payload_len":257,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":2184,"flow_avg_l4_payload_len":728,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50488,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} 00589{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":60,"flow_state":"info","flow_packets_processed":27,"flow_first_seen":1467353157138,"flow_last_seen":1467353157157,"flow_idle_time":7440000,"flow_min_l4_payload_len":372,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":32840,"flow_avg_l4_payload_len":1216,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.66","src_port":50491,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00804{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":63,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":1467353157509,"flow_last_seen":1467353159746,"flow_idle_time":7440000,"flow_min_l4_payload_len":376,"flow_max_l4_payload_len":403,"flow_tot_l4_payload_len":1168,"flow_avg_l4_payload_len":389,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.66","src_port":50494,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"12": {"risk":"HTTP Numeric IP Address","severity":"Low","risk_score": {"total":500,"client":450,"server":50}}},"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} -00690{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":81,"flow_state":"finished","flow_packets_processed":246,"flow_first_seen":1467353189325,"flow_last_seen":1467353189439,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":306749,"flow_avg_l4_payload_len":1246,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50505,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00685{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":85,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353190040,"flow_last_seen":1467353190044,"flow_idle_time":7440000,"flow_min_l4_payload_len":158,"flow_max_l4_payload_len":1009,"flow_tot_l4_payload_len":1167,"flow_avg_l4_payload_len":583,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50507,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":88,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353190634,"flow_last_seen":1467353190638,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":366,"flow_tot_l4_payload_len":510,"flow_avg_l4_payload_len":255,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50508,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} +00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":81,"flow_state":"finished","flow_packets_processed":246,"flow_first_seen":1467353189325,"flow_last_seen":1467353189439,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":306749,"flow_avg_l4_payload_len":1246,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50505,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} +00679{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":85,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353190040,"flow_last_seen":1467353190044,"flow_idle_time":7440000,"flow_min_l4_payload_len":158,"flow_max_l4_payload_len":1009,"flow_tot_l4_payload_len":1167,"flow_avg_l4_payload_len":583,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50507,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} +00677{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":88,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353190634,"flow_last_seen":1467353190638,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":366,"flow_tot_l4_payload_len":510,"flow_avg_l4_payload_len":255,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50508,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} 00597{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":32,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136837,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"114.47.91.129","src_port":22793,"dst_port":22576,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00582{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":32,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136837,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"114.47.91.129","src_port":22793,"dst_port":22576,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} -00686{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":1467353138757,"flow_last_seen":1467353138794,"flow_idle_time":7440000,"flow_min_l4_payload_len":187,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1699,"flow_avg_l4_payload_len":566,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50463,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00685{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":47,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":1467353140755,"flow_last_seen":1467353140794,"flow_idle_time":7440000,"flow_min_l4_payload_len":602,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":4283,"flow_avg_l4_payload_len":856,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.32.39","src_port":50476,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00686{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":67,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":1467353165456,"flow_last_seen":1467353165492,"flow_idle_time":7440000,"flow_min_l4_payload_len":187,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1699,"flow_avg_l4_payload_len":566,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50496,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} +00688{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":1467353138757,"flow_last_seen":1467353138794,"flow_idle_time":7440000,"flow_min_l4_payload_len":187,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1699,"flow_avg_l4_payload_len":566,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50463,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"}} +00687{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":47,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":1467353140755,"flow_last_seen":1467353140794,"flow_idle_time":7440000,"flow_min_l4_payload_len":602,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":4283,"flow_avg_l4_payload_len":856,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.32.39","src_port":50476,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"}} +00688{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":67,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":1467353165456,"flow_last_seen":1467353165492,"flow_idle_time":7440000,"flow_min_l4_payload_len":187,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1699,"flow_avg_l4_payload_len":566,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50496,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"}} 00682{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":65,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353160157,"flow_last_seen":1467353163154,"flow_idle_time":180000,"flow_min_l4_payload_len":137,"flow_max_l4_payload_len":137,"flow_tot_l4_payload_len":274,"flow_avg_l4_payload_len":137,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.5.48","dst_ip":"239.255.255.250","src_port":63930,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} 00678{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":69,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":1467353166729,"flow_last_seen":1467353166729,"flow_idle_time":180000,"flow_min_l4_payload_len":88,"flow_max_l4_payload_len":88,"flow_tot_l4_payload_len":88,"flow_avg_l4_payload_len":88,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.5.63","dst_ip":"239.255.255.250","src_port":39383,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} 00597{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136439,"flow_last_seen":1467353136440,"flow_idle_time":180000,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":74,"flow_avg_l4_payload_len":37,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.249.53.196","src_port":22793,"dst_port":32443,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00582{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136439,"flow_last_seen":1467353136440,"flow_idle_time":180000,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":74,"flow_avg_l4_payload_len":37,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.249.53.196","src_port":22793,"dst_port":32443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} -00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":90,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353191500,"flow_last_seen":1467353191505,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":439,"flow_tot_l4_payload_len":583,"flow_avg_l4_payload_len":291,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50766,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":91,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":1467353191521,"flow_last_seen":1467353191606,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":476,"flow_tot_l4_payload_len":2480,"flow_avg_l4_payload_len":310,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50767,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":93,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353191604,"flow_last_seen":1467353191608,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":472,"flow_tot_l4_payload_len":616,"flow_avg_l4_payload_len":308,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50768,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00690{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":102,"flow_state":"finished","flow_packets_processed":529,"flow_first_seen":1467353196856,"flow_last_seen":1467353197680,"flow_idle_time":7440000,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":664395,"flow_avg_l4_payload_len":1255,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50778,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00690{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":105,"flow_state":"finished","flow_packets_processed":542,"flow_first_seen":1467353198532,"flow_last_seen":1467353199507,"flow_idle_time":7440000,"flow_min_l4_payload_len":249,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":681117,"flow_avg_l4_payload_len":1256,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50780,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} +00677{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":90,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353191500,"flow_last_seen":1467353191505,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":439,"flow_tot_l4_payload_len":583,"flow_avg_l4_payload_len":291,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50766,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} +00678{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":91,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":1467353191521,"flow_last_seen":1467353191606,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":476,"flow_tot_l4_payload_len":2480,"flow_avg_l4_payload_len":310,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50767,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} +00677{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":93,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353191604,"flow_last_seen":1467353191608,"flow_idle_time":7440000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":472,"flow_tot_l4_payload_len":616,"flow_avg_l4_payload_len":308,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50768,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} +00692{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":102,"flow_state":"finished","flow_packets_processed":529,"flow_first_seen":1467353196856,"flow_last_seen":1467353197680,"flow_idle_time":7440000,"flow_min_l4_payload_len":126,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":664395,"flow_avg_l4_payload_len":1255,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50778,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"}} +00692{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":105,"flow_state":"finished","flow_packets_processed":542,"flow_first_seen":1467353198532,"flow_last_seen":1467353199507,"flow_idle_time":7440000,"flow_min_l4_payload_len":249,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":681117,"flow_avg_l4_payload_len":1256,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50780,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"}} 00585{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":106,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353200271,"flow_last_seen":1467353200271,"flow_idle_time":7440000,"flow_min_l4_payload_len":249,"flow_max_l4_payload_len":249,"flow_tot_l4_payload_len":249,"flow_avg_l4_payload_len":249,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50781,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00659{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":87,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353190168,"flow_last_seen":1467353190235,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":145,"flow_tot_l4_payload_len":290,"flow_avg_l4_payload_len":145,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"202.108.14.219","dst_ip":"192.168.115.8","src_port":80,"dst_port":50295,"l4_proto":"tcp","ndpi": {"confidence": {"1":"Match by port"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} 00585{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":87,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353190168,"flow_last_seen":1467353190235,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":145,"flow_tot_l4_payload_len":290,"flow_avg_l4_payload_len":145,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"202.108.14.219","dst_ip":"192.168.115.8","src_port":80,"dst_port":50295,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} @@ -470,19 +470,19 @@ 00682{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":80,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":1467353187172,"flow_last_seen":1467353202194,"flow_idle_time":180000,"flow_min_l4_payload_len":133,"flow_max_l4_payload_len":133,"flow_tot_l4_payload_len":798,"flow_avg_l4_payload_len":133,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.5.28","dst_ip":"239.255.255.250","src_port":60023,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} 00596{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136833,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"210.44.171.1","src_port":22793,"dst_port":29702,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00581{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136833,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"210.44.171.1","src_port":22793,"dst_port":29702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} -00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":58,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353156959,"flow_last_seen":1467353156998,"flow_idle_time":7440000,"flow_min_l4_payload_len":199,"flow_max_l4_payload_len":376,"flow_tot_l4_payload_len":575,"flow_avg_l4_payload_len":287,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"119.188.13.188","src_port":50489,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":59,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353157063,"flow_last_seen":1467353157103,"flow_idle_time":7440000,"flow_min_l4_payload_len":303,"flow_max_l4_payload_len":425,"flow_tot_l4_payload_len":728,"flow_avg_l4_payload_len":364,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"119.188.13.188","src_port":50490,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":94,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353191688,"flow_last_seen":1467353191722,"flow_idle_time":7440000,"flow_min_l4_payload_len":237,"flow_max_l4_payload_len":550,"flow_tot_l4_payload_len":787,"flow_avg_l4_payload_len":393,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50769,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} +00678{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":58,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353156959,"flow_last_seen":1467353156998,"flow_idle_time":7440000,"flow_min_l4_payload_len":199,"flow_max_l4_payload_len":376,"flow_tot_l4_payload_len":575,"flow_avg_l4_payload_len":287,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"119.188.13.188","src_port":50489,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} +00678{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":59,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353157063,"flow_last_seen":1467353157103,"flow_idle_time":7440000,"flow_min_l4_payload_len":303,"flow_max_l4_payload_len":425,"flow_tot_l4_payload_len":728,"flow_avg_l4_payload_len":364,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"119.188.13.188","src_port":50490,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} +00686{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":94,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353191688,"flow_last_seen":1467353191722,"flow_idle_time":7440000,"flow_min_l4_payload_len":237,"flow_max_l4_payload_len":550,"flow_tot_l4_payload_len":787,"flow_avg_l4_payload_len":393,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50769,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"}} 00638{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":40,"flow_first_seen":1467353136439,"flow_last_seen":1467353136982,"flow_idle_time":180000,"flow_min_l4_payload_len":19,"flow_max_l4_payload_len":1083,"flow_tot_l4_payload_len":10732,"flow_avg_l4_payload_len":268,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"222.197.138.12","src_port":22793,"dst_port":6956,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"proto":"Unknown","breed":"Unrated"}} 00638{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":101,"flow_first_seen":1467353136433,"flow_last_seen":1467353136982,"flow_idle_time":180000,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":1065,"flow_tot_l4_payload_len":34577,"flow_avg_l4_payload_len":342,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"118.171.15.56","dst_ip":"192.168.115.8","src_port":5544,"dst_port":22793,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"proto":"Unknown","breed":"Unrated"}} 00650{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136616,"flow_last_seen":1467353136617,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50462,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"1":"Match by port"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} 00576{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136616,"flow_last_seen":1467353136617,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50462,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":40,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353139505,"flow_last_seen":1467353139595,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":575,"flow_tot_l4_payload_len":720,"flow_avg_l4_payload_len":360,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50467,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} 00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":41,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353139627,"flow_last_seen":1467353139779,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":519,"flow_tot_l4_payload_len":664,"flow_avg_l4_payload_len":332,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50469,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":42,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353139662,"flow_last_seen":1467353139771,"flow_idle_time":7440000,"flow_min_l4_payload_len":140,"flow_max_l4_payload_len":370,"flow_tot_l4_payload_len":510,"flow_avg_l4_payload_len":255,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50470,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} +00686{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":42,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353139662,"flow_last_seen":1467353139771,"flow_idle_time":7440000,"flow_min_l4_payload_len":140,"flow_max_l4_payload_len":370,"flow_tot_l4_payload_len":510,"flow_avg_l4_payload_len":255,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50470,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"}} 00685{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":43,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1467353139819,"flow_last_seen":1467353142600,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":898,"flow_tot_l4_payload_len":2080,"flow_avg_l4_payload_len":520,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50471,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} 00685{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":46,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353140709,"flow_last_seen":1467353140888,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":890,"flow_tot_l4_payload_len":1035,"flow_avg_l4_payload_len":517,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50473,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00686{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":44,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353140628,"flow_last_seen":1467353140677,"flow_idle_time":7440000,"flow_min_l4_payload_len":140,"flow_max_l4_payload_len":1046,"flow_tot_l4_payload_len":1186,"flow_avg_l4_payload_len":593,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.221","src_port":50474,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} +00688{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":44,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353140628,"flow_last_seen":1467353140677,"flow_idle_time":7440000,"flow_min_l4_payload_len":140,"flow_max_l4_payload_len":1046,"flow_tot_l4_payload_len":1186,"flow_avg_l4_payload_len":593,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.221","src_port":50474,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"}} 00685{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":45,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353140655,"flow_last_seen":1467353140720,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":887,"flow_tot_l4_payload_len":1032,"flow_avg_l4_payload_len":516,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50475,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} 00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":48,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353141138,"flow_last_seen":1467353141308,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":560,"flow_tot_l4_payload_len":705,"flow_avg_l4_payload_len":352,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50477,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} 00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":51,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353147705,"flow_last_seen":1467353147794,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":363,"flow_tot_l4_payload_len":508,"flow_avg_l4_payload_len":254,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50483,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} @@ -521,12 +521,12 @@ 00585{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1467353136835,"flow_last_seen":1467353136837,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":148,"flow_tot_l4_payload_len":344,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"114.41.144.153","src_port":22793,"dst_port":10492,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00597{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136833,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"61.223.204.67","src_port":22793,"dst_port":11102,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00582{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136833,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"61.223.204.67","src_port":22793,"dst_port":11102,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} -00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":71,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353167288,"flow_last_seen":1467353167373,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":640,"flow_tot_l4_payload_len":785,"flow_avg_l4_payload_len":392,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.110.220.15","src_port":50498,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":61,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":1467353157433,"flow_last_seen":1467353157718,"flow_idle_time":7440000,"flow_min_l4_payload_len":335,"flow_max_l4_payload_len":463,"flow_tot_l4_payload_len":1261,"flow_avg_l4_payload_len":420,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.13.3","src_port":50492,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00685{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":72,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353170523,"flow_last_seen":1467353171307,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":1043,"flow_tot_l4_payload_len":1188,"flow_avg_l4_payload_len":594,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.76","src_port":50499,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00682{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":89,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":1467353190892,"flow_last_seen":1467353190978,"flow_idle_time":7440000,"flow_min_l4_payload_len":5,"flow_max_l4_payload_len":443,"flow_tot_l4_payload_len":557,"flow_avg_l4_payload_len":185,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.38.219.107","src_port":50509,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":96,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353195855,"flow_last_seen":1467353195998,"flow_idle_time":7440000,"flow_min_l4_payload_len":221,"flow_max_l4_payload_len":345,"flow_tot_l4_payload_len":566,"flow_avg_l4_payload_len":283,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.111.70","src_port":50772,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":98,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353196348,"flow_last_seen":1467353199417,"flow_idle_time":7440000,"flow_min_l4_payload_len":221,"flow_max_l4_payload_len":345,"flow_tot_l4_payload_len":566,"flow_avg_l4_payload_len":283,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.111.70","src_port":50775,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} +00677{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":71,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353167288,"flow_last_seen":1467353167373,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":640,"flow_tot_l4_payload_len":785,"flow_avg_l4_payload_len":392,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.110.220.15","src_port":50498,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} +00677{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":61,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":1467353157433,"flow_last_seen":1467353157718,"flow_idle_time":7440000,"flow_min_l4_payload_len":335,"flow_max_l4_payload_len":463,"flow_tot_l4_payload_len":1261,"flow_avg_l4_payload_len":420,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.13.3","src_port":50492,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} +00687{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":72,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353170523,"flow_last_seen":1467353171307,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":1043,"flow_tot_l4_payload_len":1188,"flow_avg_l4_payload_len":594,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.76","src_port":50499,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"}} +00676{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":89,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":1467353190892,"flow_last_seen":1467353190978,"flow_idle_time":7440000,"flow_min_l4_payload_len":5,"flow_max_l4_payload_len":443,"flow_tot_l4_payload_len":557,"flow_avg_l4_payload_len":185,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.38.219.107","src_port":50509,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} +00686{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":96,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353195855,"flow_last_seen":1467353195998,"flow_idle_time":7440000,"flow_min_l4_payload_len":221,"flow_max_l4_payload_len":345,"flow_tot_l4_payload_len":566,"flow_avg_l4_payload_len":283,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.111.70","src_port":50772,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"}} +00686{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":98,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353196348,"flow_last_seen":1467353199417,"flow_idle_time":7440000,"flow_min_l4_payload_len":221,"flow_max_l4_payload_len":345,"flow_tot_l4_payload_len":566,"flow_avg_l4_payload_len":283,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.111.70","src_port":50775,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"}} 00598{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1467353136483,"flow_last_seen":1467353136483,"flow_idle_time":180000,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":131,"flow_avg_l4_payload_len":43,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"183.228.182.44","dst_ip":"192.168.115.8","src_port":13913,"dst_port":22793,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00583{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1467353136483,"flow_last_seen":1467353136483,"flow_idle_time":180000,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":131,"flow_avg_l4_payload_len":43,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"183.228.182.44","dst_ip":"192.168.115.8","src_port":13913,"dst_port":22793,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00682{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":84,"flow_state":"finished","flow_packets_processed":5,"flow_first_seen":1467353189820,"flow_last_seen":1467353201861,"flow_idle_time":180000,"flow_min_l4_payload_len":133,"flow_max_l4_payload_len":133,"flow_tot_l4_payload_len":665,"flow_avg_l4_payload_len":133,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.5.41","dst_ip":"239.255.255.250","src_port":50374,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} @@ -545,12 +545,12 @@ 00581{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":31,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136837,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"210.47.12.20","src_port":22793,"dst_port":33738,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00596{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":30,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136837,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"210.47.12.19","src_port":22793,"dst_port":33738,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00581{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":30,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136837,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"210.47.12.19","src_port":22793,"dst_port":33738,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} -00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":92,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353191538,"flow_last_seen":1467353191606,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":210,"flow_tot_l4_payload_len":355,"flow_avg_l4_payload_len":177,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.110.220.15","src_port":50765,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} +00677{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":92,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353191538,"flow_last_seen":1467353191606,"flow_idle_time":7440000,"flow_min_l4_payload_len":145,"flow_max_l4_payload_len":210,"flow_tot_l4_payload_len":355,"flow_avg_l4_payload_len":177,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.110.220.15","src_port":50765,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Web"}} 00658{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":49,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353144633,"flow_last_seen":1467353144633,"flow_idle_time":7440000,"flow_min_l4_payload_len":293,"flow_max_l4_payload_len":293,"flow_tot_l4_payload_len":293,"flow_avg_l4_payload_len":293,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"117.79.81.135","dst_ip":"192.168.115.8","src_port":80,"dst_port":50443,"l4_proto":"tcp","ndpi": {"confidence": {"1":"Match by port"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} 00584{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":49,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1467353144633,"flow_last_seen":1467353144633,"flow_idle_time":7440000,"flow_min_l4_payload_len":293,"flow_max_l4_payload_len":293,"flow_tot_l4_payload_len":293,"flow_avg_l4_payload_len":293,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"117.79.81.135","dst_ip":"192.168.115.8","src_port":80,"dst_port":50443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} -00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":100,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353196441,"flow_last_seen":1467353196535,"flow_idle_time":7440000,"flow_min_l4_payload_len":140,"flow_max_l4_payload_len":340,"flow_tot_l4_payload_len":480,"flow_avg_l4_payload_len":240,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50776,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00686{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":101,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353196740,"flow_last_seen":1467353196835,"flow_idle_time":7440000,"flow_min_l4_payload_len":140,"flow_max_l4_payload_len":1132,"flow_tot_l4_payload_len":1272,"flow_avg_l4_payload_len":636,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50777,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} -00685{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":104,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":1467353197951,"flow_last_seen":1467353198052,"flow_idle_time":7440000,"flow_min_l4_payload_len":70,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1470,"flow_avg_l4_payload_len":490,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50779,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP","breed":"Acceptable","category":"Streaming"}} +00686{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":100,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353196441,"flow_last_seen":1467353196535,"flow_idle_time":7440000,"flow_min_l4_payload_len":140,"flow_max_l4_payload_len":340,"flow_tot_l4_payload_len":480,"flow_avg_l4_payload_len":240,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50776,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"}} +00688{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":101,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1467353196740,"flow_last_seen":1467353196835,"flow_idle_time":7440000,"flow_min_l4_payload_len":140,"flow_max_l4_payload_len":1132,"flow_tot_l4_payload_len":1272,"flow_avg_l4_payload_len":636,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50777,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"}} +00687{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":104,"flow_state":"finished","flow_packets_processed":3,"flow_first_seen":1467353197951,"flow_last_seen":1467353198052,"flow_idle_time":7440000,"flow_min_l4_payload_len":70,"flow_max_l4_payload_len":1260,"flow_tot_l4_payload_len":1470,"flow_avg_l4_payload_len":490,"midstream":1,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50779,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.PPStream","breed":"Fun","category":"Streaming"}} 00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":75,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":1467353179045,"flow_last_seen":1467353203065,"flow_idle_time":180000,"flow_min_l4_payload_len":133,"flow_max_l4_payload_len":133,"flow_tot_l4_payload_len":1197,"flow_avg_l4_payload_len":133,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.5.38","dst_ip":"239.255.255.250","src_port":58897,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} 00682{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":70,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":1467353166729,"flow_last_seen":1467353166729,"flow_idle_time":180000,"flow_min_l4_payload_len":123,"flow_max_l4_payload_len":123,"flow_tot_l4_payload_len":123,"flow_avg_l4_payload_len":123,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.5.63","dst_ip":"239.255.255.250","src_port":60976,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SSDP","breed":"Acceptable","category":"System"}} 00598{"flow_event_id":8,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_idle_time":180000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1467353203157,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.117.101.81","src_port":22793,"dst_port":10162,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} @@ -572,9 +572,9 @@ ~~ total active/idle flows...: 107/107 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4873477 bytes -~~ total memory freed........: 4873477 bytes -~~ total allocations/frees...: 104156/104156 +~~ total memory allocated....: 5372384 bytes +~~ total memory freed........: 5372384 bytes +~~ total allocations/frees...: 116038/116038 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 451 chars ~~ json string max len.......: 2182 chars diff --git a/test/results/pptp.pcap.out b/test/results/pptp.pcap.out new file mode 100644 index 000000000..938df3187 --- /dev/null +++ b/test/results/pptp.pcap.out @@ -0,0 +1,24 @@ +00455{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"pptp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00541{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"pptp.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1451895531141} +00573{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"pptp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1451895531141,"flow_last_seen":1451895531141,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1451895531141,"l3_proto":"ip4","src_ip":"192.168.43.22","dst_ip":"191.101.61.1","src_port":41366,"dst_port":1723,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00475{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"pptp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1451895531141,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1451895531141,"pkt":"AhoR+E9+0N+aZRdHCABFAAA8SqVAAEAGB\/LAqCsWv2U9AaGWBrt+ULaEAAAAAKACchAUeAAAAgQFtAQCCAoAB\/whAAAAAAEDAwo="} +00474{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"pptp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1451895531183,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1451895531183,"pkt":"0N+aZRdHAhoR+E9+CABFUAA8Q2pAAPwGUty\/ZT0BwKgrFga7oZZ1tjA4flC2haASD5Yd2AAAAgQFMgEBCAoLt6rxAAf8IQQCAAA="} +00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"pptp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1451895531183,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1451895531183,"pkt":"AhoR+E9+0N+aZRdHCABFAAA0SqZAAEAGB\/nAqCsWv2U9AaGWBrt+ULaFdbYwOYAQchDmkwAAAQEICgAH\/CwLt6rx"} +00633{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"pptp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1451895531141,"flow_last_seen":1451895531183,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":156,"flow_tot_l4_payload_len":156,"flow_avg_l4_payload_len":39,"midstream":0,"thread_ts_msec":1451895531183,"l3_proto":"ip4","src_ip":"192.168.43.22","dst_ip":"191.101.61.1","src_port":41366,"dst_port":1723,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"PPTP","breed":"Acceptable","category":"VPN"}} +00673{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":24,"source":"pptp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":24,"flow_first_seen":1451895531141,"flow_last_seen":1451895536574,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":168,"flow_tot_l4_payload_len":740,"flow_avg_l4_payload_len":30,"midstream":0,"thread_ts_msec":1451895536574,"l3_proto":"ip4","src_ip":"192.168.43.22","dst_ip":"191.101.61.1","src_port":41366,"dst_port":1723,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"PPTP","breed":"Acceptable","category":"VPN"}} +00548{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":24,"source":"pptp.pcap","alias":"nDPId-test","packets-captured":24,"packets-processed":24,"total-skipped-flows":0,"total-l4-data-len":740,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1451895536574} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 24/24 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 740 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5181161 bytes +~~ total memory freed........: 5181161 bytes +~~ total allocations/frees...: 113050/113050 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 460 chars +~~ json string max len.......: 678 chars +~~ json string avg len.......: 559 chars diff --git a/test/results/punycode-idn.pcap.out b/test/results/punycode-idn.pcap.out index 681db20e2..6b9f9fa26 100644 --- a/test/results/punycode-idn.pcap.out +++ b/test/results/punycode-idn.pcap.out @@ -27,9 +27,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681761 bytes -~~ total memory freed........: 4681761 bytes -~~ total allocations/frees...: 101168/101168 +~~ total memory allocated....: 5180668 bytes +~~ total memory freed........: 5180668 bytes +~~ total allocations/frees...: 113050/113050 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 460 chars ~~ json string max len.......: 790 chars diff --git a/test/results/quic-23.pcap.out b/test/results/quic-23.pcap.out index 30a3aed61..e53e25f46 100644 --- a/test/results/quic-23.pcap.out +++ b/test/results/quic-23.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685540 bytes -~~ total memory freed........: 4685540 bytes -~~ total allocations/frees...: 101175/101175 +~~ total memory allocated....: 5189179 bytes +~~ total memory freed........: 5189179 bytes +~~ total allocations/frees...: 113066/113066 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 2206 chars diff --git a/test/results/quic-24.pcap.out b/test/results/quic-24.pcap.out index 693b11825..54358d9f1 100644 --- a/test/results/quic-24.pcap.out +++ b/test/results/quic-24.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685367 bytes -~~ total memory freed........: 4685367 bytes -~~ total allocations/frees...: 101170/101170 +~~ total memory allocated....: 5188960 bytes +~~ total memory freed........: 5188960 bytes +~~ total allocations/frees...: 113061/113061 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 2139 chars diff --git a/test/results/quic-27.pcap.out b/test/results/quic-27.pcap.out index f79f7c2d9..8d9e6238a 100644 --- a/test/results/quic-27.pcap.out +++ b/test/results/quic-27.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685643 bytes -~~ total memory freed........: 4685643 bytes -~~ total allocations/frees...: 101176/101176 +~~ total memory allocated....: 5189341 bytes +~~ total memory freed........: 5189341 bytes +~~ total allocations/frees...: 113067/113067 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 2279 chars diff --git a/test/results/quic-28.pcap.out b/test/results/quic-28.pcap.out index 6fe9beffd..a6a5e4b42 100644 --- a/test/results/quic-28.pcap.out +++ b/test/results/quic-28.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4692223 bytes -~~ total memory freed........: 4692223 bytes -~~ total allocations/frees...: 101408/101408 +~~ total memory allocated....: 5195763 bytes +~~ total memory freed........: 5195763 bytes +~~ total allocations/frees...: 113299/113299 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 2068 chars diff --git a/test/results/quic-29.pcap.out b/test/results/quic-29.pcap.out index 1e5d54cea..3b210a0cf 100644 --- a/test/results/quic-29.pcap.out +++ b/test/results/quic-29.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685367 bytes -~~ total memory freed........: 4685367 bytes -~~ total allocations/frees...: 101170/101170 +~~ total memory allocated....: 5188960 bytes +~~ total memory freed........: 5188960 bytes +~~ total allocations/frees...: 113061/113061 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 2140 chars diff --git a/test/results/quic-33.pcapng.out b/test/results/quic-33.pcapng.out index ba7f5bfa0..38564eb88 100644 --- a/test/results/quic-33.pcapng.out +++ b/test/results/quic-33.pcapng.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4713770 bytes -~~ total memory freed........: 4713770 bytes -~~ total allocations/frees...: 102147/102147 +~~ total memory allocated....: 5217359 bytes +~~ total memory freed........: 5217359 bytes +~~ total allocations/frees...: 114038/114038 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 2144 chars diff --git a/test/results/quic-34.pcap.out b/test/results/quic-34.pcap.out new file mode 100644 index 000000000..175c74183 --- /dev/null +++ b/test/results/quic-34.pcap.out @@ -0,0 +1,24 @@ +00458{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic-34.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00544{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"quic-34.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1646827637244} +00588{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic-34.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646827637244,"flow_last_seen":1646827637244,"flow_idle_time":180000,"flow_min_l4_payload_len":1252,"flow_max_l4_payload_len":1252,"flow_tot_l4_payload_len":1252,"flow_avg_l4_payload_len":1252,"midstream":0,"thread_ts_msec":1646827637244,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.198","src_port":55880,"dst_port":4443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +02137{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic-34.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1646827637244,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"thread_ts_msec":1646827637244,"pkt":"CAAnfrFjCgAnAAAACABFAgUATWVAAEAR9m3AqDgBwKg4xtpIEVsE7ChNxv8AACIIoSj95jI1XLcIjUy3QAcovkkARMqtPUg7uXRSK4kMXX53Es5onLzxtRemVGyuMExaFbMut6vDuqB2U\/DpzOfUlq0FvRt9rUJpjW6yDtUJ\/70ztz+CDYIV8VpKhQLQtYfPD3mmkKn2FxkrrQO4KafazVucb4cvV7T4N0u43AnJcMtc4d\/GXnMaac4VfAlfHe4y11Dgg0O+0aKijzEWoPXxyRR4t51aC7Nkbv\/0J5dgWKDBQk9w37dytb5zwjbfQHpRVluNBzZHs5I4DMZ\/JnNB+PrUyuyBmXrp0gR2XnwVjzQ3flNPFgcQgu2\/JTVF0L13Ckxt\/+QZlc9B3wBoysEquMpFluVCxlhpsJNoFK7jPg3r2c+uxRQG0p8pcZpnvTksWL+f8WqFT5coLPPdZlZwBn02RKfGTA+uAZ0LaE0O1ka34WEpgqpoVc8fayaTadrjLyO\/JlS+dq\/Kdd3y9KPe38jjexcirOrW1+qlPzhwIx8piSprhOCyEQY2+fljrQNCpUoPKvzdasj+8Y\/vgOi4aANXTAspd+NPZCshlwQpGBYQdC7CEZbf5QlwUnySFyecnPIsokfcy7EJCJxGVFXATop39f5agqqDgJBBxbV7Vy06FK1qkx\/0u8uhGfVjqVKRKmprwi9X1kSSqhXt2GH8bZxjiM01oC4BQV78N199Rg9tYJupRv8l6yvhDS9rct08zWWNVxr58lebQUaKNYadQRmZaFtRmnN0sxjkvcxweUxbZooL7E4GGIqIljR4ZhLlzlK3E7B66OJGtQAC7VyR46GafnwhTxp3HrOyLyoZp0Rw7xcWItz9Tv6lT2BoA4Y0DSNY9olTp+DPyrMnUG0vqRxzRhJ8374jg6MVKZMEa\/87MY2irhA8kK8hZoC3M19FTaOnneltuWAhMrf+Q8t8BAlD7kUkH6oHx9vkYnEZiK9+\/sfx6Qq8taGMG\/mcWDWaYEb3NXAZqmf41FHteU\/OwdmlZSqoqDS5DlVhB2wq7tLwmLKxoxTkhjVXaunTU\/kfczBDm1AwklxFw3Hw5J5l+LHrwOolcProF6qLDBkbDOvOptyE1ll3vB0t4SH06Wr36sHzRz1uCQR21A9SHZvKyJK\/SCg1uApsLqdmJZ1f\/+1id8zTEwjq1qmsHED38lQ4CrlbWfoLvOR3f3s\/z\/QkitvfGtHhVZt0j0WepakKe07\/NGHX1V0dM0mTgqZKJh2Io3kvFvctAo6sUjbANXF0S8wxlOujZbFzW1LOki1CXDYWdPlq+SJtyeBxUEDNzFZ71VrbnwsnJNOpHvvMzPqdRV+ndVLZfpyQXSEsFc65QVoQNOu0MGerIkZa7wLe0y4mX0pnI8L\/R\/y1JTawqiJeeUx8r1l44ku\/g3ZE2uSVEJxuuTdY8TSHXRMxr7nqZuOWpvSIaUcGS3Q1TZnsiOTFYcvBWzEbQ72OmSRWUJzCCABBzidjiDpGWzPkhe8\/ROyjlc\/5TRQg67rXC2fAj53uXQRWw3a6jszT4xodZsJKooKIos5G3CpYzzQSJCrtOeOr5\/ce4c+q3Hx2rzKhdgv5WRhVAr2UV23TNUJd0OkmVeoZzs9v+FDb0PtPPYVDKHvjJqHAzOy1dUyjTbdc+UjRQ\/Xh3vEMPhsnnFc+0+ln6b2hntZL0z9eF8yMJK4KNw=="} +01173{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic-34.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646827637244,"flow_last_seen":1646827637244,"flow_idle_time":180000,"flow_min_l4_payload_len":1252,"flow_max_l4_payload_len":1252,"flow_tot_l4_payload_len":1252,"flow_avg_l4_payload_len":1252,"midstream":0,"thread_ts_msec":1646827637244,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.198","src_port":55880,"dst_port":4443,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"24": {"risk":"Missing SNI TLS Extension","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"4":"DPI"},"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {"version":"TLSv1.3","alpn":"h3-34,hq-34,h3-33,hq-33,h3-32,hq-32,h3-31,hq-31,h3-29,hq-29,h3-30,hq-30,h3-28,hq-28,h3-27,hq-27,h3,hq-interop","ja3":"0299b052ace53a14c3a04aceb5efd247","tls_supported_versions":"TLSv1.3,TLSv1.3 (draft),TLSv1.3 (draft),TLSv1.3 (draft)"}} +02137{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"quic-34.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1646827637247,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"thread_ts_msec":1646827637247,"pkt":"CgAnAAAACAAnfrFjCABFAgUAqq4AAEAR2STAqDjGwKg4ARFb2kgE7EgDif8AACIIjUy3QAcovkkIkbyxu2YmbzcAQJwuFyenENUqJ+JAUUd0pzPM6YfLXJbr4Ls6WaBQnpeEVYscLYmqST86NZIZE4bUhuMV7nVVeeqYe8GuuwtatPAGGTW6q7p5GlzaMgwDpbi8BdNdLtW13Hqdt9WnjpqVBlTPXGjJKFNPYUL1p5wtvsDZQ4TlC3npqKXhES1sS6J094lDKZtXU+v7T8eCFSNuI7Td4nHjGGqNqUKgJSus\/wAAIgiNTLdAByi+SQiRvLG7ZiZvN0QVSPjoxHY6BY1VSgy5etewIoW+11THSEpbinUyFsFkXsGASC8punYhUcJKCOC4rBIzaCstKMtMJHeFT+sUXNNib04LBnzYQKYceojlYPsGe5Ro3OtptLvx4kbgnpc62cqQ1nxvDHT\/fJKWJpgJvoU08oiVUiGs3B1bAvXl\/Wd+wkAF\/wAEMtHf7gZ1kaIq4RaPvn5a9A7UzqeEBuYGDShEpWXMe8q8vuDy24QsQNetariaa4kyNHYl4QdNhygXx\/G6ImAU3U1WThFZHC7AGd0gIgLIGzJf\/9m58rpSdM8Ie6D0sH7LUz+QS+Z4XNqqQcfZPaTaAVOFR6VUyiMeaj3F8bkj\/3MFBH1Z7mXRy8N0qVksEG1OlaU1eLaFjqcM9ZlnatIXhDVNsU98jz1VfTd5sFlnZuyyy7JoZ94aXeRH\/zazdoWlaXePukQ+pl9yYFQPdkgJYi+xKQurw0sw\/SIjNt6qV1Kt0\/FKxwfio1WQ7xlNXzsikFbr81oDdnzQYE6rGMYuxy0RnbfRhLVdsGTc9\/tp7zhIS4DV21JLjrv9UwKPcwJ4JD\/1Rxmkn3Jgw\/xQKXSa6JKSiLv0t\/weF0kbZssWUTcVDcUkDhsJSAH0njJoT2cFwm4lWcM5\/27nvncmYaxDvQXBfFPVW+m3Kwufpk8Xq\/eZbeo\/gSSLUYZOuQu+1ySiHDi5lLzsrpugFKrtUw8ayavMdKrm7oT2ZHXYsRczEGy\/6j7hln+rc24EWxZc0x2eirzNMVxjgu\/0CooTXqD4vghqN1FykIiDm0ZniCVUNexnbGWB7jTgFGcio0\/OnikmQ4dYt56aiM9sIGNcOvsTnFVh+cqJS5HY98vC1U2OBDew6qoIOHDQ21GKLwwRZV1T6U5f6o+37jaPoC1trLLadI2tORnFYqRZm7glwbD9lNFVr+PbofAndUgCf6Zk2CDaE686Awtk3d4hYhQQ3WNznovhVpr8uhbkmAY+WL7y023sNxtRIBnWlXFZPHQuiB37VW1mvmc13p6ljSnKt94wjvyH1FOprPa3tga3zWcYEvWdg5Xqw1ju7gmEzi+VGOvWFAXTzHEhgyFz4BPL84om6p0ALU6sMz8ZdCVqy3kojlACSWsh5\/A6tV3eZJDcnfn7IV6RS+dpvmNwYoFMJn6YSfH1ddeM9mWwCcbnxFV4aWagX1z8fcqVLI6IMYAb37L0\/zdSO2uZe\/h4kSA2SLJTWfPj+TnqT2qI8MlPDZYgXs2XiIdxOOzSUnZDmRgGIMADHBZPrEl6WERC1eVKU\/qCzCib8\/Q0YyKXEfqbm+ia9lXh1\/rbg1B\/\/CXdzCHVzZc3ir8TnofN+5SG6M6PapINQPVY7HwnTlqNqDNVMVGtlLYsPe7LMJnAoGEI2aKSrQZRaA=="} +01412{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"quic-34.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1646827637247,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":766,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":766,"pkt_l4_len":732,"thread_ts_msec":1646827637247,"pkt":"CgAnAAAACAAnfrFjCABFAgLwqq8AAEAR2zPAqDjGwKg4ARFb2kgC3Huyr\/8AACIIjUy3QAcovkkIkbyxu2YmbzdBBIfexsm7espBXzGKaZrAS7pggZDUUIfbdQ\/09SYdxmJiPOboVA5GNyIN0WKEZEb2ChDB1GilmJgW7Qp24EMucpJ8B17AVuDTPfEx7nyxUZnDxLnOV1NZxSPDEwEtlJluh20qRikrub3PX5DmXIcRaHLRejZJ9hsaCYWsq6n5Gfas0GF7MLGzHn117Y0pGUO2eqVFiwenMssI9+ug1E1aDiNVvZMQKSFdyDe9LiLFeCdes2+kAlg73TsTCPbewTMdEgVZBgLZaqO0un1mix5Qt6BKTBkVA8VSZ95v+EfSMYEwA9xZi0jAFqqTGyp+ZP95tU0r4nGCl85tIQDBKXfcBXQge764C41Mt0AHKL5JAwe7F8jwhPqhtghmuHu5o5uyPLm0TwLbmCTREzsDZ3DsGt5qVRU9QIvOhWBrh4V4uljh\/BtTxVptxRkCktu+NWT04G8qsIYXDgRKJUfYMbGUdCKTsE7gC0FAzqopaBfgolmLGZhX7ZxOjTG5NpEGFq+sEmPjGPlDauhq8NTECzVYfToMEehRp8C3bVLHR8m\/W+k90FLQ1TlaEbOqjuZyM\/9ouIFSCmQMPUymc3wxlPi0V28D1yaErAIjX4TP0GolGAZO78ybzC72YMWFqgmnosw3ju1DxFOnMm4S5978OZU\/wmbSWd91srzQp2fOyLvD3wvvNCgP73nEBs88atgYEK5VcrbDFNBrhyEvYixxRMTIqYTLkuWudZVMFEpbA6nhu6WPpaKYD3hORyKUUBLP\/t\/DIvXUYAsZ4s7fmfApFG7wJnzGak9JU7Tkzy0XAM9yEGedigZBltqQA4wPLvuXascBjTXzqxcRPwVbbiOpsQwIpMGnMJz4+XgHNI2WaH8iPl9H\/sYwWUugeEAk511PGx++JwUxDqTYxBlG36Eym55D9c1vN\/8RDw+9AAMguw=="} +00938{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4,"source":"quic-34.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646827637244,"flow_last_seen":1646827637247,"flow_idle_time":180000,"flow_min_l4_payload_len":724,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":4668,"flow_avg_l4_payload_len":1167,"midstream":0,"thread_ts_msec":1646827637247,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.198","src_port":55880,"dst_port":4443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"24": {"risk":"Missing SNI TLS Extension","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"4":"DPI"},"proto":"QUIC","breed":"Acceptable","category":"Web"}} +00549{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":4,"source":"quic-34.pcap","alias":"nDPId-test","packets-captured":4,"packets-processed":4,"total-skipped-flows":0,"total-l4-data-len":4668,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1646827637247} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 4/4 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 4668 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5188809 bytes +~~ total memory freed........: 5188809 bytes +~~ total allocations/frees...: 113050/113050 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 463 chars +~~ json string max len.......: 2142 chars +~~ json string avg len.......: 1288 chars diff --git a/test/results/quic-fuzz-overflow.pcapng.out b/test/results/quic-fuzz-overflow.pcapng.out index d8b1b67b8..f82a27543 100644 --- a/test/results/quic-fuzz-overflow.pcapng.out +++ b/test/results/quic-fuzz-overflow.pcapng.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679539 bytes -~~ total memory freed........: 4679539 bytes -~~ total allocations/frees...: 101144/101144 +~~ total memory allocated....: 5178446 bytes +~~ total memory freed........: 5178446 bytes +~~ total allocations/frees...: 113026/113026 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 476 chars ~~ json string max len.......: 3016 chars diff --git a/test/results/quic-mvfst-22.pcap.out b/test/results/quic-mvfst-22.pcap.out index 4493cbc1b..3a083839f 100644 --- a/test/results/quic-mvfst-22.pcap.out +++ b/test/results/quic-mvfst-22.pcap.out @@ -14,9 +14,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4699148 bytes -~~ total memory freed........: 4699148 bytes -~~ total allocations/frees...: 101645/101645 +~~ total memory allocated....: 5202748 bytes +~~ total memory freed........: 5202748 bytes +~~ total allocations/frees...: 113536/113536 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 2134 chars diff --git a/test/results/quic-mvfst-22_decryption_error.pcap.out b/test/results/quic-mvfst-22_decryption_error.pcap.out index 13b73d548..b3502742f 100644 --- a/test/results/quic-mvfst-22_decryption_error.pcap.out +++ b/test/results/quic-mvfst-22_decryption_error.pcap.out @@ -715,9 +715,9 @@ ~~ total active/idle flows...: 0/0 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4678638 bytes -~~ total memory freed........: 4678638 bytes -~~ total allocations/frees...: 101140/101140 +~~ total memory allocated....: 5177545 bytes +~~ total memory freed........: 5177545 bytes +~~ total allocations/frees...: 113022/113022 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 201 chars ~~ json string max len.......: 2037 chars diff --git a/test/results/quic-mvfst-27.pcapng.out b/test/results/quic-mvfst-27.pcapng.out index b6104ba6d..e66c01582 100644 --- a/test/results/quic-mvfst-27.pcapng.out +++ b/test/results/quic-mvfst-27.pcapng.out @@ -14,9 +14,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685511 bytes -~~ total memory freed........: 4685511 bytes -~~ total allocations/frees...: 101175/101175 +~~ total memory allocated....: 5189108 bytes +~~ total memory freed........: 5189108 bytes +~~ total allocations/frees...: 113066/113066 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 471 chars ~~ json string max len.......: 2203 chars diff --git a/test/results/quic-mvfst-exp.pcap.out b/test/results/quic-mvfst-exp.pcap.out index 739fce11a..bc644e89d 100644 --- a/test/results/quic-mvfst-exp.pcap.out +++ b/test/results/quic-mvfst-exp.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685801 bytes -~~ total memory freed........: 4685801 bytes -~~ total allocations/frees...: 101185/101185 +~~ total memory allocated....: 5189401 bytes +~~ total memory freed........: 5189401 bytes +~~ total allocations/frees...: 113076/113076 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 470 chars ~~ json string max len.......: 2153 chars diff --git a/test/results/quic-v2-00.pcapng.out b/test/results/quic-v2-00.pcapng.out index 16c27b720..d3023458a 100644 --- a/test/results/quic-v2-00.pcapng.out +++ b/test/results/quic-v2-00.pcapng.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685954 bytes -~~ total memory freed........: 4685954 bytes -~~ total allocations/frees...: 101185/101185 +~~ total memory allocated....: 5189563 bytes +~~ total memory freed........: 5189563 bytes +~~ total allocations/frees...: 113076/113076 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 468 chars ~~ json string max len.......: 2142 chars diff --git a/test/results/quic.pcap.out b/test/results/quic.pcap.out index df54336df..5892e87c0 100644 --- a/test/results/quic.pcap.out +++ b/test/results/quic.pcap.out @@ -71,9 +71,9 @@ ~~ total active/idle flows...: 10/10 ~~ total timeout flows.......: 1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4702637 bytes -~~ total memory freed........: 4702637 bytes -~~ total allocations/frees...: 101696/101696 +~~ total memory allocated....: 5201544 bytes +~~ total memory freed........: 5201544 bytes +~~ total allocations/frees...: 113578/113578 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 460 chars ~~ json string max len.......: 2271 chars diff --git a/test/results/quic046.pcap.out b/test/results/quic046.pcap.out index 47dece366..444df9aba 100644 --- a/test/results/quic046.pcap.out +++ b/test/results/quic046.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682458 bytes -~~ total memory freed........: 4682458 bytes -~~ total allocations/frees...: 101244/101244 +~~ total memory allocated....: 5181365 bytes +~~ total memory freed........: 5181365 bytes +~~ total allocations/frees...: 113126/113126 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 2248 chars diff --git a/test/results/quic_0RTT.pcap.out b/test/results/quic_0RTT.pcap.out index cec6f418a..861a00250 100644 --- a/test/results/quic_0RTT.pcap.out +++ b/test/results/quic_0RTT.pcap.out @@ -14,9 +14,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4684314 bytes -~~ total memory freed........: 4684314 bytes -~~ total allocations/frees...: 101157/101157 +~~ total memory allocated....: 5187149 bytes +~~ total memory freed........: 5187149 bytes +~~ total allocations/frees...: 113048/113048 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 2139 chars diff --git a/test/results/quic_crypto_aes_auth_size.pcap.out b/test/results/quic_crypto_aes_auth_size.pcap.out new file mode 100644 index 000000000..de894ea44 --- /dev/null +++ b/test/results/quic_crypto_aes_auth_size.pcap.out @@ -0,0 +1,26 @@ +00476{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic_crypto_aes_auth_size.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00562{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"quic_crypto_aes_auth_size.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1639054047280} +00604{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic_crypto_aes_auth_size.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1639054047280,"flow_last_seen":1639054047280,"flow_idle_time":180000,"flow_min_l4_payload_len":1350,"flow_max_l4_payload_len":1350,"flow_tot_l4_payload_len":1350,"flow_avg_l4_payload_len":1350,"midstream":0,"thread_ts_msec":1639054047280,"l3_proto":"ip4","src_ip":"134.53.36.43","dst_ip":"142.104.38.30","src_port":34917,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +02277{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic_crypto_aes_auth_size.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1639054047280,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"thread_ts_msec":1639054047280,"pkt":"AAAAAAAAAAMAKVHRCABFAAVifypAAD8RWHqGNSQrjmgmHohlAbsFTlBUwQAAAAEIajnnvXpZQGkAQKS1+N8fvEy\/IOkT4oydortAv2EA7pMR1b57qEUN\/CWLgwIsiaJrsQ4hFHO3l4u7VGBrkULKHI\/lxjDWdE1irA7d2B7h4jkYKWy0HD2ljAAwNUaCq2GQKYIMFYPPnjUgnc6NRkaRBhSzAe8fZndm3nU75Z7WMus4y4FiuskzWK7wPKBIM7bxQiBvpY62McQkd0tyvv46Jp9sqnschBDc67JbIa9bgESPp+gcP9R53I2XHVB+sKt85pW8jfCDOYD2MzyGLQ+T55Kb3elNggevRPNt5\/n5LSD1+BaMwPIWniyhyXqn9M7ZOvHxtplESf3\/ummwgMYCFjWE4x4CgV+8lqttLnKDT+33uPLxFmhUHvuyRgYs53v+N7Yn38UufUU6ZhOXmHE8+XWeHs3tu8WDodE6SWRhM5xseVzCZYLGTT3X6CjYNFcJl6kyqmquwogEu3CCHnXmS\/INjB4uSUiyMhRi4SumS20xZFVtqZZynkmMlWnK09e81BgkY\/iuisZWvJRuJHFdwM30B5LDjtpgqfazbpCu6Uwmv2u3GL8UYFg9JXJ6XKW7RjDXv2OXecpNpV7Ec+NZ7S+Eblk+2y7gdGGGOJ0YWQ\/UdbM9tjr75mYZlmZ2XmwaOWA7lupjotCEVtvNyVGjw1p0RQjwWwkUNuy\/TjEqMcudShKNa9WCDQ8bWEIgXHDXASO\/PVPq3gEIqJWQbO0nhO2rHJC9mtpB902MTnQB3oRhiTtUMf7fAmQ+6s5GNn6c3en3gGYGA+JPXusJvDjsRu3PwCbxmWJ5W42P6X61ctfR4ImfNUcG5Su4UNFa8ImA7GgSH608jeNlAEH+oOj8LjAiKc4rTEvo1LMxkcm0RbEgQ5zCg4gb3K695U7hnkuVkbZ2P0\/0RHqSidtcHdfWB8hEkFLyKuUlyFbgTj26IexnKPiu\/sik7Xf0GfC\/8RFWHPg46bSbOrQPg\/gjKdjoVYkal7TJgFaID+VHNzeQm+hSPwwtg2AWznQWRmFkp75yYX7gosdtClYrZYA6FFirHqDW+0GJykjlxQKOXDmUJPLnyG1hF2irp+YW2l8A4zScFSFMH7ORiz7jakW38s4r3LjbMiRb8Tx+m08\/My\/lJnC9xZh8q82LXT41dv64cfwg2eQtvH2Lqzs2I9rgcYmsyHnPyvR7699rVEk9J9YaLrjr+fk8N7MwS+A2tX9iODZWnJOUm+mTNwC\/T\/RWyAERM4hbUAEurepo8J\/aEcXnBHo7os5GSVLmj\/GiHweHArDF0myFhpn34cAp8f6Y0QM3kFU6FLExLGABdnyQk5FEBOr15qkQbVxZ3kiwHa5MCacTRiiIRbM6fJjJYMCKTLqYyerVtahDJjc9THoEHqkc263xcjlUk3B+44Z4xuqgt4XeHolWU+aZMt8oRurkAG4Tuf4UKqTmIxukJT2TMBWkasVQHP3Z8Wausgp7GWEQU567iGHAcPK670SSe9B9hqsJ8oOEYcON5apMj26RB8Zd26Q8fiq1vqWEGo1PCxuUi5unaVFgNv+c1hkvn7meyjHS\/L5Rc3CDUEpgtYy1aOHQJRbXUKAeBVqgmzVlTFgKNAdhCllApJowozwlhoVXS7RvypYWLyqEFM7Zu4iCwMajFBhTXBCFwHLDlfiSC1hs3iPlIAICRuCzOLoHacQfJq+YMBKP9Z\/B3dU8jrKoUx8rHfRizok1fJto91R9llaEwHYg05bSKiD9k+j1zXsQMK8reMddzvzIMatcM2wofN5hnpTHOrEb+bb8zNLy1vI98DbE"} +00852{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic_crypto_aes_auth_size.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1639054047280,"flow_last_seen":1639054047280,"flow_idle_time":180000,"flow_min_l4_payload_len":1350,"flow_max_l4_payload_len":1350,"flow_tot_l4_payload_len":1350,"flow_avg_l4_payload_len":1350,"midstream":0,"thread_ts_msec":1639054047280,"l3_proto":"ip4","src_ip":"134.53.36.43","dst_ip":"142.104.38.30","src_port":34917,"dst_port":443,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"QUIC.Snapchat","breed":"Fun","category":"SocialNetwork"},"quic": {"client_requested_server_name":"app-analytics-v2.snapchat.com","version":"TLSv1.3","alpn":"h3","ja3":"1b4b6c50fef204e06798d3fc7cb272fe","tls_supported_versions":"TLSv1.3"}} +00607{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"quic_crypto_aes_auth_size.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1639054232898,"flow_last_seen":1639054232898,"flow_idle_time":180000,"flow_min_l4_payload_len":1350,"flow_max_l4_payload_len":1350,"flow_tot_l4_payload_len":1350,"flow_avg_l4_payload_len":1350,"midstream":0,"thread_ts_msec":1639054232898,"l3_proto":"ip4","src_ip":"245.161.134.177","dst_ip":"77.242.114.14","src_port":27636,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +02285{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"quic_crypto_aes_auth_size.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1639054232898,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"thread_ts_msec":1639054232898,"pkt":"AAAAAAAAAAUAQ0IQCABFAAViVFVAAD8RpeL1oYaxTfJyDmv0AbsFTuofyQAAAAEIVDeTZ9G0fVcAQJ7tD+1f\/+cIs8rTOAJmB9XT+G6akE0bRSYPWlYxlwYQgKRHpPG8lylyHgIaQZ8sJXtKvXdfLWTgSTNd5aRIZtuvjsWGM2q1ChFxTDrq0gh9Mn3XrTBNGLcE\/KOXhBozAtSeZE6MWbRy5IOveCHAiESH1gtNyBv5LBZlj0NMnb2mwSGz3VEF\/uR9XKBDieR+s2tHY1DI52IyGT49Jsx+HESVOfkRSHj1714zjgsyidrvJr51XV\/iMlIIyh8C9eJOXAxFYq+H92kbHkpiREhgpx9V1pLYn02OQvsP5v6Ve8k91xQWteYlQ01o5rSdr40zwXusZGqachnXgXv8vszMRWLA9PLhOI7kOFFDZXcImD8JH5oSxZp5OovqcpoP\/NL0u7PTs2VBLlaF4HoB8x3834lHBmqnFiaVaDFwllLdbz80hqVNmVXpLgB6zB7H02Zk8y1YEnDUvjjsryRUoD\/2uXxaZ0y6dKxzxEDLAdYZLpyefpJQtFMTgT8ocY8Ud+uXKAj9s6m86UDfYUAWlFBJTNv5aeSrzpbaJy8BSLNbxUX14bMcUVrlZa6wvN6KSurVgSJLDi6uRcgpmjWx2Czjz4Z6ygzz6o50UnO3ZNyRnpD0q\/ArniO1mAFuRD8EPWjOQUVIMCFPEjh53eHS6\/oL4FopXCeW3nB8wsfVNzPBv38jmCItrDwi+mGkv6DSWyV+hgXozgwQQ5ejej2maJyF5p5n8LHVV1dEozQcIkFg1jdl11dhdr2YO+cuV9Mzhj9o+bt2Q9zCCfUuQW6bWzMhtGBruaW+trc9bGpZaCKLWinH1VFyH+j0IW6ex1lwpPGickf7IwOfBrCcjRNe9iom9A4AcKomuJD\/3xy56gpwP2whItWhilZu6bnjDW5kcsO\/6LYffu\/gGdurBeVYPsCismGAquBr\/\/sZeURzPCdSTbXciLqrL5bPr0q1GQJFjSFyN79i4bYN0MZZM\/l+RRVat88Aix7e0FL2q\/ldGUkTNonfTMqXRowtJHWSE2F4Hx9sR4mj79bpdjkJ7aPSyTzbpJXvk5hfZhwAxh8b1nGa6UagwcKkChgrDRs+aJj6u5uFs8PDQg\/ZKToy5AjNrFDPEtRRnxuM1zqNb38rtVLTTVgJgQaL0vmq9NaYENXz1aWL+guidN40XBTJrsgxD3EhGUJ+DSi59\/dOKWe2Rl1sISbY6h6MeGh+g\/i+zVTF6y50uxcyWWl1Dmxs2rXt9fj2zARugrEJVmUSW4JJVCY7wL2NY2QeDAAHL20F5xC\/x77hQYZQNgtcjoJAyCSBciIQVQRxhiuZ5p+aFbDuGE6wYLZxwdYvXXM+zUgQ++nEFyfsakRNAZGOL\/2DUBiORi\/tb+bUY3Uks3Z6CiZKZwhEx+G25f\/DF3zus8LeXpgfhonGIiwLpOhSXMO7Sfb2vEzRxXsws0LikyNbDs7giA235fQ4KYtxHcQJYl6jv0pP6jHZr6rzP9zAaWGaPC\/04kDGUig8XFlj43r4bRqomRURoYx\/xcc+mR8kpRFblBJYEvDW2cG25EuhyCidLR\/MEaMJV1aEkmvYk23KqqVsDEwUJTlePtENboY9yvL36SluUuKTLjCv6BAqIcvYU8JUNe5kKy6Y0VoQy45HxGro9pv\/+agix0J+X\/8ZPIoarFDvNd9r9w04Tg40psUeLWizK+dT27jGcmuDPDDVQWmp6QqrzpFKExSzHYja8c4K2jY\/JiwtluOmCp+ttKuD\/hxw1myZNXg94Jx3Iiq7JwfwMXbH2UidKQX\/tu2J"} +00846{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"quic_crypto_aes_auth_size.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1639054232898,"flow_last_seen":1639054232898,"flow_idle_time":180000,"flow_min_l4_payload_len":1350,"flow_max_l4_payload_len":1350,"flow_tot_l4_payload_len":1350,"flow_avg_l4_payload_len":1350,"midstream":0,"thread_ts_msec":1639054232898,"l3_proto":"ip4","src_ip":"245.161.134.177","dst_ip":"77.242.114.14","src_port":27636,"dst_port":443,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"QUIC.Snapchat","breed":"Fun","category":"SocialNetwork"},"quic": {"client_requested_server_name":"gcp.api.snapchat.com","version":"TLSv1.3","alpn":"h3","ja3":"c570fdf41c8bf336ac9442888680bf3a","tls_supported_versions":"TLSv1.3"}} +00710{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2,"source":"quic_crypto_aes_auth_size.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":1639054047280,"flow_last_seen":1639054047280,"flow_idle_time":180000,"flow_min_l4_payload_len":1350,"flow_max_l4_payload_len":1350,"flow_tot_l4_payload_len":1350,"flow_avg_l4_payload_len":1350,"midstream":0,"thread_ts_msec":1639054232898,"l3_proto":"ip4","src_ip":"134.53.36.43","dst_ip":"142.104.38.30","src_port":34917,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"QUIC.Snapchat","breed":"Fun","category":"SocialNetwork"}} +00713{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2,"source":"quic_crypto_aes_auth_size.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":1639054232898,"flow_last_seen":1639054232898,"flow_idle_time":180000,"flow_min_l4_payload_len":1350,"flow_max_l4_payload_len":1350,"flow_tot_l4_payload_len":1350,"flow_avg_l4_payload_len":1350,"midstream":0,"thread_ts_msec":1639054232898,"l3_proto":"ip4","src_ip":"245.161.134.177","dst_ip":"77.242.114.14","src_port":27636,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"QUIC.Snapchat","breed":"Fun","category":"SocialNetwork"}} +00568{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2,"source":"quic_crypto_aes_auth_size.pcap","alias":"nDPId-test","packets-captured":2,"packets-processed":2,"total-skipped-flows":0,"total-l4-data-len":2700,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":11,"global_ts_msec":1639054232898} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 2/2 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 2700 bytes +~~ total detected protocols..: 2 +~~ total active/idle flows...: 2/2 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5203775 bytes +~~ total memory freed........: 5203775 bytes +~~ total allocations/frees...: 113073/113073 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 481 chars +~~ json string max len.......: 2290 chars +~~ json string avg len.......: 1381 chars diff --git a/test/results/quic_frags_ch_in_multiple_packets.pcapng.out b/test/results/quic_frags_ch_in_multiple_packets.pcapng.out index 76688ba66..2f4da5134 100644 --- a/test/results/quic_frags_ch_in_multiple_packets.pcapng.out +++ b/test/results/quic_frags_ch_in_multiple_packets.pcapng.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4694664 bytes -~~ total memory freed........: 4694664 bytes -~~ total allocations/frees...: 101170/101170 +~~ total memory allocated....: 5202935 bytes +~~ total memory freed........: 5202935 bytes +~~ total allocations/frees...: 113070/113070 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 491 chars ~~ json string max len.......: 2186 chars diff --git a/test/results/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out b/test/results/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out index d1e4f86a9..e658f9af4 100644 --- a/test/results/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out +++ b/test/results/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out @@ -537,9 +537,9 @@ ~~ total active/idle flows...: 113/113 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 6231111 bytes -~~ total memory freed........: 6231111 bytes -~~ total allocations/frees...: 103576/103576 +~~ total memory allocated....: 7589207 bytes +~~ total memory freed........: 7589207 bytes +~~ total allocations/frees...: 117069/117069 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 506 chars ~~ json string max len.......: 2328 chars diff --git a/test/results/quic_interop_V.pcapng.out b/test/results/quic_interop_V.pcapng.out index 73ccf273e..196497347 100644 --- a/test/results/quic_interop_V.pcapng.out +++ b/test/results/quic_interop_V.pcapng.out @@ -406,9 +406,9 @@ ~~ total active/idle flows...: 77/77 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5096548 bytes -~~ total memory freed........: 5096548 bytes -~~ total allocations/frees...: 102373/102373 +~~ total memory allocated....: 5891585 bytes +~~ total memory freed........: 5891585 bytes +~~ total allocations/frees...: 114822/114822 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 472 chars ~~ json string max len.......: 2165 chars diff --git a/test/results/quic_q39.pcap.out b/test/results/quic_q39.pcap.out index bb2ac2c18..fd1d7de9f 100644 --- a/test/results/quic_q39.pcap.out +++ b/test/results/quic_q39.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681296 bytes -~~ total memory freed........: 4681296 bytes -~~ total allocations/frees...: 101204/101204 +~~ total memory allocated....: 5180203 bytes +~~ total memory freed........: 5180203 bytes +~~ total allocations/frees...: 113086/113086 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 2247 chars diff --git a/test/results/quic_q43.pcap.out b/test/results/quic_q43.pcap.out index 01fd50986..6381cb638 100644 --- a/test/results/quic_q43.pcap.out +++ b/test/results/quic_q43.pcap.out @@ -14,9 +14,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679568 bytes -~~ total memory freed........: 4679568 bytes -~~ total allocations/frees...: 101145/101145 +~~ total memory allocated....: 5178475 bytes +~~ total memory freed........: 5178475 bytes +~~ total allocations/frees...: 113027/113027 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 2247 chars diff --git a/test/results/quic_q46.pcap.out b/test/results/quic_q46.pcap.out index 52a423271..f8f32a98f 100644 --- a/test/results/quic_q46.pcap.out +++ b/test/results/quic_q46.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680134 bytes -~~ total memory freed........: 4680134 bytes -~~ total allocations/frees...: 101164/101164 +~~ total memory allocated....: 5179041 bytes +~~ total memory freed........: 5179041 bytes +~~ total allocations/frees...: 113046/113046 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 2262 chars diff --git a/test/results/quic_q46_b.pcap.out b/test/results/quic_q46_b.pcap.out index a91d669f9..d7253c43c 100644 --- a/test/results/quic_q46_b.pcap.out +++ b/test/results/quic_q46_b.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680136 bytes -~~ total memory freed........: 4680136 bytes -~~ total allocations/frees...: 101164/101164 +~~ total memory allocated....: 5179043 bytes +~~ total memory freed........: 5179043 bytes +~~ total allocations/frees...: 113046/113046 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 466 chars ~~ json string max len.......: 2343 chars diff --git a/test/results/quic_q50.pcap.out b/test/results/quic_q50.pcap.out index 368a2917b..d0096c010 100644 --- a/test/results/quic_q50.pcap.out +++ b/test/results/quic_q50.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685640 bytes -~~ total memory freed........: 4685640 bytes -~~ total allocations/frees...: 101174/101174 +~~ total memory allocated....: 5189358 bytes +~~ total memory freed........: 5189358 bytes +~~ total allocations/frees...: 113065/113065 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 2270 chars diff --git a/test/results/quic_t50.pcap.out b/test/results/quic_t50.pcap.out index 89c450ecb..87d167670 100644 --- a/test/results/quic_t50.pcap.out +++ b/test/results/quic_t50.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685427 bytes -~~ total memory freed........: 4685427 bytes -~~ total allocations/frees...: 101168/101168 +~~ total memory allocated....: 5189145 bytes +~~ total memory freed........: 5189145 bytes +~~ total allocations/frees...: 113059/113059 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 2279 chars diff --git a/test/results/quic_t51.pcap.out b/test/results/quic_t51.pcap.out index 31588428f..e75c49c06 100644 --- a/test/results/quic_t51.pcap.out +++ b/test/results/quic_t51.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4703700 bytes -~~ total memory freed........: 4703700 bytes -~~ total allocations/frees...: 101798/101798 +~~ total memory allocated....: 5207418 bytes +~~ total memory freed........: 5207418 bytes +~~ total allocations/frees...: 113689/113689 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 2272 chars diff --git a/test/results/quickplay.pcap.out b/test/results/quickplay.pcap.out index e14482d8d..09adfa9ab 100644 --- a/test/results/quickplay.pcap.out +++ b/test/results/quickplay.pcap.out @@ -127,9 +127,9 @@ ~~ total active/idle flows...: 21/21 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4706734 bytes -~~ total memory freed........: 4706734 bytes -~~ total allocations/frees...: 101414/101414 +~~ total memory allocated....: 5205641 bytes +~~ total memory freed........: 5205641 bytes +~~ total allocations/frees...: 113296/113296 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 2367 chars diff --git a/test/results/radius_false_positive.pcapng.out b/test/results/radius_false_positive.pcapng.out index dcbd23624..49ba0d0cc 100644 --- a/test/results/radius_false_positive.pcapng.out +++ b/test/results/radius_false_positive.pcapng.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679800 bytes -~~ total memory freed........: 4679800 bytes -~~ total allocations/frees...: 101153/101153 +~~ total memory allocated....: 5178707 bytes +~~ total memory freed........: 5178707 bytes +~~ total allocations/frees...: 113035/113035 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 479 chars ~~ json string max len.......: 2155 chars diff --git a/test/results/rdp.pcap.out b/test/results/rdp.pcap.out index 2aa2908cb..81a6393fe 100644 --- a/test/results/rdp.pcap.out +++ b/test/results/rdp.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4737800 bytes -~~ total memory freed........: 4737800 bytes -~~ total allocations/frees...: 103153/103153 +~~ total memory allocated....: 5236707 bytes +~~ total memory freed........: 5236707 bytes +~~ total allocations/frees...: 115035/115035 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 436 chars ~~ json string max len.......: 828 chars diff --git a/test/results/reasm_crash_anon.pcapng.out b/test/results/reasm_crash_anon.pcapng.out index 1e8366ed2..71f73cf75 100644 --- a/test/results/reasm_crash_anon.pcapng.out +++ b/test/results/reasm_crash_anon.pcapng.out @@ -35,9 +35,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4694369 bytes -~~ total memory freed........: 4694369 bytes -~~ total allocations/frees...: 101347/101347 +~~ total memory allocated....: 5193276 bytes +~~ total memory freed........: 5193276 bytes +~~ total allocations/frees...: 113229/113229 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 220 chars ~~ json string max len.......: 657 chars diff --git a/test/results/reasm_segv_anon.pcapng.out b/test/results/reasm_segv_anon.pcapng.out index 8fc5eecf6..f8f1fe865 100644 --- a/test/results/reasm_segv_anon.pcapng.out +++ b/test/results/reasm_segv_anon.pcapng.out @@ -71,9 +71,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681888 bytes -~~ total memory freed........: 4681888 bytes -~~ total allocations/frees...: 101225/101225 +~~ total memory allocated....: 5180795 bytes +~~ total memory freed........: 5180795 bytes +~~ total allocations/frees...: 113107/113107 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 244 chars ~~ json string max len.......: 703 chars diff --git a/test/results/reddit.pcap.out b/test/results/reddit.pcap.out index 676ad3783..c1b01894b 100644 --- a/test/results/reddit.pcap.out +++ b/test/results/reddit.pcap.out @@ -453,9 +453,9 @@ ~~ total active/idle flows...: 60/60 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5299296 bytes -~~ total memory freed........: 5299296 bytes -~~ total allocations/frees...: 113316/113316 +~~ total memory allocated....: 5798203 bytes +~~ total memory freed........: 5798203 bytes +~~ total allocations/frees...: 125198/125198 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 1464 chars diff --git a/test/results/rsync.pcap.out b/test/results/rsync.pcap.out new file mode 100644 index 000000000..93afac388 --- /dev/null +++ b/test/results/rsync.pcap.out @@ -0,0 +1,24 @@ +00456{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"rsync.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00542{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"rsync.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1387144174826} +00566{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"rsync.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1387144174826,"flow_last_seen":1387144174826,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1387144174826,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":54489,"dst_port":873,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00476{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"rsync.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1387144174826,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1387144174826,"pkt":"AAAAAAAAAAAAAAAACABFAAA8ACBAAEAGPJp\/AAABfwAAAdTZA2mzXXC1AAAAAKACqqr+MAAAAgT\/1wQCCAoAPHCVAAAAAAEDAwo="} +00476{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"rsync.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1387144174826,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1387144174826,"pkt":"AAAAAAAAAAAAAAAACABFAAA8AABAAEAGPLp\/AAABfwAAAQNp1NlRGhcWs11wtqASqqr+MAAAAgT\/1wQCCAoAPHCVADxwlQEDAwo="} +00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"rsync.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1387144174826,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1387144174826,"pkt":"AAAAAAAAAAAAAAAACABFAAA0ACFAAEAGPKF\/AAABfwAAAdTZA2mzXXC2URoXF4AQACv+KAAAAQEICgA8cJUAPHCV"} +00633{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":9,"source":"rsync.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":1387144174826,"flow_last_seen":1387144174828,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":14,"flow_tot_l4_payload_len":45,"flow_avg_l4_payload_len":5,"midstream":0,"thread_ts_msec":1387144174828,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":54489,"dst_port":873,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"RSYNC","breed":"Acceptable","category":"DataTransfer"}} +00676{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":30,"source":"rsync.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":30,"flow_first_seen":1387144174826,"flow_last_seen":1387144174967,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":346,"flow_tot_l4_payload_len":497,"flow_avg_l4_payload_len":16,"midstream":0,"thread_ts_msec":1387144174967,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":54489,"dst_port":873,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"RSYNC","breed":"Acceptable","category":"DataTransfer"}} +00549{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":30,"source":"rsync.pcap","alias":"nDPId-test","packets-captured":30,"packets-processed":30,"total-skipped-flows":0,"total-l4-data-len":497,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1387144174967} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 30/30 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 497 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5181335 bytes +~~ total memory freed........: 5181335 bytes +~~ total allocations/frees...: 113056/113056 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 461 chars +~~ json string max len.......: 681 chars +~~ json string avg len.......: 560 chars diff --git a/test/results/rtmp.pcap.out b/test/results/rtmp.pcap.out new file mode 100644 index 000000000..42ea332ca --- /dev/null +++ b/test/results/rtmp.pcap.out @@ -0,0 +1,24 @@ +00455{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"rtmp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00541{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"rtmp.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1196541506793} +00573{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"rtmp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1196541506793,"flow_last_seen":1196541506793,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1196541506793,"l3_proto":"ip4","src_ip":"192.168.43.1","dst_ip":"192.168.43.128","src_port":1177,"dst_port":1935,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00459{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"rtmp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1196541506793,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1196541506793,"pkt":"AAwpfMZqAFBWwAAICABFAAAwAzJAAIAGH8TAqCsBwKgrgASZB49J0s7PAAAAAHAC\/\/+GgwAAAgQFtAEBBAI="} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"rtmp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1196541506794,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1196541506794,"pkt":"AFBWwAAIAAwpfMZqCABFAAAwAABAAEAGYvbAqCuAwKgrAQePBJklcSWUSdLO0HASFtAknQAAAgQFtAEBBAI="} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"rtmp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1196541506794,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":1196541506794,"pkt":"AAwpfMZqAFBWwAAICABFAAAoAzNAAIAGH8vAqCsBwKgrgASZB49J0s7QJXEllVAQ\/\/9oMQAA"} +00638{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"rtmp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":1196541506793,"flow_last_seen":1196541507028,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":2797,"flow_avg_l4_payload_len":349,"midstream":0,"thread_ts_msec":1196541507028,"l3_proto":"ip4","src_ip":"192.168.43.1","dst_ip":"192.168.43.128","src_port":1177,"dst_port":1935,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"RTMP","breed":"Acceptable","category":"Media"}} +00679{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":26,"source":"rtmp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":26,"flow_first_seen":1196541506793,"flow_last_seen":1196541507836,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":6948,"flow_avg_l4_payload_len":267,"midstream":0,"thread_ts_msec":1196541507836,"l3_proto":"ip4","src_ip":"192.168.43.1","dst_ip":"192.168.43.128","src_port":1177,"dst_port":1935,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"RTMP","breed":"Acceptable","category":"Media"}} +00549{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":26,"source":"rtmp.pcap","alias":"nDPId-test","packets-captured":26,"packets-processed":26,"total-skipped-flows":0,"total-l4-data-len":6948,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1196541507836} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 26/26 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 6948 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5181219 bytes +~~ total memory freed........: 5181219 bytes +~~ total allocations/frees...: 113052/113052 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 452 chars +~~ json string max len.......: 684 chars +~~ json string avg len.......: 557 chars diff --git a/test/results/rtsp.pcap.out b/test/results/rtsp.pcap.out index 1239d7d28..6bef8629f 100644 --- a/test/results/rtsp.pcap.out +++ b/test/results/rtsp.pcap.out @@ -51,9 +51,9 @@ ~~ total active/idle flows...: 7/7 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4715602 bytes -~~ total memory freed........: 4715602 bytes -~~ total allocations/frees...: 101737/101737 +~~ total memory allocated....: 5214509 bytes +~~ total memory freed........: 5214509 bytes +~~ total allocations/frees...: 113619/113619 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 460 chars ~~ json string max len.......: 812 chars diff --git a/test/results/rtsp_setup_http.pcapng.out b/test/results/rtsp_setup_http.pcapng.out index 8323ccb94..3ae79a4ea 100644 --- a/test/results/rtsp_setup_http.pcapng.out +++ b/test/results/rtsp_setup_http.pcapng.out @@ -13,9 +13,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681639 bytes -~~ total memory freed........: 4681639 bytes -~~ total allocations/frees...: 101146/101146 +~~ total memory allocated....: 5180546 bytes +~~ total memory freed........: 5180546 bytes +~~ total allocations/frees...: 113028/113028 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 473 chars ~~ json string max len.......: 826 chars diff --git a/test/results/rx.pcap.out b/test/results/rx.pcap.out index 541145514..9eae1ff1c 100644 --- a/test/results/rx.pcap.out +++ b/test/results/rx.pcap.out @@ -39,9 +39,9 @@ ~~ total active/idle flows...: 5/5 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4686826 bytes -~~ total memory freed........: 4686826 bytes -~~ total allocations/frees...: 101287/101287 +~~ total memory allocated....: 5185733 bytes +~~ total memory freed........: 5185733 bytes +~~ total allocations/frees...: 113169/113169 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 458 chars ~~ json string max len.......: 1899 chars diff --git a/test/results/s7comm.pcap.out b/test/results/s7comm.pcap.out index e8c30f7c5..c6183eb0e 100644 --- a/test/results/s7comm.pcap.out +++ b/test/results/s7comm.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681105 bytes -~~ total memory freed........: 4681105 bytes -~~ total allocations/frees...: 101198/101198 +~~ total memory allocated....: 5180012 bytes +~~ total memory freed........: 5180012 bytes +~~ total allocations/frees...: 113080/113080 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 685 chars diff --git a/test/results/safari.pcap.out b/test/results/safari.pcap.out index 5f2978471..db2b6e195 100644 --- a/test/results/safari.pcap.out +++ b/test/results/safari.pcap.out @@ -60,9 +60,9 @@ ~~ total active/idle flows...: 7/7 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4886265 bytes -~~ total memory freed........: 4886265 bytes -~~ total allocations/frees...: 107199/107199 +~~ total memory allocated....: 5385172 bytes +~~ total memory freed........: 5385172 bytes +~~ total allocations/frees...: 119081/119081 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 1220 chars diff --git a/test/results/salesforce.pcap.out b/test/results/salesforce.pcap.out index cbffe2302..60e687ace 100644 --- a/test/results/salesforce.pcap.out +++ b/test/results/salesforce.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4688376 bytes -~~ total memory freed........: 4688376 bytes -~~ total allocations/frees...: 101166/101166 +~~ total memory allocated....: 5187283 bytes +~~ total memory freed........: 5187283 bytes +~~ total allocations/frees...: 113048/113048 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 466 chars ~~ json string max len.......: 1259 chars diff --git a/test/results/sccp_hw_conf_register.pcapng.out b/test/results/sccp_hw_conf_register.pcapng.out new file mode 100644 index 000000000..b031e8517 --- /dev/null +++ b/test/results/sccp_hw_conf_register.pcapng.out @@ -0,0 +1,24 @@ +00474{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"sccp_hw_conf_register.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00560{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"sccp_hw_conf_register.pcapng","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1557178511664} +00593{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"sccp_hw_conf_register.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1557178511664,"flow_last_seen":1557178511664,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1557178511664,"l3_proto":"ip4","src_ip":"10.180.110.58","dst_ip":"10.180.110.48","src_port":46461,"dst_port":2000,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00472{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"sccp_hw_conf_register.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1557178511664,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":1557178511664,"pkt":"AFBW6tqSuDhhiHXECABFYAAsOMQAAP8GkNUKtG46CrRuMLV9B9BgU38BAAAAAGACECD5kQAAAgQFtA=="} +00473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"sccp_hw_conf_register.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1557178511664,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":1557178511664,"pkt":"uDhhiHXEAFBW6tqSCABFAAAsAABAAEAGSPoKtG4wCrRuOgfQtX0KPck5YFN\/AmASchDEGQAAAgQFtA=="} +00464{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"sccp_hw_conf_register.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1557178511664,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_msec":1557178511664,"pkt":"AFBW6tqSuDhhiHXECABFYAAoOMUAAP8GkNgKtG46CrRuMLV9B9BgU38CCj3JOlAQECA9xwAA"} +00663{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":15,"source":"sccp_hw_conf_register.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":15,"flow_first_seen":1557178511664,"flow_last_seen":1557178511707,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":316,"flow_tot_l4_payload_len":568,"flow_avg_l4_payload_len":37,"midstream":0,"thread_ts_msec":1557178511707,"l3_proto":"ip4","src_ip":"10.180.110.58","dst_ip":"10.180.110.48","src_port":46461,"dst_port":2000,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"CiscoSkinny","breed":"Acceptable","category":"VoIP"}} +00702{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17,"source":"sccp_hw_conf_register.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":17,"flow_first_seen":1557178511664,"flow_last_seen":1557178511908,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":316,"flow_tot_l4_payload_len":596,"flow_avg_l4_payload_len":35,"midstream":0,"thread_ts_msec":1557178511908,"l3_proto":"ip4","src_ip":"10.180.110.58","dst_ip":"10.180.110.48","src_port":46461,"dst_port":2000,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"CiscoSkinny","breed":"Acceptable","category":"VoIP"}} +00567{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":17,"source":"sccp_hw_conf_register.pcapng","alias":"nDPId-test","packets-captured":17,"packets-processed":17,"total-skipped-flows":0,"total-l4-data-len":596,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1557178511908} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 17/17 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 596 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5180958 bytes +~~ total memory freed........: 5180958 bytes +~~ total allocations/frees...: 113043/113043 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 469 chars +~~ json string max len.......: 707 chars +~~ json string avg len.......: 577 chars diff --git a/test/results/sctp.cap.out b/test/results/sctp.cap.out new file mode 100644 index 000000000..37e0503b4 --- /dev/null +++ b/test/results/sctp.cap.out @@ -0,0 +1,28 @@ +00454{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"sctp.cap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00540{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"sctp.cap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1088696689784} +00539{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"sctp.cap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1088696689784,"flow_last_seen":1088696689784,"flow_idle_time":600000,"flow_min_l4_payload_len":104,"flow_max_l4_payload_len":104,"flow_tot_l4_payload_len":104,"flow_avg_l4_payload_len":104,"midstream":0,"thread_ts_msec":1088696689784,"l3_proto":"ip4","src_ip":"10.28.6.43","dst_ip":"10.28.6.44","l4_proto":132,"flow_datalink":1,"flow_max_packets":3} +00558{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"sctp.cap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1088696689784,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"thread_ts_msec":1088696689784,"pkt":"AKCAAF5GCAADSgA1CABFAAB8FBwAADuESlQKHAYrChwGLEAAC4AAAW8KbbAYggADAFsoAkNFAACgvQAAAAdNRUdBQ08vMiA8bWctdHI+OjE2Mzg0ClJlcGx5ID0gMTc0MDkxewpDb250ZXh0ID0gMjU1ewpNb2RpZnkgPSBNVVgvMjU1Cn0KfQpn"} +00598{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"sctp.cap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1088696689784,"flow_last_seen":1088696689784,"flow_idle_time":600000,"flow_min_l4_payload_len":104,"flow_max_l4_payload_len":104,"flow_tot_l4_payload_len":104,"flow_avg_l4_payload_len":104,"midstream":0,"thread_ts_msec":1088696689784,"l3_proto":"ip4","src_ip":"10.28.6.43","dst_ip":"10.28.6.44","l4_proto":132,"ndpi": {"confidence": {"4":"DPI"},"proto":"SCTP","breed":"Acceptable","category":"Network"}} +00456{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"sctp.cap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1088696689784,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1088696689784,"pkt":"CAADSgA1AKCAAF5GCABFAAAwCdlAAP+EUOIKHAYsChwGKwuAQAAhRBUjK\/ICTgMAABAoAkNFAAAgAAAAAAA="} +00535{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"sctp.cap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1088696689872,"flow_last_seen":1088696689872,"flow_idle_time":600000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":1088696689872,"l3_proto":"ip4","src_ip":"10.28.6.42","dst_ip":"10.28.6.44","l4_proto":132,"flow_datalink":1,"flow_max_packets":3} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"sctp.cap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1088696689872,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":1088696689872,"pkt":"AKCAAF5GAAGvDAaWCABFAAA4ykAAAECEj3QKHAYqChwGLAtZC1kAAA5QU8MFXwQAABgAAQAUQORLkgocBiwbZq9+AAAAAA=="} +00594{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"sctp.cap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1088696689872,"flow_last_seen":1088696689872,"flow_idle_time":600000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":1088696689872,"l3_proto":"ip4","src_ip":"10.28.6.42","dst_ip":"10.28.6.44","l4_proto":132,"ndpi": {"confidence": {"4":"DPI"},"proto":"SCTP","breed":"Acceptable","category":"Network"}} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"sctp.cap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1088696689872,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"thread_ts_msec":1088696689872,"pkt":"AAGvDAaWAKCAAF5GCABFAAA4u4FAAP+EnzIKHAYsChwGKgtZC1kNU+b+jI4HRgUAABgAAQAUQORLkgocBiwbZq9+AAAAAA=="} +00633{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4,"source":"sctp.cap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1088696689872,"flow_last_seen":1088696689872,"flow_idle_time":600000,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":36,"midstream":0,"thread_ts_msec":1088696689872,"l3_proto":"ip4","src_ip":"10.28.6.42","dst_ip":"10.28.6.44","l4_proto":132,"flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SCTP","breed":"Acceptable","category":"Network"}} +00635{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4,"source":"sctp.cap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1088696689784,"flow_last_seen":1088696689784,"flow_idle_time":600000,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":104,"flow_tot_l4_payload_len":132,"flow_avg_l4_payload_len":66,"midstream":0,"thread_ts_msec":1088696689872,"l3_proto":"ip4","src_ip":"10.28.6.43","dst_ip":"10.28.6.44","l4_proto":132,"flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SCTP","breed":"Acceptable","category":"Network"}} +00545{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":4,"source":"sctp.cap","alias":"nDPId-test","packets-captured":4,"packets-processed":4,"total-skipped-flows":0,"total-l4-data-len":204,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":13,"global_ts_msec":1088696689872} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 4/4 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 204 bytes +~~ total detected protocols..: 2 +~~ total active/idle flows...: 2/2 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5179405 bytes +~~ total memory freed........: 5179405 bytes +~~ total allocations/frees...: 113032/113032 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 459 chars +~~ json string max len.......: 640 chars +~~ json string avg len.......: 546 chars diff --git a/test/results/selfsigned.pcap.out b/test/results/selfsigned.pcap.out index 38855f1af..f883b154b 100644 --- a/test/results/selfsigned.pcap.out +++ b/test/results/selfsigned.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4690422 bytes -~~ total memory freed........: 4690422 bytes -~~ total allocations/frees...: 101169/101169 +~~ total memory allocated....: 5189329 bytes +~~ total memory freed........: 5189329 bytes +~~ total allocations/frees...: 113051/113051 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 1423 chars diff --git a/test/results/sflow.pcap.out b/test/results/sflow.pcap.out new file mode 100644 index 000000000..fbc99bb39 --- /dev/null +++ b/test/results/sflow.pcap.out @@ -0,0 +1,24 @@ +00456{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"sflow.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00542{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"sflow.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1378125488790} +00580{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"sflow.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1378125488790,"flow_last_seen":1378125488790,"flow_idle_time":180000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":0,"thread_ts_msec":1378125488790,"l3_proto":"ip4","src_ip":"172.21.35.17","dst_ip":"172.21.35.199","src_port":1027,"dst_port":6343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00624{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"sflow.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1378125488790,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":186,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":186,"pkt_l4_len":152,"thread_ts_msec":1378125488790,"pkt":"AFBWlgDZAOCxz5TDCABFAACsIfoAAEARuUSsFSMRrBUjxwQDGMcAmAAAAAAABQAAAAGsFSMRAAAAAQAAAZ9nPdcQAAAAAQAAAAIAAABsAAAhJQAABAwAAAABAAAAAQAAAFgAAAQMAAAABgAAAAAF9eEAAAAAAQAAAAMAAAAAAYwszAAAm4MAApAWAAH2cwAAAAAAAAAAAAAAAAAAAAAAUz3BAACgtwAAIYcAAAjXAAAAAAAAAAAAAAAA"} +00640{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"sflow.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1378125488790,"flow_last_seen":1378125488790,"flow_idle_time":180000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":144,"flow_tot_l4_payload_len":144,"flow_avg_l4_payload_len":144,"midstream":0,"thread_ts_msec":1378125488790,"l3_proto":"ip4","src_ip":"172.21.35.17","dst_ip":"172.21.35.199","src_port":1027,"dst_port":6343,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"sFlow","breed":"Acceptable","category":"Network"}} +00624{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"sflow.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1378125507793,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":186,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":186,"pkt_l4_len":152,"thread_ts_msec":1378125507793,"pkt":"AFBWlgDZAOCxz5TDCABFAACsIfsAAEARuUOsFSMRrBUjxwQDGMcAmAAAAAAABQAAAAGsFSMRAAAAAQAAAaBnPiFIAAAAAQAAAAIAAABsAAAAaAAABBMAAAABAAAAAQAAAFgAAAQTAAAABgAAAAAF9eEAAAAAAQAAAAMAAAAAAwmHZAAAPY8ACrt0AAAffQAAAAAAAAAAAAAAAAAAAAAGHWdKAABT9wAJE0IACVxYAAAAAAAAAAAAAAAA"} +00624{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"sflow.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1378125518792,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":186,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":186,"pkt_l4_len":152,"thread_ts_msec":1378125518792,"pkt":"AFBWlgDZAOCxz5TDCABFAACsIfwAAEARuUKsFSMRrBUjxwQDGMcAmAAAAAAABQAAAAGsFSMRAAAAAQAAAaFnPkxAAAAAAQAAAAIAAABsAAAhJgAABAwAAAABAAAAAQAAAFgAAAQMAAAABgAAAAAF9eEAAAAAAQAAAAMAAAAAAYw+XwAAm4gAApAuAAH2kQAAAAAAAAAAAAAAAAAAAAAAU0E5AACgvgAAIYgAAAjXAAAAAAAAAAAAAAAA"} +00680{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9,"source":"sflow.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":1378125488790,"flow_last_seen":1378125597799,"flow_idle_time":180000,"flow_min_l4_payload_len":144,"flow_max_l4_payload_len":172,"flow_tot_l4_payload_len":1324,"flow_avg_l4_payload_len":147,"midstream":0,"thread_ts_msec":1378125597799,"l3_proto":"ip4","src_ip":"172.21.35.17","dst_ip":"172.21.35.199","src_port":1027,"dst_port":6343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"sFlow","breed":"Acceptable","category":"Network"}} +00547{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":9,"source":"sflow.pcap","alias":"nDPId-test","packets-captured":9,"packets-processed":9,"total-skipped-flows":0,"total-l4-data-len":1324,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1378125597799} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 9/9 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 1324 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5178678 bytes +~~ total memory freed........: 5178678 bytes +~~ total allocations/frees...: 113034/113034 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 461 chars +~~ json string max len.......: 685 chars +~~ json string avg len.......: 566 chars diff --git a/test/results/signal.pcap.out b/test/results/signal.pcap.out index bd3171294..5dcc9eb24 100644 --- a/test/results/signal.pcap.out +++ b/test/results/signal.pcap.out @@ -143,9 +143,9 @@ ~~ total active/idle flows...: 19/19 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4771339 bytes -~~ total memory freed........: 4771339 bytes -~~ total allocations/frees...: 101918/101918 +~~ total memory allocated....: 5270246 bytes +~~ total memory freed........: 5270246 bytes +~~ total allocations/frees...: 113800/113800 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 1427 chars diff --git a/test/results/simple-dnscrypt.pcap.out b/test/results/simple-dnscrypt.pcap.out index 3dc7cd3bf..224d5e779 100644 --- a/test/results/simple-dnscrypt.pcap.out +++ b/test/results/simple-dnscrypt.pcap.out @@ -41,9 +41,9 @@ ~~ total active/idle flows...: 4/4 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4774793 bytes -~~ total memory freed........: 4774793 bytes -~~ total allocations/frees...: 101305/101305 +~~ total memory allocated....: 5273700 bytes +~~ total memory freed........: 5273700 bytes +~~ total allocations/frees...: 113187/113187 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 1269 chars diff --git a/test/results/sip.pcap.out b/test/results/sip.pcap.out index 615ddbe28..fd7c3b915 100644 --- a/test/results/sip.pcap.out +++ b/test/results/sip.pcap.out @@ -40,9 +40,9 @@ ~~ total active/idle flows...: 4/4 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685374 bytes -~~ total memory freed........: 4685374 bytes -~~ total allocations/frees...: 101264/101264 +~~ total memory allocated....: 5184281 bytes +~~ total memory freed........: 5184281 bytes +~~ total allocations/frees...: 113146/113146 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 459 chars ~~ json string max len.......: 1532 chars diff --git a/test/results/sites.pcapng.out b/test/results/sites.pcapng.out new file mode 100644 index 000000000..b01945045 --- /dev/null +++ b/test/results/sites.pcapng.out @@ -0,0 +1,353 @@ +00458{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"sites.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00544{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"sites.pcapng","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1595957694169} +00577{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"sites.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1595957694169,"flow_last_seen":1595957694169,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1595957694169,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"69.171.250.20","src_port":46160,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00479{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"sites.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1595957694169,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1595957694169,"pkt":"CL6sCxdumt9Y+uvcCABFAAA86wlAAEAGQqHAqAypRav6FLRQAbvxSUO4AAAAAKAC\/\/943AAAAgQFtAQCCAp3CF\/6AAAAAAEDAwk="} +00477{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"sites.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1595957694175,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1595957694175,"pkt":"mt9Y+uvcCL6sCxduCABFAAA8AABAAFUGGKtFq\/oUwKgMqQG7tFDMBUIi8UlDuaASbHAk8gAAAgQFeAQCCAqwcikLdwhf+gEDAwg="} +00980{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"sites.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1595957694181,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":447,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":447,"pkt_l4_len":413,"thread_ts_msec":1595957694181,"pkt":"CL6sCxdumt9Y+uvcCABFAAGx6wtAAEAGQSrAqAypRav6FLRQAbvxSUO5zAVCI4AYAKzC2gAAAQEICncIYAWwcikLFgMBAXgBAAF0AwMbz\/EVbbBeXTFd91pcxBNP5UcnCfq3Wnx+FKK431A8vCCYle6z8aZolVAW\/WsVOAFFqAocCpVZly96\/6VmRt6unAAGEwETAhMDAQABJQArAAUEAwT7GgAKAAYABAAdABcAMwAmACQAHQAgzM0Khe3cuLbHFAoUoUQ75VluiC+bl0wBHYa7GiFLSWoADQAGAAQEAwgEAAAAGwAZAAAWZWRnZS1tcXR0LmZhY2Vib29rLmNvbQAQAAsACQJoMgVoMi1mYgAtAAMCAQAAKgAAACkAoQB8AHb7PHlIDGTq5r6EmcaA47DeHw9k60TmJpJ4kMbWc07CmAAAAACvwY+4+cqVZO3LiyMH\/OBKqYTgxknPoune8SSx08gYUQ5v8dX54IHzjPiACk0t5hhgO+DjiFkUqTNKryO5SnHrNvAKz6QqOMdma4t912EvXAHgfFvQwwAhIFgFM36LO5BemV+W466ubu2dweNDP\/fyvoT9kq0FWNy9"} +00905{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"sites.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1595957694169,"flow_last_seen":1595957694181,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":381,"flow_tot_l4_payload_len":381,"flow_avg_l4_payload_len":127,"midstream":0,"thread_ts_msec":1595957694181,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"69.171.250.20","src_port":46160,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Messenger","breed":"Acceptable","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"edge-mqtt.facebook.com","ja3":"44dab16d680ef93487bc16ad23b3ffb1","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,h2-fb","tls_supported_versions":"TLSv1.3,TLSv1.3 (Fizz)"}} +00951{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":4,"source":"sites.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1595957694169,"flow_last_seen":1595957694188,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":381,"flow_tot_l4_payload_len":597,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":1595957694188,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"69.171.250.20","src_port":46160,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Messenger","breed":"Acceptable","category":"Chat"},"tls": {"version":"TLSv1.3 (Fizz)","client_requested_server_name":"edge-mqtt.facebook.com","ja3":"44dab16d680ef93487bc16ad23b3ffb1","ja3s":"fcb2d4d0991292272fcb1e464eedfd43","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,h2-fb","tls_supported_versions":"TLSv1.3,TLSv1.3 (Fizz)"}} +00546{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":5,"source":"sites.pcapng","alias":"nDPId-test","packets-captured":5,"packets-processed":4,"total-skipped-flows":0,"total-l4-data-len":597,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":1,"total-updates":0,"current-active-flows":1,"total-active-flows":1,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1623221441867} +00575{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5,"source":"sites.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1623221441867,"flow_last_seen":1623221441867,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1623221441867,"l3_proto":"ip4","src_ip":"192.168.1.250","dst_ip":"92.122.95.99","src_port":41878,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00478{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"sites.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1623221441867,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1623221441867,"pkt":"pJGxgjQ5AoEfHBPlCABFAAA8opRAAEAGGajAqAH6XHpfY6OWAbs7TQBaAAAAAKAC\/\/9coQAAAgQFtAQCCAqqdeFuAAAAAAEDAwk="} +00477{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"sites.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1623221441879,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1623221441879,"pkt":"AoEfHBPlpJGxgjQ5CABFAAA8AABAADgGxDxcel9jwKgB+gG7o5aALohKO00AW6AS\/ojeuQAAAgQFtAQCCAoeqlgsqnXhbgEDAwc="} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"sites.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1623221441880,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1623221441880,"pkt":"pJGxgjQ5AoEfHBPlCABFAAA0opVAAEAGGa\/AqAH6XHpfY6OWAbs7TQBbgC6IS4AQAKwLVQAAAQEICqp14Xweqlgs"} +00916{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"sites.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1623221441867,"flow_last_seen":1623221441893,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"thread_ts_msec":1623221441893,"l3_proto":"ip4","src_ip":"192.168.1.250","dst_ip":"92.122.95.99","src_port":41878,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.TikTok","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"vcs-va.tiktokv.com","ja3":"66918128f1b9b03303d77c6f2eefd128","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} +00958{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":10,"source":"sites.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1623221441867,"flow_last_seen":1623221441911,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":1623221441911,"l3_proto":"ip4","src_ip":"192.168.1.250","dst_ip":"92.122.95.99","src_port":41878,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.TikTok","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.3","client_requested_server_name":"vcs-va.tiktokv.com","ja3":"66918128f1b9b03303d77c6f2eefd128","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} +00688{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":31,"source":"sites.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1595957694169,"flow_last_seen":1595957694188,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":381,"flow_tot_l4_payload_len":597,"flow_avg_l4_payload_len":149,"midstream":0,"thread_ts_msec":1623221442073,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"69.171.250.20","src_port":46160,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Messenger","breed":"Acceptable","category":"Chat"}} +00551{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":36,"source":"sites.pcapng","alias":"nDPId-test","packets-captured":36,"packets-processed":35,"total-skipped-flows":0,"total-l4-data-len":9095,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":2,"total-updates":0,"current-active-flows":1,"total-active-flows":2,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":17,"global_ts_msec":1623222051753} +00576{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":36,"source":"sites.pcapng","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1623222051753,"flow_last_seen":1623222051753,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1623222051753,"l3_proto":"ip4","src_ip":"192.168.1.227","dst_ip":"52.73.71.226","src_port":50071,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":36,"source":"sites.pcapng","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":1623222051753,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1623222051753,"pkt":"pJGxgjQ56CrqthSFCABFAAA0YDdAAIAGW9bAqAHjNElH4sOXAbv6yL58AAAAAIAC+vC20AAAAgQFtAEDAwgBAQQC"} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":37,"source":"sites.pcapng","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":1623222051852,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1623222051852,"pkt":"6CrqthSFpJGxgjQ5CABFAAA0AABAAOkGUw00SUfiwKgB4wG7w5czz+y6+si+fYASaQMoIwAAAgQFtAEBBAIBAwMI"} +00458{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":38,"source":"sites.pcapng","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_last_seen":1623222051853,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_msec":1623222051853,"pkt":"pJGxgjQ56CrqthSFCABFAAAoYDhAAIAGW+HAqAHjNElH4sOXAbv6yL59M8\/su1AQAgHP+AAAAAAAAAAA"} +00912{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":39,"source":"sites.pcapng","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1623222051753,"flow_last_seen":1623222051854,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"thread_ts_msec":1623222051854,"l3_proto":"ip4","src_ip":"192.168.1.227","dst_ip":"52.73.71.226","src_port":50071,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Fuze","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"presence.fuze.com","ja3":"b32309a26951912be7dba376398abc3b","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} +00968{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":41,"source":"sites.pcapng","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1623222051753,"flow_last_seen":1623222051957,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":1977,"flow_avg_l4_payload_len":329,"midstream":0,"thread_ts_msec":1623222051957,"l3_proto":"ip4","src_ip":"192.168.1.227","dst_ip":"52.73.71.226","src_port":50071,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Fuze","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"presence.fuze.com","ja3":"b32309a26951912be7dba376398abc3b","ja3s":"8d2a028aa94425f76ced7826b1f39039","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} +01192{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":44,"source":"sites.pcapng","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":9,"flow_first_seen":1623222051753,"flow_last_seen":1623222051957,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":5798,"flow_avg_l4_payload_len":644,"midstream":0,"thread_ts_msec":1623222051957,"l3_proto":"ip4","src_ip":"192.168.1.227","dst_ip":"52.73.71.226","src_port":50071,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Fuze","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"presence.fuze.com","server_names":"*.presence.fuze.com,presence.fuze.com","ja3":"b32309a26951912be7dba376398abc3b","ja3s":"8d2a028aa94425f76ced7826b1f39039","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=Amazon, OU=Server CA 1B, CN=Amazon","subjectDN":"CN=*.presence.fuze.com","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1","fingerprint":"B4:E1:85:91:CD:36:0A:89:7B:6F:A0:C1:11:B5:A5:29:CE:05:13:79"}} +00687{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":60,"source":"sites.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":31,"flow_first_seen":1623221441867,"flow_last_seen":1623221458497,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":8498,"flow_avg_l4_payload_len":274,"midstream":0,"thread_ts_msec":1623222052202,"l3_proto":"ip4","src_ip":"192.168.1.250","dst_ip":"92.122.95.99","src_port":41878,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.TikTok","breed":"Fun","category":"SocialNetwork"}} +00552{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":67,"source":"sites.pcapng","alias":"nDPId-test","packets-captured":67,"packets-processed":66,"total-skipped-flows":0,"total-l4-data-len":17875,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":3,"total-detection-updates":4,"total-updates":0,"current-active-flows":1,"total-active-flows":3,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":26,"global_ts_msec":1623223595952} +00578{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":67,"source":"sites.pcapng","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1623223595952,"flow_last_seen":1623223595952,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1623223595952,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"91.198.174.208","src_port":50620,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00478{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":67,"source":"sites.pcapng","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_last_seen":1623223595952,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1623223595952,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8ZBhAAEAGCeXAqAGAW8au0MW8AbvaIBcHAAAAAKAC+vC78AAAAgQFtAQCCAq86k7VAAAAAAEDAwc="} +00478{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":68,"source":"sites.pcapng","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_last_seen":1623223595999,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1623223595999,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADEGfP1bxq7QwKgBgAG7xbxrNtsg2iAXCKASqbDzDgAAAgQFnAQCCAoXn7wwvOpO1QEDAwk="} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":69,"source":"sites.pcapng","alias":"nDPId-test","flow_id":4,"flow_packet_id":3,"flow_last_seen":1623223596002,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1623223596002,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA0ZBlAAEAGCezAqAGAW8au0MW8AbvaIBcIazbbIYAQAfbJTQAAAQEICrzqTwcXn7ww"} +00894{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":70,"source":"sites.pcapng","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1623223595952,"flow_last_seen":1623223596004,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"thread_ts_msec":1623223596004,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"91.198.174.208","src_port":50620,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Wikipedia","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"upload.wikimedia.org","ja3":"6b5e0cfe988c723ee71faf54f8460684","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00935{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":72,"source":"sites.pcapng","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1623223595952,"flow_last_seen":1623223596052,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":1623223596052,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"91.198.174.208","src_port":50620,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Wikipedia","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"upload.wikimedia.org","ja3":"6b5e0cfe988c723ee71faf54f8460684","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00684{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":107,"source":"sites.pcapng","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":31,"flow_first_seen":1623222051753,"flow_last_seen":1623222112185,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":8780,"flow_avg_l4_payload_len":283,"midstream":0,"thread_ts_msec":1623223596203,"l3_proto":"ip4","src_ip":"192.168.1.227","dst_ip":"52.73.71.226","src_port":50071,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Fuze","breed":"Acceptable","category":"VoIP"}} +00555{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":119,"source":"sites.pcapng","alias":"nDPId-test","packets-captured":119,"packets-processed":118,"total-skipped-flows":0,"total-l4-data-len":35609,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":4,"total-detection-updates":5,"total-updates":0,"current-active-flows":1,"total-active-flows":4,"total-idle-flows":3,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":34,"global_ts_msec":1623226283573} +00576{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":119,"source":"sites.pcapng","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1623226283573,"flow_last_seen":1623226283573,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1623226283573,"l3_proto":"ip4","src_ip":"192.168.1.250","dst_ip":"45.82.241.51","src_port":39890,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":119,"source":"sites.pcapng","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_last_seen":1623226283573,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1623226283573,"pkt":"pJGxgjQ5AoEfHBPlCABFAAA8M5RAAEAGJgDAqAH6LVLxM5vSAFAXgCu+AAAAAKAC\/\/9tawAAAgQFtAQCCAolvfRMAAAAAAEDAwk="} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":120,"source":"sites.pcapng","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_last_seen":1623226283601,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1623226283601,"pkt":"AoEfHBPlpJGxgjQ5CABFAAA0AABAADMGZpwtUvEzwKgB+gBQm9LNImc9F4Arv4ASchAIQAAAAgQFeAEBBAIBAwMK"} +00459{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":121,"source":"sites.pcapng","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_last_seen":1623226283602,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_msec":1623226283602,"pkt":"pJGxgjQ5AoEfHBPlCABFAAAoM5VAAEAGJhPAqAH6LVLxM5vSAFAXgCu\/zSJnPlAQAKy6PQAAAAAAAAAA"} +00823{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":122,"source":"sites.pcapng","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1623226283573,"flow_last_seen":1623226283612,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":190,"flow_tot_l4_payload_len":190,"flow_avg_l4_payload_len":47,"midstream":0,"thread_ts_msec":1623226283612,"l3_proto":"ip4","src_ip":"192.168.1.250","dst_ip":"45.82.241.51","src_port":39890,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.Likee","breed":"Fun","category":"SocialNetwork"},"http": {"hostname":"videosnap.like.video","url":"videosnap.like.video\/eu_live\/5uz\/1YOmxT.webp?type=8&resize=1&dw=360","code":0,"content_type":"","user_agent":"Like-Android"}} +00685{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":229,"source":"sites.pcapng","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":52,"flow_first_seen":1623223595952,"flow_last_seen":1623223766553,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":17734,"flow_avg_l4_payload_len":341,"midstream":0,"thread_ts_msec":1623226286427,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"91.198.174.208","src_port":50620,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Wikipedia","breed":"Safe","category":"Web"}} +00556{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":231,"source":"sites.pcapng","alias":"nDPId-test","packets-captured":231,"packets-processed":230,"total-skipped-flows":0,"total-l4-data-len":108050,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":5,"total-detection-updates":5,"total-updates":0,"current-active-flows":1,"total-active-flows":5,"total-idle-flows":4,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":41,"global_ts_msec":1631088115362} +00579{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":231,"source":"sites.pcapng","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1631088115362,"flow_last_seen":1631088115362,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1631088115362,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"199.232.82.109","src_port":46724,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00479{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":231,"source":"sites.pcapng","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_last_seen":1631088115362,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1631088115362,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8aylAAEAG8xTAqAGAx+hSbbaEAbsR7WhdAAAAAKAC+vCzrwAAAgQFtAQCCAqzLdcpAAAAAAEDAwc="} +00483{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":232,"source":"sites.pcapng","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_last_seen":1631088115376,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1631088115376,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADQGaj7H6FJtwKgBgAG7toQ\/rdv6Ee1oXqAS\/\/\/HZwAAAgQFTAQCCApg6mr7sy3XKQEDAwk="} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":233,"source":"sites.pcapng","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_last_seen":1631088115376,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1631088115376,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA0aypAAEAG8xvAqAGAx+hSbbaEAbsR7WheP63b+4AQAfbzyQAAAQEICrMt1zdg6mr7"} +00911{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":234,"source":"sites.pcapng","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1631088115362,"flow_last_seen":1631088115376,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"thread_ts_msec":1631088115376,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"199.232.82.109","src_port":46724,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Vimeo","breed":"Fun","category":"Streaming"},"tls": {"version":"TLSv1.2","client_requested_server_name":"f.vimeocdn.com","ja3":"cd08e31494f9531f560d64c695473da9","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} +00967{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":236,"source":"sites.pcapng","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1631088115362,"flow_last_seen":1631088115392,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1344,"flow_tot_l4_payload_len":1861,"flow_avg_l4_payload_len":310,"midstream":0,"thread_ts_msec":1631088115392,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"199.232.82.109","src_port":46724,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Vimeo","breed":"Fun","category":"Streaming"},"tls": {"version":"TLSv1.2","client_requested_server_name":"f.vimeocdn.com","ja3":"cd08e31494f9531f560d64c695473da9","ja3s":"16c0b3e6a7b8173c16d944cfeaeee9cf","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} +01185{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":240,"source":"sites.pcapng","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":10,"flow_first_seen":1631088115362,"flow_last_seen":1631088115392,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1344,"flow_tot_l4_payload_len":4549,"flow_avg_l4_payload_len":454,"midstream":0,"thread_ts_msec":1631088115392,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"199.232.82.109","src_port":46724,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Vimeo","breed":"Fun","category":"Streaming"},"tls": {"version":"TLSv1.2","client_requested_server_name":"f.vimeocdn.com","server_names":"*.vimeocdn.com","ja3":"cd08e31494f9531f560d64c695473da9","ja3s":"16c0b3e6a7b8173c16d944cfeaeee9cf","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=BE, O=GlobalSign nv-sa, CN=GlobalSign Atlas R3 DV TLS CA 2020","subjectDN":"CN=*.vimeocdn.com","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2,TLSv1.1,TLSv1","fingerprint":"3A:0F:CF:EC:3C:13:25:E2:E1:4D:C6:52:A6:4D:8D:96:10:1E:8E:37"}} +00689{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":248,"source":"sites.pcapng","alias":"nDPId-test","flow_id":5,"flow_state":"finished","flow_packets_processed":112,"flow_first_seen":1623226283573,"flow_last_seen":1623226466507,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":72441,"flow_avg_l4_payload_len":646,"midstream":0,"thread_ts_msec":1631088115406,"l3_proto":"ip4","src_ip":"192.168.1.250","dst_ip":"45.82.241.51","src_port":39890,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.Likee","breed":"Fun","category":"SocialNetwork"}} +00556{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":256,"source":"sites.pcapng","alias":"nDPId-test","packets-captured":256,"packets-processed":255,"total-skipped-flows":0,"total-l4-data-len":113664,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":6,"total-detection-updates":7,"total-updates":0,"current-active-flows":1,"total-active-flows":6,"total-idle-flows":5,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":50,"global_ts_msec":1637349011376} +00577{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":256,"source":"sites.pcapng","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1637349011376,"flow_last_seen":1637349011376,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1637349011376,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"143.204.9.65","src_port":48918,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":256,"source":"sites.pcapng","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_last_seen":1637349011376,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1637349011376,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8TGJAAEAGkyTAqAGAj8wJQb8WAbs5hVBVAAAAAKAC+vA+\/wAAAgQFtAQCCAoHfmCrAAAAAAEDAww="} +00479{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":257,"source":"sites.pcapng","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_last_seen":1637349011393,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1637349011393,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8T5MAAPMGHPOPzAlBwKgBgAG7vxa2dgKJOYVQVqASBZSQpgAAAgQFoAQCCArIQyJ4B35gqwEDAwk="} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":258,"source":"sites.pcapng","alias":"nDPId-test","flow_id":7,"flow_packet_id":3,"flow_last_seen":1637349011393,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1637349011393,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA0TGNAAEAGkyvAqAGAj8wJQb8WAbs5hVBWtnYCioAQABDE0gAAAQEICgd+YL3IQyJ4"} +00905{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":261,"source":"sites.pcapng","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1637349011376,"flow_last_seen":1637349011396,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":86,"midstream":0,"thread_ts_msec":1637349011396,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"143.204.9.65","src_port":48918,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.DisneyPlus","breed":"Fun","category":"Streaming"},"tls": {"version":"TLSv1.2","client_requested_server_name":"prod-static.disney-plus.net","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00947{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":263,"source":"sites.pcapng","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":1637349011376,"flow_last_seen":1637349011405,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1428,"flow_tot_l4_payload_len":1945,"flow_avg_l4_payload_len":243,"midstream":0,"thread_ts_msec":1637349011405,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"143.204.9.65","src_port":48918,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.DisneyPlus","breed":"Fun","category":"Streaming"},"tls": {"version":"TLSv1.3","client_requested_server_name":"prod-static.disney-plus.net","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"f4febc55ea12b31ae17cfb7e614afda8","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00685{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":285,"source":"sites.pcapng","alias":"nDPId-test","flow_id":6,"flow_state":"finished","flow_packets_processed":25,"flow_first_seen":1631088115362,"flow_last_seen":1631088168165,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1344,"flow_tot_l4_payload_len":5614,"flow_avg_l4_payload_len":224,"midstream":0,"thread_ts_msec":1637349011425,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"199.232.82.109","src_port":46724,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Vimeo","breed":"Fun","category":"Streaming"}} +00556{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":285,"source":"sites.pcapng","alias":"nDPId-test","packets-captured":285,"packets-processed":284,"total-skipped-flows":0,"total-l4-data-len":121431,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":7,"total-detection-updates":8,"total-updates":0,"current-active-flows":1,"total-active-flows":7,"total-idle-flows":6,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":58,"global_ts_msec":1642584017659} +00578{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":285,"source":"sites.pcapng","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1642584017659,"flow_last_seen":1642584017659,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1642584017659,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"23.12.104.83","src_port":39248,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":285,"source":"sites.pcapng","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_last_seen":1642584017659,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1642584017659,"pkt":"CL6sCxdumt9Y+uvcCABFAAA8EtFAAEAG2zrAqAypFwxoU5lQAbvzO0RFAAAAAKAC\/\/9KaQAAAgQFtAQCCApYVYYCAAAAAAEDAwk="} +00479{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":286,"source":"sites.pcapng","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_last_seen":1642584017680,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1642584017680,"pkt":"mt9Y+uvcCL6sCxduCABFAAA8AABAADcG9wsXDGhTwKgMqQG7mVB1nT8a8ztERqAS\/ojzIwAAAgQFtAQCCAqw3vMWWFWGAgEDAwc="} +00467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":287,"source":"sites.pcapng","alias":"nDPId-test","flow_id":8,"flow_packet_id":3,"flow_last_seen":1642584017681,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1642584017681,"pkt":"CL6sCxdumt9Y+uvcCABFAAA0EtJAAEAG20HAqAypFwxoU5lQAbvzO0RGdZ0\/G4AQAKwfuAAAAQEIClhVhhew3vMW"} +00905{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":288,"source":"sites.pcapng","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1642584017659,"flow_last_seen":1642584017683,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"thread_ts_msec":1642584017683,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"23.12.104.83","src_port":39248,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.AccuWeather","breed":"Fun","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"api.accuweather.com","ja3":"9b02ebd3a43b62d825e1ac605b621dc8","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} +00946{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":290,"source":"sites.pcapng","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1642584017659,"flow_last_seen":1642584017706,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":327,"midstream":0,"thread_ts_msec":1642584017706,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"23.12.104.83","src_port":39248,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.AccuWeather","breed":"Fun","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"api.accuweather.com","ja3":"9b02ebd3a43b62d825e1ac605b621dc8","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} +00688{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":315,"source":"sites.pcapng","alias":"nDPId-test","flow_id":7,"flow_state":"finished","flow_packets_processed":29,"flow_first_seen":1637349011376,"flow_last_seen":1637349011425,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1428,"flow_tot_l4_payload_len":7767,"flow_avg_l4_payload_len":267,"midstream":0,"thread_ts_msec":1642584019409,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"143.204.9.65","src_port":48918,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.DisneyPlus","breed":"Fun","category":"Streaming"}} +00556{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":315,"source":"sites.pcapng","alias":"nDPId-test","packets-captured":315,"packets-processed":314,"total-skipped-flows":0,"total-l4-data-len":128021,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":8,"total-detection-updates":9,"total-updates":0,"current-active-flows":1,"total-active-flows":8,"total-idle-flows":7,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":66,"global_ts_msec":1643355518166} +00589{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":315,"source":"sites.pcapng","alias":"nDPId-test","flow_id":9,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1643355518166,"flow_last_seen":1643355518166,"flow_idle_time":180000,"flow_min_l4_payload_len":1250,"flow_max_l4_payload_len":1250,"flow_tot_l4_payload_len":1250,"flow_avg_l4_payload_len":1250,"midstream":0,"thread_ts_msec":1643355518166,"l3_proto":"ip4","src_ip":"192.168.1.123","dst_ip":"216.58.209.46","src_port":59102,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +02141{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":315,"source":"sites.pcapng","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_last_seen":1643355518166,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1292,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1292,"pkt_l4_len":1258,"thread_ts_msec":1643355518166,"pkt":"pJGxgjQ5SKRyNpegCABFAAT+PElAAIARThnAqAF72DrRLubeAbsE6urRwAAAAAEIZ7HskbOWr9QAAETQNKtjIjiCXCI+9vqBWPy31G7jDH4RlwYv0XhaWuj0UrdcSVWZIrVwzwDrJa8dEWOeUvaAw7BXeYev6bi8Nu9Z4LWOvt0+XPgNkeHB6PvaZ9N4cpB1UIRx6byg5QljaxCkgdia5\/WZz2yX\/TayWJG0egLwFK4DYqDDADilA59ewmPTSu6+F3\/EVfKw86o2Yio5HeQqtUOtEdw6pRwxBehgjTrZf0PMuk40XDPug94YB\/sEApD8Ghq1zUUVofn\/jZoji68n+CZ74BkmZ8LSaemosx3Vm7YV3yQUauQU4lBHNM2XdkooJSDGv9YINXu8hmpHdW\/1encLGdPSyOJC8itWve1maDbUaMRhrbQrpaAPeVfgND5alDCN2DMGvFe3nB6Pz2LOpDsj\/3ZN3caT5Nt0nSv8HN+DYWZc+2JmBlBY71FJ57bmTqruFnoZ\/GjM0BGxB5WlpJ0M3zE3M16k0p8WRYGK3bOkXFB5rtEix709VUri+WnB1ivvzP4A8iO977JvKVGlPddOYZ4k7qZne6v\/jb1y0P5AatOM7YYIeRI7u8jf\/xM8RY8UTL\/Pv+EQzBcgac+DyXJSt\/sJo+Uuz0dGCYpa4Aa01DbWUiA5x+j4g5WT5LGdKrytMkGgkIcVSlNAt4nWOQc2IroqJjfmf+NbusGe\/Gviz5jV93bOaTFv7sGyuvESP0iH2MD2mwPgizF6t5EabtXWaevGbit0evQ9O3bHeRpQwTlwh0hRD7WqrIf0Wri9spAJN53856UKZFRupvrVqTH40ht5wGl2g3HXmJvEKnWBsD1hEB3sacVd4lWjKim62JMTY6yUmMhRBlNu2AupnyFsChUJ1NgsRbg5cQPowXRIBVG8WcjCs7OHKUH\/zza5xjXEz1FrdKQASDLCvFyh9YUzlRmDx7d99nX5vf9AwJejikY1uel\/yRMHcT9IqYO0kZBeGiX2ZDJD7vD1sF+05Qq++ztAL3CTqhuU\/7KSbWKiGOoFGj9phj6fZiE+g9e7+HIVuvPAKr+aSbxS71gHelt+hKMcDj7jdDFk5P6TqQdUXfqrnN38RDusNZmvWB+23Sj9NvIjlpua1MtXRWVJaLY5mX9AL1kTENCHtxomZwiXSqkSWtzS8dZocOlqjfWrd2hnw5yl8b7T0843OsmN6ZOoho4X9bhFw\/52C+NFDBAC42\/6jsH2i4NdbJBqOAuf4tLWi3oaJ\/0r5Y0wWyVnBbFtq1sx6d6EHxqir52O50dkkD8SF7j+wGSCG2L1l5bcQGnAqpzpZNB8AgofMTbrgYgdYIyrh\/neffOlCQyXy2EgLb\/xWEt+QftF8p5n2FzevDADqTCGGVeWULgrEsb\/3qULNf4uZHaY4HBD6To7yTuITvaXdqFt30MJBKnhBexi0dhA\/MGpMyVJfR\/PhbhWZmiNdx\/LRAV2Semg\/nPWe+DzSBBXm7wJXZiE\/8ewkRVdkujJi\/QhXAX0aOL76X77YYeny\/V35WiIqUmuxRHrBRdP5AMMQo\/adJoX4bzVdEvw3cGw7\/\/hO2VzwL5m0trABzWAWdjRjsrTEu\/mWAVCZDP5\/peoG8YXeXsdHWwpRLyNJpzOlRz5aND24Jgn5x2v3PqoD5RBiIEHwD8jlV2fRCZXq1e7tPV6eLhSI74="} +00900{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":315,"source":"sites.pcapng","alias":"nDPId-test","flow_id":9,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1643355518166,"flow_last_seen":1643355518166,"flow_idle_time":180000,"flow_min_l4_payload_len":1250,"flow_max_l4_payload_len":1250,"flow_tot_l4_payload_len":1250,"flow_avg_l4_payload_len":1250,"midstream":0,"thread_ts_msec":1643355518166,"l3_proto":"ip4","src_ip":"192.168.1.123","dst_ip":"216.58.209.46","src_port":59102,"dst_port":443,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"QUIC.GoogleClassroom","breed":"Safe","category":"Collaborative"},"quic": {"client_requested_server_name":"classroom.google.com","user_agent":"Chrome\/97.0.4692.99 Windows NT 10.0; Win64; x64","version":"TLSv1.3","alpn":"h3","ja3":"a27a03a8478393fe7f8958648bb71ff4","tls_supported_versions":"TLSv1.3"}} +00684{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":316,"source":"sites.pcapng","alias":"nDPId-test","flow_id":8,"flow_state":"finished","flow_packets_processed":30,"flow_first_seen":1642584017659,"flow_last_seen":1642584019409,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":6590,"flow_avg_l4_payload_len":219,"midstream":0,"thread_ts_msec":1643355518166,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"23.12.104.83","src_port":39248,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.AccuWeather","breed":"Fun","category":"Web"}} +00556{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":316,"source":"sites.pcapng","alias":"nDPId-test","packets-captured":316,"packets-processed":315,"total-skipped-flows":0,"total-l4-data-len":129271,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":9,"total-detection-updates":9,"total-updates":0,"current-active-flows":1,"total-active-flows":9,"total-idle-flows":8,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":71,"global_ts_msec":1646482623895} +00579{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":316,"source":"sites.pcapng","alias":"nDPId-test","flow_id":10,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482623895,"flow_last_seen":1646482623895,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482623895,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"31.222.67.112","src_port":35054,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":316,"source":"sites.pcapng","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_last_seen":1646482623895,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482623895,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8U5dAAEAGwa7AqAGAH95DcIjuAbuZU7+5AAAAAKAC+vB+rAAAAgQFtAQCCAqYsCyFAAAAAAEDAwc="} +00469{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":317,"source":"sites.pcapng","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_last_seen":1646482623937,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1646482623937,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA0AABAADIGI04f3kNwwKgBgAG7iO5SHRbemVO\/uoASa9CRawAAAgQFUAEBBAIBAwMH"} +01155{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":318,"source":"sites.pcapng","alias":"nDPId-test","flow_id":10,"flow_packet_id":3,"flow_last_seen":1646482623941,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"thread_ts_msec":1646482623941,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAItU5lAAEAGv7vAqAGAH95DcIjuAbuZU7+6Uh0W31AYAfZFAQAAFgMBAgABAAH8AwM7S+zQhzGHYgeM16HLoV5Lvv0qFp3\/Q9lLhcf6NGzgACCV4MycI1TbPUTQp0gTtBJdGxhCWPX0NxBb4Keh1UEhIQAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAASABAAAA13d3cuYmFkb28uY29tABcAAP8BAAEAAAoADgAMAB0AFwAYABkBAAEBAAsAAgEAACMAAAAQAA4ADAJoMghodHRwLzEuMQAFAAUBAAAAAAAiAAoACAQDBQMGAwIDADMAawBpAB0AIDy\/wV7uHvn89KVxoNawBj6O\/1N7J\/Rv6ROuT\/L2i752ABcAQQR8rtiFUa3yYRs4u6Ro\/84M9BXHGtIJp6HdzCSQRE\/jjRMPOqb5+WU5M\/Rwa3rXtSAPp6MS0Mul28MptoKZ2BK0ACsABQQDBAMDAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAQAcAAJAAQAVAIkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00893{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":318,"source":"sites.pcapng","alias":"nDPId-test","flow_id":10,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482623895,"flow_last_seen":1646482623941,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482623941,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"31.222.67.112","src_port":35054,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Badoo","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.badoo.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00934{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":319,"source":"sites.pcapng","alias":"nDPId-test","flow_id":10,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482623895,"flow_last_seen":1646482623982,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1380,"flow_tot_l4_payload_len":1897,"flow_avg_l4_payload_len":474,"midstream":0,"thread_ts_msec":1646482623982,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"31.222.67.112","src_port":35054,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Badoo","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.3","client_requested_server_name":"www.badoo.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00703{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":320,"source":"sites.pcapng","alias":"nDPId-test","flow_id":9,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":1643355518166,"flow_last_seen":1643355518166,"flow_idle_time":180000,"flow_min_l4_payload_len":1250,"flow_max_l4_payload_len":1250,"flow_tot_l4_payload_len":1250,"flow_avg_l4_payload_len":1250,"midstream":0,"thread_ts_msec":1646482623982,"l3_proto":"ip4","src_ip":"192.168.1.123","dst_ip":"216.58.209.46","src_port":59102,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"QUIC.GoogleClassroom","breed":"Safe","category":"Collaborative"}} +00579{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":320,"source":"sites.pcapng","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482634412,"flow_last_seen":1646482634412,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482634412,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"172.65.251.78","src_port":53998,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":320,"source":"sites.pcapng","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_last_seen":1646482634412,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482634412,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8ehBAAEAGVvPAqAGArEH7TtLuAburPYAuAAAAAKAC+vCVcQAAAgQFtAQCCAoaoTMuAAAAAAEDAwc="} +00470{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":321,"source":"sites.pcapng","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_last_seen":1646482634431,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1646482634431,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA0AABAADkG2AusQftOwKgBgAG70u5kgyMxqz2AL4AS\/\/99tgAAAgQFeAEBBAIBAwMK"} +01152{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":322,"source":"sites.pcapng","alias":"nDPId-test","flow_id":11,"flow_packet_id":3,"flow_last_seen":1646482634434,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"thread_ts_msec":1646482634434,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAItehJAAEAGVQDAqAGArEH7TtLuAburPYAvZIMjMlAYAfajwgAAFgMBAgABAAH8AwNOB4Gzi6+YArAvzkfwrorK9DEddM7BFl3e3mWx5EKfGSCorzDjbh21t2eWZKubSdOdkcLfUyHi+FUzEXYnC03sBQAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAATABEAAA53d3cuZ2l0bGFiLmNvbQAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAIgAKAAgEAwUDBgMCAwAzAGsAaQAdACA5FC8LVJQpX7CGnPMJyGCVSqmP\/UlOQqTKt4aSCzonPAAXAEEEf41WX9lKjs6LoM+3mxjeublwFG7G1\/kkw4gmsHPLzdToe\/hXlsiK3SyaMLeOC3M5q1ZNvI72xevTMYH\/wlBkVwArAAUEAwQDAwANABgAFgQDBQMGAwgECAUIBgQBBQEGAQIDAgEALQACAQEAHAACQAEAFQCIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00895{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":322,"source":"sites.pcapng","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482634412,"flow_last_seen":1646482634434,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482634434,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"172.65.251.78","src_port":53998,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.GitLab","breed":"Fun","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.gitlab.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00936{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":323,"source":"sites.pcapng","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482634412,"flow_last_seen":1646482634459,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":1977,"flow_avg_l4_payload_len":494,"midstream":0,"thread_ts_msec":1646482634459,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"172.65.251.78","src_port":53998,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.GitLab","breed":"Fun","category":"Collaborative"},"tls": {"version":"TLSv1.3","client_requested_server_name":"www.gitlab.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"eb1d94daa7e0344597e756a1fb6e7054","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00578{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":324,"source":"sites.pcapng","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482646628,"flow_last_seen":1646482646628,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482646628,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"2.17.141.128","src_port":42580,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":324,"source":"sites.pcapng","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_last_seen":1646482646628,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482646628,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8eQxAAEAGb\/bAqAGAAhGNgKZUAbv+Ru5OAAAAAKAC+vDfwAAAAgQFtAQCCAp7uQs2AAAAAAEDAwc="} +00482{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":325,"source":"sites.pcapng","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_last_seen":1646482646646,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482646646,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADgG8QICEY2AwKgBgAG7plR0ThXR\/kbuT6AS\/oh2XAAAAgQFtAQCCAqpkTIKe7kLNgEDAwc="} +01165{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":326,"source":"sites.pcapng","alias":"nDPId-test","flow_id":12,"flow_packet_id":3,"flow_last_seen":1646482646648,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482646648,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5eQ5AAEAGbffAqAGAAhGNgKZUAbv+Ru5PdE4V0oAYAfbaKAAAAQEICnu5C0qpkTIKFgMBAgABAAH8AwMSh5Kk8yD8gdWVB2YFzzg9KRBCWJ\/pzlApBrokxgf2OCBs84UpHDw4uY4jKpCVZJzZAhJUrEs0AlJ7gTtfJSwiWgAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAXABUAABJ3d3cuYWN0aXZpc2lvbi5jb20AFwAA\/wEAAQAACgAOAAwAHQAXABgAGQEAAQEACwACAQAAIwAAABAADgAMAmgyCGh0dHAvMS4xAAUABQEAAAAAACIACgAIBAMFAwYDAgMAMwBrAGkAHQAg40qefHDImQJEkibGm9hnpGwl44lKo4KOQS8qsLRSATsAFwBBBPNBVrG5A+ZLqrow1aQOaEgsW+53RcPAplpAt8ULtljoAJH8CjL7YTSZ+PIOiRhMhirRlex47cXc5PiOAFYE9T0AKwAFBAMEAwMADQAYABYEAwUDBgMIBAgFCAYEAQUBBgECAwIBAC0AAgEBABwAAkABABUAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00893{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":326,"source":"sites.pcapng","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482646628,"flow_last_seen":1646482646648,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482646648,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"2.17.141.128","src_port":42580,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Activision","breed":"Fun","category":"Game"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.activision.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00949{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":327,"source":"sites.pcapng","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482646628,"flow_last_seen":1646482646665,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646482646665,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"2.17.141.128","src_port":42580,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Activision","breed":"Fun","category":"Game"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.activision.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"35af4c8cd9495354f7d701ce8ad7fd2d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +02301{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":330,"source":"sites.pcapng","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":1646482646628,"flow_last_seen":1646482646669,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":5461,"flow_avg_l4_payload_len":780,"midstream":0,"thread_ts_msec":1646482646669,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"2.17.141.128","src_port":42580,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Activision","breed":"Fun","category":"Game"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.activision.com","server_names":"www.benefitsforeveryworld.com,worldseriesofwarzone.com,treyarch.com,toysforbob.com,spyrothedragon.com,sledgehammergames.com,skylanders.com,sierragames.com,sekirothegame.com,ravensoftware.com,preview.demonware.net,infinityward.com,highmoonstudios.com,highmoon.com,guitarhero.com,europeanwarzoneseries.com,demonware.net,crashbandicoot.com,cdn.gh5.ps3.guitarhero.com,callofdutyleague.com,callofdutyendowment.org,callofdutyendowment.com,callofduty.com,benefitsforeveryworld.com,activisionretail.com,activisionblizzardmedia.com,activisionblizzard.com,activision.com,*.worldseriesofwarzone.com,*.treyarch.com,*.toysforbob.com,*.support.activision.com,*.spyrothedragon.com,*.sledgehammergames.com,*.skylanders.com,*.sierragames.com,*.sekirothegame.com,*.ravensoftware.com,*.infinityward.com,*.highmoonstudios.com,*.highmoon.com,*.guitarhero.com,*.europeanwarzoneseries.com,*.demonware.net,*.crashbandicoot.com,*.callofdutyleague.com,*.callofdutyendowment.org,*.callofdutyendowment.com,*.callofduty.com,*.activisionretail.com,*.activisionblizzardmedia.com,*.activisionblizzard.com,*.activision.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"35af4c8cd9495354f7d701ce8ad7fd2d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA","subjectDN":"C=US, ST=California, L=Santa Monica, O=Activision Publishing, Inc., CN=activision.com","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"F7:39:B4:E7:27:83:D4:55:8B:13:77:16:D5:8A:3E:77:FB:2A:4F:41"}} +00579{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":333,"source":"sites.pcapng","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482659915,"flow_last_seen":1646482659915,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482659915,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"146.75.62.167","src_port":46084,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":333,"source":"sites.pcapng","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_last_seen":1646482659915,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482659915,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8NwhAAEAGcJnAqAGAkks+p7QEAbuPD+ThAAAAAKAC+vAn\/AAAAgQFtAQCCAp9leqxAAAAAAEDAwc="} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":334,"source":"sites.pcapng","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_last_seen":1646482659944,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482659944,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADkGrqGSSz6nwKgBgAG7tAQzgGmMjw\/k4qAS\/\/\/dhgAAAgQFTAQCCAr4JbCIfZXqsQEDAwk="} +01168{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":335,"source":"sites.pcapng","alias":"nDPId-test","flow_id":13,"flow_packet_id":3,"flow_last_seen":1646482659945,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482659945,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5NwpAAEAGbprAqAGAkks+p7QEAbuPD+TiM4BpjYAYAfarGwAAAQEICn2V6s\/4JbCIFgMBAgABAAH8AwPVHsjDDxZ0MEuPnh4mVZQrYKtXYBQ9pfekL0WuWf4AwyAvTRXY5\/1xoex7GTddskZx0XzTM0eEKSDE8zjmPz09AAAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAASABAAAA1ncWwudHdpdGNoLnR2ABcAAP8BAAEAAAoADgAMAB0AFwAYABkBAAEBAAsAAgEAACMAAAAQAA4ADAJoMghodHRwLzEuMQAFAAUBAAAAAAAiAAoACAQDBQMGAwIDADMAawBpAB0AICTuPjjZ\/cozh9y3b4u57OZ+NqRixmrA1oX4LnqMFUIxABcAQQTtWijAm0UTGHfpz\/ha9z62jseAV4wQoU798kRZvjxGrgocjEiYQtFtFEOacmIDo8c6dP4orndC+2JQqffkv\/gjACsABQQDBAMDAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAQAcAAJAAQAVAIkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00886{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":335,"source":"sites.pcapng","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482659915,"flow_last_seen":1646482659945,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482659945,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"146.75.62.167","src_port":46084,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Twitch","breed":"Fun","category":"Video"},"tls": {"version":"TLSv1.2","client_requested_server_name":"gql.twitch.tv","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00927{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":336,"source":"sites.pcapng","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482659915,"flow_last_seen":1646482659961,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1340,"flow_tot_l4_payload_len":1857,"flow_avg_l4_payload_len":464,"midstream":0,"thread_ts_msec":1646482659961,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"146.75.62.167","src_port":46084,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Twitch","breed":"Fun","category":"Video"},"tls": {"version":"TLSv1.3","client_requested_server_name":"gql.twitch.tv","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"f4febc55ea12b31ae17cfb7e614afda8","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00578{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":337,"source":"sites.pcapng","alias":"nDPId-test","flow_id":14,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482686914,"flow_last_seen":1646482686914,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482686914,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"208.85.40.158","src_port":45936,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":337,"source":"sites.pcapng","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_last_seen":1646482686914,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482686914,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8RWlAAEAGOjfAqAGA0FUonrNwAFCsdkxQAAAAAKAC+vAqmQAAAgQFtAQCCArNau1nAAAAAAEDAwc="} +00482{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":338,"source":"sites.pcapng","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_last_seen":1646482687080,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482687080,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8\/\/dAAPAGz6fQVSiewKgBgABQs3Db1RKprHZMUaASOQif4AAAAgQFtAEDAwAEAggKWgQEFM1q7Wc="} +00579{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":339,"source":"sites.pcapng","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482724450,"flow_last_seen":1646482724450,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482724450,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"18.66.196.102","src_port":51806,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":339,"source":"sites.pcapng","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_last_seen":1646482724450,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482724450,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8sa9AAEAG8DvAqAGAEkLEZspeAbv+oP0DAAAAAKAC+vBIlQAAAgQFtAQCCAqQpxNDAAAAAAEDAwc="} +00483{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":340,"source":"sites.pcapng","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_last_seen":1646482724458,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482724458,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8e2QAAPYGsIYSQsRmwKgBgAG7yl4LcBoC\/qD9BKAS\/\/+NCwAAAgQFoAQCCAqOOgLQkKcTQwEDAwg="} +01168{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":341,"source":"sites.pcapng","alias":"nDPId-test","flow_id":15,"flow_packet_id":3,"flow_last_seen":1646482724464,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482724464,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5sbFAAEAG7jzAqAGAEkLEZspeAbv+oP0EC3AaA4AYAfbA9QAAAQEICpCnE1COOgLQFgMBAgABAAH8AwM6K+sImNx3dIej3yQBfsHlSQyH5l4F8hLKFYurrt+jPCCUv6qySiadEZg7Gj4\/vX5jrLg\/JYOIeoxWa\/ahTy7RDQAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAATABEAAA5zb3VuZGNsb3VkLmNvbQAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAIgAKAAgEAwUDBgMCAwAzAGsAaQAdACDq1odYnjLE9YoHd\/igeLWhv14ukLQSyf98ZPyHkQn7OgAXAEEEKYWpJR9uHJSJZBwzi1pAC8cLX9iNXc5VMFPlSgV8HHXqYbwegIwyfo36+y7oUVZIFeBilQuBs9gLF4NzHajtKwArAAUEAwQDAwANABgAFgQDBQMGAwgECAUIBgQBBQEGAQIDAgEALQACAQEAHAACQAEAFQCIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00891{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":341,"source":"sites.pcapng","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482724450,"flow_last_seen":1646482724464,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482724464,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"18.66.196.102","src_port":51806,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.SoundCloud","breed":"Fun","category":"Music"},"tls": {"version":"TLSv1.2","client_requested_server_name":"soundcloud.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00932{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":342,"source":"sites.pcapng","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482724450,"flow_last_seen":1646482724472,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1428,"flow_tot_l4_payload_len":1945,"flow_avg_l4_payload_len":486,"midstream":0,"thread_ts_msec":1646482724472,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"18.66.196.102","src_port":51806,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.SoundCloud","breed":"Fun","category":"Music"},"tls": {"version":"TLSv1.3","client_requested_server_name":"soundcloud.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"f4febc55ea12b31ae17cfb7e614afda8","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00580{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":343,"source":"sites.pcapng","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482734324,"flow_last_seen":1646482734324,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482734324,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"151.101.192.92","src_port":56468,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":343,"source":"sites.pcapng","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_last_seen":1646482734324,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482734324,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8YZNAAEAGvz7AqAGAl2XAXNyUAbtdgP2MAAAAAKAC+vB5pwAAAgQFtAQCCArbJaT6AAAAAAEDAwc="} +00482{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":344,"source":"sites.pcapng","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_last_seen":1646482734331,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482734331,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADkGJ9KXZcBcwKgBgAG73JRRJl9LXYD9jaAS\/\/87kQAAAgQFTAQCCArq9J312yWk+gEDAwk="} +01168{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":345,"source":"sites.pcapng","alias":"nDPId-test","flow_id":16,"flow_packet_id":3,"flow_last_seen":1646482734334,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482734334,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5YZVAAEAGvT\/AqAGAl2XAXNyUAbtdgP2NUSZfTIAYAfZOkQAAAQEICtslpQXq9J31FgMBAgABAAH8AwNzr2vzd\/QT\/aDhJiSq61v58duBBGwTUq6z8fAzWLEV5CDNfOfaUUVYVfXW\/CDKtRAJ+tVWWsbZK9mMfW2g+Km+ogAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAANAAsAAAh2ZXZvLmNvbQAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAIgAKAAgEAwUDBgMCAwAzAGsAaQAdACCPQyH3d70yPXK9aVtEdAPnRA9ZC5WTB071dNPYc9Y+CAAXAEEEeVVr0wfghCvKk8pB3rwr9lMyYYYxB1YwkLSYt9F3bwDqNkUCdiLkyXAxOw3adrfDZNG4HFWPlbGmWIPel1Si6AArAAUEAwQDAwANABgAFgQDBQMGAwgECAUIBgQBBQEGAQIDAgEALQACAQEAHAACQAEAFQCOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00874{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":345,"source":"sites.pcapng","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482734324,"flow_last_seen":1646482734334,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482734334,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"151.101.192.92","src_port":56468,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"vevo.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00930{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":346,"source":"sites.pcapng","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482734324,"flow_last_seen":1646482734350,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1340,"flow_tot_l4_payload_len":1857,"flow_avg_l4_payload_len":464,"midstream":0,"thread_ts_msec":1646482734350,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"151.101.192.92","src_port":56468,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"vevo.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"00447ab319e9d94ba2b4c1248e155917","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +01479{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":348,"source":"sites.pcapng","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1646482734324,"flow_last_seen":1646482734350,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1340,"flow_tot_l4_payload_len":4125,"flow_avg_l4_payload_len":687,"midstream":0,"thread_ts_msec":1646482734350,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"151.101.192.92","src_port":56468,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Vevo","breed":"Fun","category":"Music"},"tls": {"version":"TLSv1.2","client_requested_server_name":"vevo.com","server_names":"*.cache.vevo.com,*.cache.vevodev.com,*.cache.vevoprd.com,*.cache.vevostg.com,*.vevodev.com,*.vevoprd.com,*.vevostg.com,stg.vevo.ly,vevo.com,vevo.ly,vevo.pl,vevo.tv,vevoapi.com,vevocdn.com,vevolive.tv,vevosubmit.com,www.vevo.ly,www.vevo.pl,*.vevo.com,*.vevo.ly,*.vevo.pl,*.vevo.tv,*.vevoapi.com,*.vevocdn.com,*.vevolive.tv,*.vevosubmit.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"00447ab319e9d94ba2b4c1248e155917","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=BE, O=GlobalSign nv-sa, CN=GlobalSign Atlas R3 DV TLS CA 2020","subjectDN":"CN=*.cache.vevo.com","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"ED:55:58:0E:19:94:FE:95:93:86:88:FE:30:27:DF:43:EB:74:17:C2"}} +00576{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":351,"source":"sites.pcapng","alias":"nDPId-test","flow_id":17,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482753482,"flow_last_seen":1646482753482,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482753482,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"23.1.66.79","src_port":48140,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":351,"source":"sites.pcapng","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_last_seen":1646482753482,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482753482,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8SaBAAEAG1aPAqAGAFwFCT7wMAbtaGHg4AAAAAKAC+vA\/9AAAAgQFtAQCCAr10Gu5AAAAAAEDAwc="} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":352,"source":"sites.pcapng","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_last_seen":1646482753504,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482753504,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADkGJkQXAUJPwKgBgAG7vAwZG5KKWhh4OaAS\/ogYMwAAAgQFtAQCCApuzQml9dBruQEDAwc="} +01168{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":353,"source":"sites.pcapng","alias":"nDPId-test","flow_id":17,"flow_packet_id":3,"flow_last_seen":1646482753507,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482753507,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5SaJAAEAG06TAqAGAFwFCT7wMAbtaGHg5GRuSi4AYAfZqJAAAAQEICvXQa9NuzQmlFgMBAgABAAH8AwOUyHhinsfe9G2IXNgY9L7xAzZ+DjB199btap4Cw89cViDuti6QLvXTxzS8GPAI\/LqrruRicKAVDOLPOdfZnGvHHQAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAQAA4AAAtjZG4uY25uLmNvbQAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAIgAKAAgEAwUDBgMCAwAzAGsAaQAdACCyATmKdF69bnRwMVBRd98tu612XdMkfb0+p4HzFN6fBwAXAEEE+SEvSVfUiTeIP8IKKsjphsMZuVwTWztloapho\/r89Lhgv68xO7BDbwW8nmN\/dVf8z\/v3pQVdFakWyi7cuNIpiwArAAUEAwQDAwANABgAFgQDBQMGAwgECAUIBgQBBQEGAQIDAgEALQACAQEAHAACQAEAFQCLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00877{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":353,"source":"sites.pcapng","alias":"nDPId-test","flow_id":17,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482753482,"flow_last_seen":1646482753507,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482753507,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"23.1.66.79","src_port":48140,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.CNN","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"cdn.cnn.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00918{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":354,"source":"sites.pcapng","alias":"nDPId-test","flow_id":17,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482753482,"flow_last_seen":1646482753526,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646482753526,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"23.1.66.79","src_port":48140,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.CNN","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"cdn.cnn.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00577{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":355,"source":"sites.pcapng","alias":"nDPId-test","flow_id":18,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482759960,"flow_last_seen":1646482759960,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482759960,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"2.17.141.49","src_port":40832,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":355,"source":"sites.pcapng","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_last_seen":1646482759960,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482759960,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8N8NAAEAGsY7AqAGAAhGNMZ+AAbsz0CpkAAAAAKAC+vAbqAAAAgQFtAQCCApTrIzgAAAAAAEDAwc="} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":356,"source":"sites.pcapng","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_last_seen":1646482759979,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482759979,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADgG8VECEY0xwKgBgAG7n4Axx0rTM9AqZaAS\/ogIXwAAAgQFtAQCCAq1xN1AU6yM4AEDAwc="} +01169{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":357,"source":"sites.pcapng","alias":"nDPId-test","flow_id":18,"flow_packet_id":3,"flow_last_seen":1646482759982,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482759982,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5N8VAAEAGr4\/AqAGAAhGNMZ+AAbsz0CplMcdK1IAYAfb4fgAAAQEIClOsjPe1xN1AFgMBAgABAAH8AwO90p\/YrOJd\/Z4tss7jqktThIJxJIB3e+qrLLFobtKKlyAX6YhgDO5LSOYTxZN2IGu+QsQ1WdlQy7VgjD2lE+VvBgAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAARAA8AAAx3d3cuZWJheS5jb20AFwAA\/wEAAQAACgAOAAwAHQAXABgAGQEAAQEACwACAQAAIwAAABAADgAMAmgyCGh0dHAvMS4xAAUABQEAAAAAACIACgAIBAMFAwYDAgMAMwBrAGkAHQAgf8Mv24G6SSqxNEfrqm7W\/bejLWA6OGSZmHTWefPpxiwAFwBBBD+GtRBdEP9fCUeld\/IGhJTQe0q9+sY1uU3D5mNCoqM6EROqE0XBEIsVt1XPe0XwL5d6JRvhBZsY2OXTwlPA9KoAKwAFBAMEAwMADQAYABYEAwUDBgMIBAgFCAYEAQUBBgECAwIBAC0AAgEBABwAAkABABUAigAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00885{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":357,"source":"sites.pcapng","alias":"nDPId-test","flow_id":18,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482759960,"flow_last_seen":1646482759982,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482759982,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"2.17.141.49","src_port":40832,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.eBay","breed":"Safe","category":"Shopping"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.ebay.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00926{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":358,"source":"sites.pcapng","alias":"nDPId-test","flow_id":18,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482759960,"flow_last_seen":1646482760002,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646482760002,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"2.17.141.49","src_port":40832,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.eBay","breed":"Safe","category":"Shopping"},"tls": {"version":"TLSv1.3","client_requested_server_name":"www.ebay.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00580{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":359,"source":"sites.pcapng","alias":"nDPId-test","flow_id":19,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482772264,"flow_last_seen":1646482772264,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482772264,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"185.125.190.21","src_port":42884,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":359,"source":"sites.pcapng","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_last_seen":1646482772264,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482772264,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8SfdAAEAGtwnAqAGAuX2+FaeEAbviQ3M+AAAAAKAC+vAD2AAAAgQFtAQCCAo3btlLAAAAAAEDAwc="} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":360,"source":"sites.pcapng","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_last_seen":1646482772292,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482772292,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADcGCgG5fb4VwKgBgAG7p4RVAzgX4kNzP6AS\/ogvJwAAAgQFtAQCCAoh0SIcN27ZSwEDAwc="} +01167{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":361,"source":"sites.pcapng","alias":"nDPId-test","flow_id":19,"flow_packet_id":3,"flow_last_seen":1646482772294,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482772294,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5SflAAEAGtQrAqAGAuX2+FaeEAbviQ3M\/VQM4GIAYAfaY1QAAAQEICjdu2Woh0SIcFgMBAgABAAH8AwMB8bRCQdqcx9fui+mF7VjuHN5SBb79arjGU4qYGthMOSBbTABCg135wJeFEPl+a8Oxzav9AsC9J9+l+IIaNAxYkQAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAWABQAABFhc3NldHMudWJ1bnR1LmNvbQAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAIgAKAAgEAwUDBgMCAwAzAGsAaQAdACCezVQBlUDf2SIx8m1xehLWY9pQKyvfH068Wwzre\/JcNwAXAEEEo09VNt2RkHEqlhHBw1nk6JbOlFIOJqgyxElu\/vwC+3XCJEwr43v+9rwXwcTyZXa+qtiIur9f6O0kVe2u0AJzEQArAAUEAwQDAwANABgAFgQDBQMGAwgECAUIBgQBBQEGAQIDAgEALQACAQEAHAACQAEAFQCFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00901{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":361,"source":"sites.pcapng","alias":"nDPId-test","flow_id":19,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482772264,"flow_last_seen":1646482772294,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482772294,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"185.125.190.21","src_port":42884,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.UbuntuONE","breed":"Acceptable","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"assets.ubuntu.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00942{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":362,"source":"sites.pcapng","alias":"nDPId-test","flow_id":19,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482772264,"flow_last_seen":1646482772325,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646482772325,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"185.125.190.21","src_port":42884,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.UbuntuONE","breed":"Acceptable","category":"Cloud"},"tls": {"version":"TLSv1.3","client_requested_server_name":"assets.ubuntu.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00579{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":363,"source":"sites.pcapng","alias":"nDPId-test","flow_id":20,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482785304,"flow_last_seen":1646482785304,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482785304,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"95.131.169.91","src_port":51248,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":363,"source":"sites.pcapng","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_last_seen":1646482785304,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482785304,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8c2NAAEAG\/FHAqAGAX4OpW8gwAbszoGaBAAAAAKAC+vB9ogAAAgQFtAQCCArCJt4xAAAAAAEDAwc="} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":364,"source":"sites.pcapng","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_last_seen":1646482785347,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482785347,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADIGfbVfg6lbwKgBgAG7yDD0fDnYM6BmgqASOJCOBAAAAgQFtAQCCAoi\/WCZwibeMQEDAwk="} +01167{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":365,"source":"sites.pcapng","alias":"nDPId-test","flow_id":20,"flow_packet_id":3,"flow_last_seen":1646482785351,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482785351,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5c2VAAEAG+lLAqAGAX4OpW8gwAbszoGaC9Hw52YAYAfYZoQAAAQEICsIm3l8i\/WCZFgMBAgABAAH8AwNK0euZMFtaCNBtu+eL8QS+C1QwW1wzikaweB9ZeLN7jCCkdWD5KYTe5rYj3sVQQUUDDmKS7Ul8Bkz8dJPsZBeSHgAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAPAA0AAAp0dWVudGkuY29tABcAAP8BAAEAAAoADgAMAB0AFwAYABkBAAEBAAsAAgEAACMAAAAQAA4ADAJoMghodHRwLzEuMQAFAAUBAAAAAAAiAAoACAQDBQMGAwIDADMAawBpAB0AIJK5tprzoOfSjZ23KXMf08y5udMKZfRYOXHDalLyYQBZABcAQQRLZU+TiBidby\/7mJhjeaCEAZfIl\/ESg4w9XgdOmdSs6KJ9\/6C1zE6e09432pgZPLx5qZNVUeHl8Lum72bGeXBPACsABQQDBAMDAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAQAcAAJAAQAVAIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00875{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":365,"source":"sites.pcapng","alias":"nDPId-test","flow_id":20,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482785304,"flow_last_seen":1646482785351,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482785351,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"95.131.169.91","src_port":51248,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"tuenti.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00931{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":366,"source":"sites.pcapng","alias":"nDPId-test","flow_id":20,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482785304,"flow_last_seen":1646482785395,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646482785395,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"95.131.169.91","src_port":51248,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"tuenti.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"61be9ce3d068c08ff99a857f62352f9d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +01207{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":368,"source":"sites.pcapng","alias":"nDPId-test","flow_id":20,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1646482785304,"flow_last_seen":1646482785395,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":3831,"flow_avg_l4_payload_len":638,"midstream":0,"thread_ts_msec":1646482785395,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"95.131.169.91","src_port":51248,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Tuenti","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"tuenti.com","server_names":"*.tuenti.com,tuenti.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"61be9ce3d068c08ff99a857f62352f9d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=DigiCert Inc, CN=DigiCert TLS RSA SHA256 2020 CA1","subjectDN":"C=ES, L=Madrid, O=Tuenti Technologies S.L., CN=*.tuenti.com","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"89:B8:FA:C7:22:04:D2:BE:C5:6E:59:10:31:67:42:B1:3F:6D:F8:3B"}} +00579{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":371,"source":"sites.pcapng","alias":"nDPId-test","flow_id":21,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482786097,"flow_last_seen":1646482786097,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482786097,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"95.131.170.91","src_port":39302,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":371,"source":"sites.pcapng","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_last_seen":1646482786097,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482786097,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8MYNAAEAGPTLAqAGAX4OqW5mGAbs4G85LAAAAAKAC+vAJ+AAAAgQFtAQCCApUK4E8AAAAAAEDAwc="} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":372,"source":"sites.pcapng","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_last_seen":1646482786139,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482786139,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADEGfbVfg6pbwKgBgAG7mYaAJv+vOBvOTKASOJA3NAAAAgQFtAQCCAojEPIqVCuBPAEDAwk="} +01170{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":373,"source":"sites.pcapng","alias":"nDPId-test","flow_id":21,"flow_packet_id":3,"flow_last_seen":1646482786140,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482786140,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5MYVAAEAGOzPAqAGAX4OqW5mGAbs4G85MgCb\/sIAYAfY7ugAAAQEIClQrgWcjEPIqFgMBAgABAAH8AwPCuINo9aszS1NOKEJoT\/qcXc1z2+SkMYjVWEN9Dzm1uCAc1Fe\/tF+S3TB+puhQn5k1kl\/SrZE1Zu7DG17b6iPYkAAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAWABQAABFzdGF0aWMudHVlbnRpLmNvbQAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAIgAKAAgEAwUDBgMCAwAzAGsAaQAdACAO0kbEPJvFV01Owk3nxVpBPAsVRMhGqyVHONxZeCXXCAAXAEEEdYt+qtkVgPe4ucZXkNkiZFAQTN50kMr6BFmQ8vGiT4E\/aWy5wxXrEUez6C+lutJauRk\/zdA9y71YXWyeYxHbNwArAAUEAwQDAwANABgAFgQDBQMGAwgECAUIBgQBBQEGAQIDAgEALQACAQEAHAACQAEAFQCFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00896{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":373,"source":"sites.pcapng","alias":"nDPId-test","flow_id":21,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482786097,"flow_last_seen":1646482786140,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482786140,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"95.131.170.91","src_port":39302,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Tuenti","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"static.tuenti.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00952{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":374,"source":"sites.pcapng","alias":"nDPId-test","flow_id":21,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482786097,"flow_last_seen":1646482786188,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646482786188,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"95.131.170.91","src_port":39302,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Tuenti","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"static.tuenti.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"61be9ce3d068c08ff99a857f62352f9d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +01214{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":376,"source":"sites.pcapng","alias":"nDPId-test","flow_id":21,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1646482786097,"flow_last_seen":1646482786188,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":3831,"flow_avg_l4_payload_len":638,"midstream":0,"thread_ts_msec":1646482786188,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"95.131.170.91","src_port":39302,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Tuenti","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"static.tuenti.com","server_names":"*.tuenti.com,tuenti.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"61be9ce3d068c08ff99a857f62352f9d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=DigiCert Inc, CN=DigiCert TLS RSA SHA256 2020 CA1","subjectDN":"C=ES, L=Madrid, O=Tuenti Technologies S.L., CN=*.tuenti.com","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"89:B8:FA:C7:22:04:D2:BE:C5:6E:59:10:31:67:42:B1:3F:6D:F8:3B"}} +00580{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":379,"source":"sites.pcapng","alias":"nDPId-test","flow_id":22,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482791144,"flow_last_seen":1646482791144,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482791144,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"95.101.195.214","src_port":51432,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":379,"source":"sites.pcapng","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_last_seen":1646482791144,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482791144,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8FF5AAEAGQPrAqAGAX2XD1sjoAbs9AWSXAAAAAKAC+vBfJgAAAgQFtAQCCAoz72hZAAAAAAEDAwc="} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":380,"source":"sites.pcapng","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_last_seen":1646482791167,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482791167,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADMGYlhfZcPWwKgBgAG7yOhRyYQJPQFkmKAS\/ohadwAAAgQFtAQCCAoA0SpiM+9oWQEDAwc="} +01165{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":381,"source":"sites.pcapng","alias":"nDPId-test","flow_id":22,"flow_packet_id":3,"flow_last_seen":1646482791170,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482791170,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5FGBAAEAGPvvAqAGAX2XD1sjoAbs9AWSYUcmECoAYAfYkYQAAAQEICjPvaHMA0SpiFgMBAgABAAH8AwPkjLny33P+mExr32cMRl62\/8RJSZlKid1V05U+ySIWLCA+yoN1VMfFXakU81pmrArAv4PMFa74gV6zhhtZIkRahgAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAANAAsAAAhodWx1LmNvbQAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAIgAKAAgEAwUDBgMCAwAzAGsAaQAdACATY1QXYS0qh7KvKliQF74PNyaFCqlZEZicpu9ccKADKQAXAEEEtcC0kqJMuUk4fNE8PcFvshva3wSMZbKQk5Gr6YxJX1t14RCVX0X4nJLqvHYB8ofAk7LBbtBWK6qUGB5XQIzcOQArAAUEAwQDAwANABgAFgQDBQMGAwgECAUIBgQBBQEGAQIDAgEALQACAQEAHAACQAEAFQCOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00884{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":381,"source":"sites.pcapng","alias":"nDPId-test","flow_id":22,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482791144,"flow_last_seen":1646482791170,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482791170,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"95.101.195.214","src_port":51432,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Hulu","breed":"Fun","category":"Streaming"},"tls": {"version":"TLSv1.2","client_requested_server_name":"hulu.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00925{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":382,"source":"sites.pcapng","alias":"nDPId-test","flow_id":22,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482791144,"flow_last_seen":1646482791191,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646482791191,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"95.101.195.214","src_port":51432,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Hulu","breed":"Fun","category":"Streaming"},"tls": {"version":"TLSv1.3","client_requested_server_name":"hulu.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00578{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":383,"source":"sites.pcapng","alias":"nDPId-test","flow_id":23,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482801387,"flow_last_seen":1646482801387,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482801387,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"34.96.123.111","src_port":44954,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":383,"source":"sites.pcapng","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_last_seen":1646482801387,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482801387,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8u7RAAEAGHxDAqAGAImB7b6+aAFDTrORQAAAAAKAC+vAeUwAAAgQFtAQCCAqmtsAlAAAAAAEDAwc="} +00482{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":384,"source":"sites.pcapng","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_last_seen":1646482801394,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482801394,"pkt":"PKn0qB\/spJGxgjQ5CABFgAA8tJQAAHkGLLAiYHtvwKgBgABQr5rfpgWE06zkUaAS\/\/9QBgAAAgQFlgQCCArcngeAprbAJQEDAwg="} +00580{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":385,"source":"sites.pcapng","alias":"nDPId-test","flow_id":24,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482802720,"flow_last_seen":1646482802720,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482802720,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"35.201.112.136","src_port":47122,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":385,"source":"sites.pcapng","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_last_seen":1646482802720,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482802720,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8g6pAAEAGYJjAqAGAI8lwiLgSAbvaEoGzAAAAAKAC+vAuRQAAAgQFtAQCCArAZPJXAAAAAAEDAwc="} +00482{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":386,"source":"sites.pcapng","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_last_seen":1646482802726,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482802726,"pkt":"PKn0qB\/spJGxgjQ5CABFgAA8b+kAAHkGetkjyXCIwKgBgAG7uBJNy0p52hKBtKAS\/\/9IWQAAAgQFlgQCCArHroD1wGTyVwEDAwg="} +01169{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":387,"source":"sites.pcapng","alias":"nDPId-test","flow_id":24,"flow_packet_id":3,"flow_last_seen":1646482802732,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482802732,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5g6xAAEAGXpnAqAGAI8lwiLgSAbvaEoG0TctKeoAYAfa\/ZwAAAQEICsBk8mLHroD1FgMBAgABAAH8AwM6s1cKgDvTG3LALyk7fAmvRJX9DNZN37XWMNl1\/SdHaCCUR56oKGM2UcODstsWkptKjiMgLAJPLuO56cI3NFuiCgAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAASABAAAA1rZXJ2ZS5sYXN0LmZtABcAAP8BAAEAAAoADgAMAB0AFwAYABkBAAEBAAsAAgEAACMAAAAQAA4ADAJoMghodHRwLzEuMQAFAAUBAAAAAAAiAAoACAQDBQMGAwIDADMAawBpAB0AIEXwFTh8NFdQPbVwjRz3qZyMML4Z+FJITLECgKzAH2YhABcAQQROHWQ9TZ\/FNyVoueylOLPpt31B2wF8YuKZg+41\/WG\/Ucaum9xuzZgJXugnVJqsHgtbN0plSfDPGhyRi1GNW\/CAACsABQQDBAMDAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAQAcAAJAAQAVAIkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00887{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":387,"source":"sites.pcapng","alias":"nDPId-test","flow_id":24,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482802720,"flow_last_seen":1646482802732,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482802732,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"35.201.112.136","src_port":47122,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.LastFM","breed":"Fun","category":"Music"},"tls": {"version":"TLSv1.2","client_requested_server_name":"kerve.last.fm","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00928{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":388,"source":"sites.pcapng","alias":"nDPId-test","flow_id":24,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482802720,"flow_last_seen":1646482802742,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1418,"flow_tot_l4_payload_len":1935,"flow_avg_l4_payload_len":483,"midstream":0,"thread_ts_msec":1646482802742,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"35.201.112.136","src_port":47122,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.LastFM","breed":"Fun","category":"Music"},"tls": {"version":"TLSv1.3","client_requested_server_name":"kerve.last.fm","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"eb1d94daa7e0344597e756a1fb6e7054","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00578{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":389,"source":"sites.pcapng","alias":"nDPId-test","flow_id":25,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482825245,"flow_last_seen":1646482825245,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482825245,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"69.191.252.15","src_port":39036,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":389,"source":"sites.pcapng","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_last_seen":1646482825245,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482825245,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8fBNAAEAGurHAqAGARb\/8D5h8AFDXP+M5AAAAAKAC+vDCpAAAAgQFtAQCCArIaWrDAAAAAAEDAwc="} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":390,"source":"sites.pcapng","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_last_seen":1646482826257,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482826257,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8fBRAAEAGurDAqAGARb\/8D5h8AFDXP+M5AAAAAKAC+vC+sAAAAgQFtAQCCArIaW63AAAAAAEDAwc="} +00482{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":391,"source":"sites.pcapng","alias":"nDPId-test","flow_id":25,"flow_packet_id":3,"flow_last_seen":1646482828277,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482828277,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8fBVAAEAGuq\/AqAGARb\/8D5h8AFDXP+M5AAAAAKAC+vC2zAAAAgQFtAQCCArIaXabAAAAAAEDAwc="} +00580{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":394,"source":"sites.pcapng","alias":"nDPId-test","flow_id":26,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482844787,"flow_last_seen":1646482844787,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482844787,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"151.101.193.73","src_port":43412,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":394,"source":"sites.pcapng","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_last_seen":1646482844787,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482844787,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8DedAAEAGEf7AqAGAl2XBSamUAbtMTKsLAAAAAKAC+vDPdgAAAgQFtAQCCApUsmtnAAAAAAEDAwc="} +00482{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":395,"source":"sites.pcapng","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_last_seen":1646482844795,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482844795,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADkGJuWXZcFJwKgBgAG7qZRSHsTXTEyrDKAS\/\/9OHAAAAgQFTAQCCAoo5zzDVLJrZwEDAwk="} +01168{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":396,"source":"sites.pcapng","alias":"nDPId-test","flow_id":26,"flow_packet_id":3,"flow_last_seen":1646482844798,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482844798,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5DelAAEAGD\/\/AqAGAl2XBSamUAbtMTKsMUh7E2IAYAfYA+gAAAQEIClSya3Io5zzDFgMBAgABAAH8AwORBDzSmJ5ztCo20SFZ11gW0AoQQ4sgaFZaA3Y+KP\/wXyDr7yv9lTOmWoS6i6wF3DRKGiQ0dwIiiuA6PbPxGRgIZwAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAWABQAABF3d3cuYmxvb21iZXJnLmNvbQAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAIgAKAAgEAwUDBgMCAwAzAGsAaQAdACDquIWld0x6v\/7S4zdZ49LOkRXJqmmpTXYEodSal6cCHwAXAEEEAIPYMeBzwG1ajydlfuoJM30LuOrUqddbx+YHyLZsEMUExIIuEeju0UTUsS5CFNGsqSGbD968lENk0xLpNURtmQArAAUEAwQDAwANABgAFgQDBQMGAwgECAUIBgQBBQEGAQIDAgEALQACAQEAHAACQAEAFQCFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00901{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":396,"source":"sites.pcapng","alias":"nDPId-test","flow_id":26,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482844787,"flow_last_seen":1646482844798,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482844798,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"151.101.193.73","src_port":43412,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Bloomberg","breed":"Acceptable","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.bloomberg.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00957{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":397,"source":"sites.pcapng","alias":"nDPId-test","flow_id":26,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482844787,"flow_last_seen":1646482844815,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1340,"flow_tot_l4_payload_len":1857,"flow_avg_l4_payload_len":464,"midstream":0,"thread_ts_msec":1646482844815,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"151.101.193.73","src_port":43412,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Bloomberg","breed":"Acceptable","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.bloomberg.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"16c0b3e6a7b8173c16d944cfeaeee9cf","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +01825{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":399,"source":"sites.pcapng","alias":"nDPId-test","flow_id":26,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1646482844787,"flow_last_seen":1646482844815,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1340,"flow_tot_l4_payload_len":4537,"flow_avg_l4_payload_len":756,"midstream":0,"thread_ts_msec":1646482844815,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"151.101.193.73","src_port":43412,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Bloomberg","breed":"Acceptable","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.bloomberg.com","server_names":"www.bloomberg.com,api.businessweek.com,api.bwbx.io,assets.bwbx.io,byzantium.bloomberg.com,cdn-mobapi.bloomberg.com,cdn-videos.bloomberg.com,cdn.gotraffic.net,charts.bloomberg.com,embeds.bloomberg.com,fastly.bloomberg.tv,feeds.bloomberg.com,fonts.gotraffic.net,staging-assets.bwbx.io,nav.bloomberg.com,sponsored.bloomberg.com,spotlight.bloomberg.com,tictoc.video,www.bbthat.com,www.bloomberg.co.jp,www.bloomberg.co.jp.shared.bloomberga.com,www.bloomberg.com.shared.bloomberga.com,www.bloombergview.com,www.citylab.com,www.citylab.com.shared.bloomberga.com,www.quicktake.video,www.tictoc.video,cdn-api.cmobile.bloomberg.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"16c0b3e6a7b8173c16d944cfeaeee9cf","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=DigiCert Inc, CN=DigiCert TLS RSA SHA256 2020 CA1","subjectDN":"C=US, ST=New York, L=New York, O=Bloomberg LP, CN=www.bloomberg.com","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"88:4A:85:34:1D:E6:C0:BE:5E:C6:14:BB:BA:94:A3:55:92:BA:95:82"}} +00581{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":403,"source":"sites.pcapng","alias":"nDPId-test","flow_id":27,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482845216,"flow_last_seen":1646482845216,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482845216,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"108.139.210.102","src_port":57014,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":403,"source":"sites.pcapng","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_last_seen":1646482845216,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482845216,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8ZOJAAEAG1L\/AqAGAbIvSZt62AbvYtDuvAAAAAKAC+vDuhAAAAgQFtAQCCAq3z7DKAAAAAAEDAwc="} +00483{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":404,"source":"sites.pcapng","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_last_seen":1646482845236,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482845236,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8MSYAAPgGkHtsi9JmwKgBgAG73rYdOl\/82LQ7sKAS\/\/9A+gAAAgQFoAQCCAoefQzKt8+wygEDAwg="} +01166{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":405,"source":"sites.pcapng","alias":"nDPId-test","flow_id":27,"flow_packet_id":3,"flow_last_seen":1646482845241,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482845241,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5ZORAAEAG0sDAqAGAbIvSZt62AbvYtDuwHTpf\/YAYAfbCEAAAAQEICrfPsOMefQzKFgMBAgABAAH8AwNDaq9+o2\/m1P9XaJsuL18rMu\/cbIc9LrPA5zUbsuvbziCdB7Y010YsAP9WvlmHthVAcmE9qTBtm04O9SpF9+K9iwAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAhAB8AABxzb3VyY2Vwb2ludGNtcC5ibG9vbWJlcmcuY29tABcAAP8BAAEAAAoADgAMAB0AFwAYABkBAAEBAAsAAgEAACMAAAAQAA4ADAJoMghodHRwLzEuMQAFAAUBAAAAAAAiAAoACAQDBQMGAwIDADMAawBpAB0AIFWzj0ex9WIWXeCl2qveVdo+cRB1gHroBn+mOFydyRUDABcAQQTZ7Kd3Dh15jhsRvRpWp2w5A6ZrOrpRgthYeTOHm9lBNbC7SyMy7sz4nAvG5eX8+75Yb0V9pFtY29+UzxdUbzEpACsABQQDBAMDAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAQAcAAJAAQAVAHoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00913{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":405,"source":"sites.pcapng","alias":"nDPId-test","flow_id":27,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482845216,"flow_last_seen":1646482845241,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482845241,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"108.139.210.102","src_port":57014,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Bloomberg","breed":"Acceptable","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"sourcepointcmp.bloomberg.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00954{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":406,"source":"sites.pcapng","alias":"nDPId-test","flow_id":27,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482845216,"flow_last_seen":1646482845260,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1428,"flow_tot_l4_payload_len":1945,"flow_avg_l4_payload_len":486,"midstream":0,"thread_ts_msec":1646482845260,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"108.139.210.102","src_port":57014,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Bloomberg","breed":"Acceptable","category":"Cloud"},"tls": {"version":"TLSv1.3","client_requested_server_name":"sourcepointcmp.bloomberg.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"f4febc55ea12b31ae17cfb7e614afda8","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00578{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":408,"source":"sites.pcapng","alias":"nDPId-test","flow_id":28,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482860064,"flow_last_seen":1646482860064,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482860064,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"13.107.42.14","src_port":48654,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":408,"source":"sites.pcapng","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_last_seen":1646482860064,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482860064,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8zthAAEAGckLAqAGADWsqDr4OAbv2xGogAAAAAKAC+vA6VgAAAgQFtAQCCArF2TKPAAAAAAEDAwc="} +00470{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":409,"source":"sites.pcapng","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_last_seen":1646482860089,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1646482860089,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA0KdNAAHUG4k8NayoOwKgBgAG7vg7o0cSg9sRqIYAS\/\/+nUAAAAgQFoAEDAwgBAQQC"} +01150{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":410,"source":"sites.pcapng","alias":"nDPId-test","flow_id":28,"flow_packet_id":3,"flow_last_seen":1646482860092,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"thread_ts_msec":1646482860092,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAItztpAAEAGcE\/AqAGADWsqDr4OAbv2xGoh6NHEoVAYAfY2twAAFgMBAgABAAH8AwN91wMalwKbnp34VhS8QvEFPozBOcSHhaFoSNBfPba3AiDXrrHLYmT\/nToyiJxYmouQzlobVBifJMUtdUWk4ZdOUAAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAVABMAABB3d3cubGlua2VkaW4uY29tABcAAP8BAAEAAAoADgAMAB0AFwAYABkBAAEBAAsAAgEAACMAAAAQAA4ADAJoMghodHRwLzEuMQAFAAUBAAAAAAAiAAoACAQDBQMGAwIDADMAawBpAB0AIOvcUoPBHSJ9xxKLt05ZOdwqxB4X188WUTuTKbETRNVIABcAQQSw33BhIovc8GgXm9sGLVvnRexF7f826PClnfuvUvruR3Sq4irZ9toHOp2agzdKIN0AwGPF8iqx1fv+O3\/0IjBNACsABQQDBAMDAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAQAcAAJAAQAVAIYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00898{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":410,"source":"sites.pcapng","alias":"nDPId-test","flow_id":28,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482860064,"flow_last_seen":1646482860092,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482860092,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"13.107.42.14","src_port":48654,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.LinkedIn","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.linkedin.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +01720{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":414,"source":"sites.pcapng","alias":"nDPId-test","flow_id":28,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":1646482860064,"flow_last_seen":1646482860115,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":4992,"flow_avg_l4_payload_len":713,"midstream":0,"thread_ts_msec":1646482860115,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"13.107.42.14","src_port":48654,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.LinkedIn","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.linkedin.com","server_names":"www.linkedin.com,linkedin.com,rum5.perf.linkedin.com,exp4.www.linkedin.com,exp3.www.linkedin.com,exp2.www.linkedin.com,exp1.www.linkedin.com,rum2.perf.linkedin.com,rum4.perf.linkedin.com,rum6.perf.linkedin.com,rum17.perf.linkedin.com,rum8.perf.linkedin.com,rum9.perf.linkedin.com,afd.perf.linkedin.com,rum14.perf.linkedin.com,rum18.perf.linkedin.com,rum19.perf.linkedin.com,exp5.www.linkedin.com,realtime.www.linkedin.com,px.ads.linkedin.com,px4.ads.linkedin.com,dc.ads.linkedin.com,lnkd.in,px.jobs.linkedin.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"a66ea560599a2f5c89eec8c3a0d69cee","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA","subjectDN":"C=US, ST=California, L=Sunnyvale, O=LinkedIn Corporation, CN=www.linkedin.com","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"CE:D8:A5:BE:BD:4B:EF:E9:22:C8:0D:55:A6:7A:A6:4A:B8:03:4A:53"}} +00579{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":417,"source":"sites.pcapng","alias":"nDPId-test","flow_id":29,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482866432,"flow_last_seen":1646482866432,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482866432,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"104.23.98.190","src_port":39934,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":417,"source":"sites.pcapng","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_last_seen":1646482866432,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482866432,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8sBtAAEAG\/aLAqAGAaBdivpv+AbuQtJSoAAAAAKAC+vAG0QAAAgQFtAQCCAoY1d1UAAAAAAEDAwc="} +00471{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":418,"source":"sites.pcapng","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_last_seen":1646482866449,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1646482866449,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA0AABAADkGtMZoF2K+wKgBgAG7m\/4hqZihkLSUqYAS\/\/9k2gAAAgQFeAEBBAIBAwMK"} +01152{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":419,"source":"sites.pcapng","alias":"nDPId-test","flow_id":29,"flow_packet_id":3,"flow_last_seen":1646482866451,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"thread_ts_msec":1646482866451,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAItsB1AAEAG+6\/AqAGAaBdivpv+AbuQtJSpIamYolAYAfYUJQAAFgMBAgABAAH8AwOkCw2THMGhALk0\/S0UPYY9Fiy1MMas0dLFjf2ObmEV3iD+CRapxYYnJ+AUET5SjxVSaJRJeT\/rvI5T4N1r2TpPLQAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAARAA8AAAxwYXN0ZWJpbi5jb20AFwAA\/wEAAQAACgAOAAwAHQAXABgAGQEAAQEACwACAQAAIwAAABAADgAMAmgyCGh0dHAvMS4xAAUABQEAAAAAACIACgAIBAMFAwYDAgMAMwBrAGkAHQAg+1dFx2JbQxGMLbjHxdWGfdupB63kQdiHTmuNhsrVgTQAFwBBBKdDPqMFSChZhRpkv1Y2JjoX2aNL5O59XM1C0oY6ZFf1Ifckam\/eVu5cuFoipFrAsWBrxGiWt6uHvmWbTHpfZoYAKwAFBAMEAwMADQAYABYEAwUDBgMIBAgFCAYEAQUBBgECAwIBAC0AAgEBABwAAkABABUAigAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +01027{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":419,"source":"sites.pcapng","alias":"nDPId-test","flow_id":29,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482866432,"flow_last_seen":1646482866451,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482866451,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"104.23.98.190","src_port":39934,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"TLS.Pastebin","breed":"Potentially Dangerous","category":"Download"},"tls": {"version":"TLSv1.2","client_requested_server_name":"pastebin.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +01068{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":420,"source":"sites.pcapng","alias":"nDPId-test","flow_id":29,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482866432,"flow_last_seen":1646482866473,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":1977,"flow_avg_l4_payload_len":494,"midstream":0,"thread_ts_msec":1646482866473,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"104.23.98.190","src_port":39934,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"TLS.Pastebin","breed":"Potentially Dangerous","category":"Download"},"tls": {"version":"TLSv1.3","client_requested_server_name":"pastebin.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"eb1d94daa7e0344597e756a1fb6e7054","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00577{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":421,"source":"sites.pcapng","alias":"nDPId-test","flow_id":30,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482879566,"flow_last_seen":1646482879566,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482879566,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"23.1.68.189","src_port":57336,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":421,"source":"sites.pcapng","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_last_seen":1646482879566,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482879566,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8ZJ5AAEAGuDfAqAGAFwFEvd\/4Abu+RY+DAAAAAKAC+vCgEQAAAgQFtAQCCAqibL0tAAAAAAEDAwc="} +00483{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":422,"source":"sites.pcapng","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_last_seen":1646482879585,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482879585,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADkGI9YXAUS9wKgBgAG73\/iES9VYvkWPhKAS\/ojG\/QAAAgQFtAQCCApEcjdUomy9LQEDAwc="} +01169{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":423,"source":"sites.pcapng","alias":"nDPId-test","flow_id":30,"flow_packet_id":3,"flow_last_seen":1646482879590,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482879590,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5ZKBAAEAGtjjAqAGAFwFEvd\/4Abu+RY+EhEvVWYAYAfb4UwAAAQEICqJsvUREcjdUFgMBAgABAAH8AwPTmj1yotJrCU5Axy8WSqX4RbWM\/SINHTcC+qIJwwqdWyAtxwR2GOpVXqzss+L4QuffJNllYoSRruXn4YOMT1n2UQAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAYABYAABN3d3cucGxheXN0YXRpb24uY29tABcAAP8BAAEAAAoADgAMAB0AFwAYABkBAAEBAAsAAgEAACMAAAAQAA4ADAJoMghodHRwLzEuMQAFAAUBAAAAAAAiAAoACAQDBQMGAwIDADMAawBpAB0AIO+m+y4kE\/Ul0wRfLnWkNqXDSHnFmA3tI1g\/5Tv\/EZwCABcAQQQh+3EFl7VEJWAHnTsK42aVbCexqYTb9DwqjdAN6Pu9IMJwjvRFdXg\/Y6aZYu3btbo89OdSMmSsifn4YkrISGSJACsABQQDBAMDAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAQAcAAJAAQAVAIMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00894{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":423,"source":"sites.pcapng","alias":"nDPId-test","flow_id":30,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482879566,"flow_last_seen":1646482879590,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482879590,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"23.1.68.189","src_port":57336,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Playstation","breed":"Fun","category":"Game"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.playstation.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00950{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":424,"source":"sites.pcapng","alias":"nDPId-test","flow_id":30,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482879566,"flow_last_seen":1646482879608,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646482879608,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"23.1.68.189","src_port":57336,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Playstation","breed":"Fun","category":"Game"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.playstation.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"19e4a55cecd087d9ebf88da03db13a0f","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +01282{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":426,"source":"sites.pcapng","alias":"nDPId-test","flow_id":30,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1646482879566,"flow_last_seen":1646482879608,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":4380,"flow_avg_l4_payload_len":730,"midstream":0,"thread_ts_msec":1646482879608,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"23.1.68.189","src_port":57336,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Playstation","breed":"Fun","category":"Game"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.playstation.com","server_names":"playstation.com,webforms.playstation.com,www.playstation.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"19e4a55cecd087d9ebf88da03db13a0f","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA","subjectDN":"C=US, ST=California, L=San Mateo, O=SONY INTERACTIVE ENTERTAINMENT LLC, CN=www.playstation.com","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"19:BC:48:84:B7:B0:91:46:45:D5:DD:3B:B5:8D:8E:45:E8:42:1A:8A"}} +00578{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":429,"source":"sites.pcapng","alias":"nDPId-test","flow_id":31,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482879964,"flow_last_seen":1646482879964,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482879964,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"23.51.246.65","src_port":46264,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":429,"source":"sites.pcapng","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_last_seen":1646482879964,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482879964,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8nmNAAEAGzLvAqAGAFzP2QbS4AbvcfW4jAAAAAKAC+vARXQAAAgQFtAQCCAo1KzXVAAAAAAEDAwc="} +00482{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":430,"source":"sites.pcapng","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_last_seen":1646482879981,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482879981,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADgGcx8XM\/ZBwKgBgAG7tLg0LEpK3H1uJKAS\/oiOFAAAAgQFtAQCCAqG0XpXNSs11QEDAwc="} +01163{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":431,"source":"sites.pcapng","alias":"nDPId-test","flow_id":31,"flow_packet_id":3,"flow_last_seen":1646482879983,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482879983,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5nmVAAEAGyrzAqAGAFzP2QbS4AbvcfW4kNCxKS4AYAfZhPwAAAQEICjUrNeiG0XpXFgMBAgABAAH8AwOVj3yfLLIdpS7ph9cCyv5vCYAGlSzvdrVr1N5tbcI94SDvfvqZxXeUOWdQ166wenjn8HB2CzcmnFG8kG7bSApHKAAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAbABkAABZzdGF0aWMucGxheXN0YXRpb24uY29tABcAAP8BAAEAAAoADgAMAB0AFwAYABkBAAEBAAsAAgEAACMAAAAQAA4ADAJoMghodHRwLzEuMQAFAAUBAAAAAAAiAAoACAQDBQMGAwIDADMAawBpAB0AID7op1onM6THMaho0vMOrhWIG6UTS6n8xwsrP6D1biscABcAQQR0Q9Knvll2eKORbkRyexBvYc7r+Q69FpqwjjnvO3KMU7d3ZPOw9jaGO1B0c9lo8UIHFSOSayE0o5gPreutfPv3ACsABQQDBAMDAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAQAcAAJAAQAVAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00898{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":431,"source":"sites.pcapng","alias":"nDPId-test","flow_id":31,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482879964,"flow_last_seen":1646482879983,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482879983,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"23.51.246.65","src_port":46264,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Playstation","breed":"Fun","category":"Game"},"tls": {"version":"TLSv1.2","client_requested_server_name":"static.playstation.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00939{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":432,"source":"sites.pcapng","alias":"nDPId-test","flow_id":31,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482879964,"flow_last_seen":1646482879998,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646482879998,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"23.51.246.65","src_port":46264,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Playstation","breed":"Fun","category":"Game"},"tls": {"version":"TLSv1.3","client_requested_server_name":"static.playstation.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00580{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":435,"source":"sites.pcapng","alias":"nDPId-test","flow_id":32,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482896911,"flow_last_seen":1646482896911,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482896911,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"108.138.199.67","src_port":43150,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":435,"source":"sites.pcapng","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_last_seen":1646482896911,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482896911,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8pPpAAEAGn8vAqAGAbIrHQ6iOAbuXn2EUAAAAAKAC+vCb0AAAAgQFtAQCCApW0sF4AAAAAAEDAwc="} +00482{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":436,"source":"sites.pcapng","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_last_seen":1646482896918,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482896918,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8E58AAPcGuiZsisdDwKgBgAG7qI5txRYul59hFaAS\/\/+2KgAAAgQFoAQCCAqPYc1DVtLBeAEDAwg="} +01163{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":437,"source":"sites.pcapng","alias":"nDPId-test","flow_id":32,"flow_packet_id":3,"flow_last_seen":1646482896921,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482896921,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5pPxAAEAGnczAqAGAbIrHQ6iOAbuXn2EVbcUWL4AYAfaXogAAAQEIClbSwYKPYc1DFgMBAgABAAH8AwNMrbkme+2pG6WKGaUcTfCs10ic95it0jPiimTr5KWaaiCmUwwyrZpDXgONpktntKRQJ28LAppHGUwuuBwH65AqlAAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAPAA0AAApkZWV6ZXIuY29tABcAAP8BAAEAAAoADgAMAB0AFwAYABkBAAEBAAsAAgEAACMAAAAQAA4ADAJoMghodHRwLzEuMQAFAAUBAAAAAAAiAAoACAQDBQMGAwIDADMAawBpAB0AIAS3iFI+Lml2aqbJ99HMOh2pxKpjuORM+VA6AJN2jS5cABcAQQS2OgHZ7hQeCCurKRe6Z6o4CXtv3DRVG4xO7HV8XVI+fMr+wQD4VFXUBMvHu9XDFEguxQ+LZymMWbInoPBoAAbBACsABQQDBAMDAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAQAcAAJAAQAVAIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00884{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":437,"source":"sites.pcapng","alias":"nDPId-test","flow_id":32,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482896911,"flow_last_seen":1646482896921,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482896921,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"108.138.199.67","src_port":43150,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Deezer","breed":"Fun","category":"Music"},"tls": {"version":"TLSv1.2","client_requested_server_name":"deezer.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00925{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":438,"source":"sites.pcapng","alias":"nDPId-test","flow_id":32,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482896911,"flow_last_seen":1646482896928,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1428,"flow_tot_l4_payload_len":1945,"flow_avg_l4_payload_len":486,"midstream":0,"thread_ts_msec":1646482896928,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"108.138.199.67","src_port":43150,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Deezer","breed":"Fun","category":"Music"},"tls": {"version":"TLSv1.3","client_requested_server_name":"deezer.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"f4febc55ea12b31ae17cfb7e614afda8","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00576{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":439,"source":"sites.pcapng","alias":"nDPId-test","flow_id":33,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482916232,"flow_last_seen":1646482916232,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482916232,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"18.65.82.67","src_port":52070,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":439,"source":"sites.pcapng","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_last_seen":1646482916232,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482916232,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8ooZAAEAGcYnAqAGAEkFSQ8tmAFAueWmfAAAAAKAC+vBogwAAAgQFtAQCCApZaACoAAAAAAEDAwc="} +00482{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":440,"source":"sites.pcapng","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_last_seen":1646482916249,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482916249,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8Lu8AAPcGbiASQVJDwKgBgABQy2YtbN9PLnlpoKAS\/\/+hEQAAAgQFoAQCCAqviQYeWWgAqAEDAwk="} +00581{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":441,"source":"sites.pcapng","alias":"nDPId-test","flow_id":34,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482940480,"flow_last_seen":1646482940480,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482940480,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.180.142","src_port":38858,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":441,"source":"sites.pcapng","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_last_seen":1646482940480,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482940480,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA806FAAEAGYWnAqAGAjvq0jpfKAbsw63pbAAAAAKAC+vDytAAAAgQFtAQCCAoU3PsAAAAAAAEDAwc="} +00482{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":442,"source":"sites.pcapng","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_last_seen":1646482940487,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482940487,"pkt":"PKn0qB\/spJGxgjQ5CABFgAA8FycAAHkGJGSO+rSOwKgBgAG7l8rhydulMOt6XKAS\/\/9c9AAAAgQFlgQCCAqRbEHhFNz7AAEDAwg="} +01167{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":443,"source":"sites.pcapng","alias":"nDPId-test","flow_id":34,"flow_packet_id":3,"flow_last_seen":1646482940491,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482940491,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI506NAAEAGX2rAqAGAjvq0jpfKAbsw63pc4cnbpoAYAfb+6AAAAQEIChTc+wqRbEHhFgMBAgABAAH8AwO7ribOnVQsY1sOMkcbEYXbLY3qPQQ51Elay7+WtVSrNSAVw+m3VKjUN5Kg0hk0Rcql0l9JhorDl+A6BcRaD2MOQwAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAUABIAAA9tYXBzLmdvb2dsZS5jb20AFwAA\/wEAAQAACgAOAAwAHQAXABgAGQEAAQEACwACAQAAIwAAABAADgAMAmgyCGh0dHAvMS4xAAUABQEAAAAAACIACgAIBAMFAwYDAgMAMwBrAGkAHQAgZi1V3KN\/7YwDfK8H3VIJ+hl8oG\/pcyHsJbGlMXjOc2MAFwBBBJu4yUB5A9M8e+22tNqv37PZXfAJovqkKxk\/cRDsm65QH7HDIBoXPUoAJy1c6x2wwBosAz8dzXVrLnN4Hqic9PsAKwAFBAMEAwMADQAYABYEAwUDBgMIBAgFCAYEAQUBBgECAwIBAC0AAgEBABwAAkABABUAhwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00893{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":443,"source":"sites.pcapng","alias":"nDPId-test","flow_id":34,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482940480,"flow_last_seen":1646482940491,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482940491,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.180.142","src_port":38858,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.GoogleMaps","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"maps.google.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00934{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":444,"source":"sites.pcapng","alias":"nDPId-test","flow_id":34,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482940480,"flow_last_seen":1646482940513,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1418,"flow_tot_l4_payload_len":1935,"flow_avg_l4_payload_len":483,"midstream":0,"thread_ts_msec":1646482940513,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.180.142","src_port":38858,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.GoogleMaps","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"maps.google.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"eb1d94daa7e0344597e756a1fb6e7054","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00577{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":445,"source":"sites.pcapng","alias":"nDPId-test","flow_id":35,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646482995689,"flow_last_seen":1646482995689,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646482995689,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"2.17.140.63","src_port":48902,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":445,"source":"sites.pcapng","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_last_seen":1646482995689,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482995689,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8enxAAEAGb8fAqAGAAhGMP78GAburV\/8MAAAAAKAC+vDqEgAAAgQFtAQCCArEqeKzAAAAAAEDAwc="} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":446,"source":"sites.pcapng","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_last_seen":1646482995709,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646482995709,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADgG8kMCEYw\/wKgBgAG7vwYhgnsXq1f\/DaAS\/ohOCgAAAgQFtAQCCAocht8\/xKniswEDAwc="} +01169{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":447,"source":"sites.pcapng","alias":"nDPId-test","flow_id":35,"flow_packet_id":3,"flow_last_seen":1646482995711,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646482995711,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5en5AAEAGbcjAqAGAAhGMP78GAburV\/8NIYJ7GIAYAfY3gAAAAQEICsSp4socht8\/FgMBAgABAAH8AwNFE1YF0dNQQhTDT2LTts3l72ip1ON6WYuBYFjp45zAOSCfsggN3rEBQ1caacueVCEG9V0G2r03kBuc\/FQ9ILx8tQAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAVABMAABBhY2NvdW50Lnhib3guY29tABcAAP8BAAEAAAoADgAMAB0AFwAYABkBAAEBAAsAAgEAACMAAAAQAA4ADAJoMghodHRwLzEuMQAFAAUBAAAAAAAiAAoACAQDBQMGAwIDADMAawBpAB0AIKOdg7M8WplrJ1dHmYhafGTWEV65\/XHCmgpJRZB9OyhxABcAQQSUMlyZp7X5PylQs43MbEemG5LZD4aMK86EfSyduzhW1kr6wtZBIJI7MJb\/MCOqF0\/ebXOaYXIP5autWsClQmu8ACsABQQDBAMDAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAQAcAAJAAQAVAIYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00884{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":447,"source":"sites.pcapng","alias":"nDPId-test","flow_id":35,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646482995689,"flow_last_seen":1646482995711,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646482995711,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"2.17.140.63","src_port":48902,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Xbox","breed":"Fun","category":"Game"},"tls": {"version":"TLSv1.2","client_requested_server_name":"account.xbox.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00925{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":448,"source":"sites.pcapng","alias":"nDPId-test","flow_id":35,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646482995689,"flow_last_seen":1646482995732,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646482995732,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"2.17.140.63","src_port":48902,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Xbox","breed":"Fun","category":"Game"},"tls": {"version":"TLSv1.3","client_requested_server_name":"account.xbox.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00577{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":449,"source":"sites.pcapng","alias":"nDPId-test","flow_id":36,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646483012464,"flow_last_seen":1646483012464,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646483012464,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"40.97.160.2","src_port":39828,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":449,"source":"sites.pcapng","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_last_seen":1646483012464,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646483012464,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8NmFAAEAGec\/AqAGAKGGgApuUAbvrsR4tAAAAAKAC+vCXKwAAAgQFtAQCCAqLefivAAAAAAEDAwc="} +00470{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":450,"source":"sites.pcapng","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_last_seen":1646483012642,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1646483012642,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA0h61AAOYGgoooYaACwKgBgAG7m5Tksd5d67EeLoAS\/\/96NQAAAgQFtAEDAwgBAQQC"} +01149{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":451,"source":"sites.pcapng","alias":"nDPId-test","flow_id":36,"flow_packet_id":3,"flow_last_seen":1646483012643,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"thread_ts_msec":1646483012643,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAItNmNAAEAGd9zAqAGAKGGgApuUAbvrsR4u5LHeXlAYAfZhOgAAFgMBAgABAAH8AwO1u+oefRTEOwSLQjLjHhVV0xmNEBLIePou\/aAHVOd2CCAPyrTST2MnYmbxM2VIZnvQo7xJWWszq6XT0HB3y7IoMAAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAQAA4AAAtvdXRsb29rLmNvbQAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAIgAKAAgEAwUDBgMCAwAzAGsAaQAdACBWvkXIQj27ydSlWNcrtPVAAtDjckdSwzserfJQbjqaWAAXAEEEmLcB97hFECojXeQm9a5elnWgKYRExdFmjiW10ZfBGP+icRnFpjaWBz97zhMeOCLZ79LJYWeVZvs9jOUTVoTTCAArAAUEAwQDAwANABgAFgQDBQMGAwgECAUIBgQBBQEGAQIDAgEALQACAQEAHAACQAEAFQCLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00890{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":451,"source":"sites.pcapng","alias":"nDPId-test","flow_id":36,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646483012464,"flow_last_seen":1646483012643,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646483012643,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"40.97.160.2","src_port":39828,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Outlook","breed":"Acceptable","category":"Email"},"tls": {"version":"TLSv1.2","client_requested_server_name":"outlook.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +01697{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":455,"source":"sites.pcapng","alias":"nDPId-test","flow_id":36,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":1646483012464,"flow_last_seen":1646483012821,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":4952,"flow_avg_l4_payload_len":707,"midstream":0,"thread_ts_msec":1646483012821,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"40.97.160.2","src_port":39828,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Microsoft365","breed":"Acceptable","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"outlook.com","server_names":"*.internal.outlook.com,*.outlook.com,outlook.com,office365.com,*.office365.com,*.outlook.office365.com,*.office.com,outlook.office.com,substrate.office.com,attachment.outlook.live.net,attachment.outlook.office.net,attachment.outlook.officeppe.net,attachments.office.net,*.clo.footprintdns.com,*.nrb.footprintdns.com,ccs.login.microsoftonline.com,ccs-sdf.login.microsoftonline.com,substrate-sdf.office.com,attachments-sdf.office.net,*.live.com,mail.services.live.com,hotmail.com,*.hotmail.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"71d9ce75f347e6cf54268d7114ae6925","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1","subjectDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"4E:39:B4:13:4B:8C:77:57:7D:80:3D:76:40:E8:88:22:05:00:1C:58"}} +00561{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":458,"source":"sites.pcapng","alias":"nDPId-test","packets-captured":458,"packets-processed":457,"total-skipped-flows":0,"total-l4-data-len":197833,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":32,"total-detection-updates":38,"total-updates":0,"current-active-flows":27,"total-active-flows":36,"total-idle-flows":9,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":230,"global_ts_msec":1646495488872} +00579{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":458,"source":"sites.pcapng","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646495488872,"flow_last_seen":1646495488872,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495488872,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"15.160.39.187","src_port":45898,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00482{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":458,"source":"sites.pcapng","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_last_seen":1646495488872,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646495488872,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8\/MhAAEAGRHDAqAGAD6Anu7NKAbvmP22QAAAAAKAC+vBpUQAAAgQFtAQCCAoE\/txmAAAAAAEDAwc="} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":459,"source":"sites.pcapng","alias":"nDPId-test","flow_id":37,"flow_packet_id":2,"flow_last_seen":1646495488880,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646495488880,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8AABAADIGTzkPoCe7wKgBgAG7s0optQbo5j9tkaAS9LPzBQAAAgQFtAQCCAoEQEeaBP7cZgEDAwc="} +01169{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":460,"source":"sites.pcapng","alias":"nDPId-test","flow_id":37,"flow_packet_id":3,"flow_last_seen":1646495488882,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646495488882,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5\/MpAAEAGQnHAqAGAD6Anu7NKAbvmP22RKbUG6YAYAfaZtgAAAQEICgT+3HEEQEeaFgMBAgABAAH8AwO25geT89HZVQIHdAvPqVcdroWBp1YfQbaMJ\/IT9jA01iAQ9v2Qg1QtgoSL\/wrZgtn2pCmqUafGB71JcGJ1a5vPpQAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAWABQAABFndXp6b25pLmFwcGxlLmNvbQAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAIgAKAAgEAwUDBgMCAwAzAGsAaQAdACAfoSMbRE149N9PW6YpT\/B1gLVQ\/izORnimYk5vzkOPIwAXAEEEYgA3US97mm0LBVaj+yl1ih4nt3Ma4wqV+qwTQtcgUnIu95ynuvYl8aODuWCNRrQ8KDDItT25yW1YelOufG9kvAArAAUEAwQDAwANABgAFgQDBQMGAwgECAUIBgQBBQEGAQIDAgEALQACAQEAHAACQAEAFQCFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00908{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":460,"source":"sites.pcapng","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646495488872,"flow_last_seen":1646495488882,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646495488882,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"15.160.39.187","src_port":45898,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.AppleSiri","breed":"Acceptable","category":"VirtAssistant"},"tls": {"version":"TLSv1.2","client_requested_server_name":"guzzoni.apple.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00949{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":461,"source":"sites.pcapng","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646495488872,"flow_last_seen":1646495488890,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"15.160.39.187","src_port":45898,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.AppleSiri","breed":"Acceptable","category":"VirtAssistant"},"tls": {"version":"TLSv1.3","client_requested_server_name":"guzzoni.apple.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"eb1d94daa7e0344597e756a1fb6e7054","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00685{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":22,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482791144,"flow_last_seen":1646482791191,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"95.101.195.214","src_port":51432,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Hulu","breed":"Fun","category":"Streaming"}} +00665{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":23,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1646482801387,"flow_last_seen":1646482801394,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"34.96.123.111","src_port":44954,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"2":"Match by IP"},"proto":"HTTP.GoogleCloud","breed":"Acceptable","category":"Cloud"},"http": {}} +00579{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":23,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1646482801387,"flow_last_seen":1646482801394,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"34.96.123.111","src_port":44954,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00665{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":25,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":1646482825245,"flow_last_seen":1646482890325,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"69.191.252.15","src_port":39036,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"2":"Match by IP"},"proto":"HTTP.Bloomberg","breed":"Acceptable","category":"Network"},"http": {}} +00579{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":25,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":1646482825245,"flow_last_seen":1646482890325,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"69.191.252.15","src_port":39036,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00689{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":10,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482623895,"flow_last_seen":1646482623982,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1380,"flow_tot_l4_payload_len":1897,"flow_avg_l4_payload_len":474,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"31.222.67.112","src_port":35054,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Badoo","breed":"Fun","category":"SocialNetwork"}} +00693{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":26,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":1646482844787,"flow_last_seen":1646482844825,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1340,"flow_tot_l4_payload_len":5346,"flow_avg_l4_payload_len":594,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"151.101.193.73","src_port":43412,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Bloomberg","breed":"Acceptable","category":"Cloud"}} +00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":12,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":1646482646628,"flow_last_seen":1646482646693,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":5845,"flow_avg_l4_payload_len":649,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"2.17.141.128","src_port":42580,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Activision","breed":"Fun","category":"Game"}} +00682{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":13,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482659915,"flow_last_seen":1646482659961,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1340,"flow_tot_l4_payload_len":1857,"flow_avg_l4_payload_len":464,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"146.75.62.167","src_port":46084,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Twitch","breed":"Fun","category":"Video"}} +00685{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":31,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482879964,"flow_last_seen":1646482879998,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"23.51.246.65","src_port":46264,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Playstation","breed":"Fun","category":"Game"}} +00653{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":14,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1646482686914,"flow_last_seen":1646482687080,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"208.85.40.158","src_port":45936,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"1":"Match by port"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00579{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":14,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1646482686914,"flow_last_seen":1646482687080,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"208.85.40.158","src_port":45936,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00677{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":35,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482995689,"flow_last_seen":1646482995732,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"2.17.140.63","src_port":48902,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Xbox","breed":"Fun","category":"Game"}} +00682{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":18,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482759960,"flow_last_seen":1646482760002,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"2.17.141.49","src_port":40832,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.eBay","breed":"Safe","category":"Shopping"}} +00684{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":30,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":1646482879566,"flow_last_seen":1646482879632,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":4764,"flow_avg_l4_payload_len":595,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"23.1.68.189","src_port":57336,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Playstation","breed":"Fun","category":"Game"}} +00691{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":28,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":1646482860064,"flow_last_seen":1646482860150,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":5476,"flow_avg_l4_payload_len":608,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"13.107.42.14","src_port":48654,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.LinkedIn","breed":"Fun","category":"SocialNetwork"}} +00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":24,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482802720,"flow_last_seen":1646482802742,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1418,"flow_tot_l4_payload_len":1935,"flow_avg_l4_payload_len":483,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"35.201.112.136","src_port":47122,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.LastFM","breed":"Fun","category":"Music"}} +00694{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":27,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482845216,"flow_last_seen":1646482845260,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1428,"flow_tot_l4_payload_len":1945,"flow_avg_l4_payload_len":486,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"108.139.210.102","src_port":57014,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Bloomberg","breed":"Acceptable","category":"Cloud"}} +00681{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":16,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":1646482734324,"flow_last_seen":1646482734359,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1340,"flow_tot_l4_payload_len":4476,"flow_avg_l4_payload_len":559,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"151.101.192.92","src_port":56468,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Vevo","breed":"Fun","category":"Music"}} +00687{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":34,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482940480,"flow_last_seen":1646482940513,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1418,"flow_tot_l4_payload_len":1935,"flow_avg_l4_payload_len":483,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.180.142","src_port":38858,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.GoogleMaps","breed":"Safe","category":"Web"}} +00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":32,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482896911,"flow_last_seen":1646482896928,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1428,"flow_tot_l4_payload_len":1945,"flow_avg_l4_payload_len":486,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"108.138.199.67","src_port":43150,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Deezer","breed":"Fun","category":"Music"}} +00661{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":33,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1646482916232,"flow_last_seen":1646482916249,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"18.65.82.67","src_port":52070,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"2":"Match by IP"},"proto":"HTTP.AmazonAWS","breed":"Acceptable","category":"Cloud"},"http": {}} +00577{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":33,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1646482916232,"flow_last_seen":1646482916249,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"18.65.82.67","src_port":52070,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00824{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":29,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482866432,"flow_last_seen":1646482866473,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":1977,"flow_avg_l4_payload_len":494,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"104.23.98.190","src_port":39934,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"TLS.Pastebin","breed":"Potentially Dangerous","category":"Download"}} +00688{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":20,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":1646482785304,"flow_last_seen":1646482785442,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":4008,"flow_avg_l4_payload_len":501,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"95.131.169.91","src_port":51248,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Tuenti","breed":"Acceptable","category":"VoIP"}} +00686{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":15,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482724450,"flow_last_seen":1646482724472,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1428,"flow_tot_l4_payload_len":1945,"flow_avg_l4_payload_len":486,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"18.66.196.102","src_port":51806,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.SoundCloud","breed":"Fun","category":"Music"}} +00690{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":11,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482634412,"flow_last_seen":1646482634459,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":1977,"flow_avg_l4_payload_len":494,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"172.65.251.78","src_port":53998,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.GitLab","breed":"Fun","category":"Collaborative"}} +00701{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":36,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":1646483012464,"flow_last_seen":1646483013011,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":5436,"flow_avg_l4_payload_len":604,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"40.97.160.2","src_port":39828,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Microsoft365","breed":"Acceptable","category":"Collaborative"}} +00688{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":21,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":1646482786097,"flow_last_seen":1646482786234,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":4008,"flow_avg_l4_payload_len":501,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"95.131.170.91","src_port":39302,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Tuenti","breed":"Acceptable","category":"VoIP"}} +00675{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":17,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482753482,"flow_last_seen":1646482753526,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"23.1.66.79","src_port":48140,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.CNN","breed":"Safe","category":"Web"}} +00693{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":19,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646482772264,"flow_last_seen":1646482772325,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646495488890,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"185.125.190.21","src_port":42884,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.UbuntuONE","breed":"Acceptable","category":"Cloud"}} +00580{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":38,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646495650748,"flow_last_seen":1646495650748,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495650748,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"52.113.194.132","src_port":57878,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":462,"source":"sites.pcapng","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_last_seen":1646495650748,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646495650748,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8GIFAAEAGaR3AqAGANHHChOIWAbvSHIRRAAAAAKAC+vCUIQAAAgQFtAQCCApnoF3vAAAAAAEDAwc="} +00471{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":463,"source":"sites.pcapng","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_last_seen":1646495650768,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1646495650768,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA0H0NAAHQGLmM0ccKEwKgBgAG74hatJvO00hyEUoAS\/\/\/a2QAAAgQFoAEDAwgBAQQC"} +01153{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":464,"source":"sites.pcapng","alias":"nDPId-test","flow_id":38,"flow_packet_id":3,"flow_last_seen":1646495650768,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"thread_ts_msec":1646495650768,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAItGINAAEAGZyrAqAGANHHChOIWAbvSHIRSrSbztVAYAfbGZQAAFgMBAgABAAH8AwO6eoC9IxGTkdV9vVeJGWk4znzi7kZuVq2WW+Nl\/2Sg0SCU+jy21h8ySE7r\/PfMeW\/+6AejiqSkX1JQLDj\/qy1dewAgSkoTARMCEwPAK8AvwCzAMMypzKjAE8AUAJwAnQAvADUBAAGTCgoAAAAAABUAEwAAEHRlYW1zLm9mZmljZS5jb20AFwAA\/wEAAQAACgAKAAjKygAdABcAGAALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAADQASABAEAwgEBAEFAwgFBQEIBgYBABIAAAAzACsAKcrKAAEAAB0AIP361tTnT+5yNMG5uzlpGoadVy4F1\/ksgWxYfkq0hvgPAC0AAgEBACsABwYaGgMEAwMAGwADAgACRGkABQADAmgyWloAAQAAFQDHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00905{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":464,"source":"sites.pcapng","alias":"nDPId-test","flow_id":38,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646495650748,"flow_last_seen":1646495650768,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646495650768,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"52.113.194.132","src_port":57878,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"teams.office.com","ja3":"cd08e31494f9531f560d64c695473da9","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2"}} +01176{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":467,"source":"sites.pcapng","alias":"nDPId-test","flow_id":38,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1646495650748,"flow_last_seen":1646495650804,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":4443,"flow_avg_l4_payload_len":740,"midstream":0,"thread_ts_msec":1646495650804,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"52.113.194.132","src_port":57878,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"teams.office.com","server_names":"teams.office.com","ja3":"cd08e31494f9531f560d64c695473da9","ja3s":"104071bf77c5f0d7bae5f17542ba9428","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01","subjectDN":"CN=teams.office.com","alpn":"h2,http\/1.1","tls_supported_versions":"GREASE,TLSv1.3,TLSv1.2","fingerprint":"27:20:65:85:4C:34:BF:09:F0:25:56:B8:50:A7:4D:38:8C:45:82:80"}} +00581{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":470,"source":"sites.pcapng","alias":"nDPId-test","flow_id":39,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646495669804,"flow_last_seen":1646495669804,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495669804,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"108.138.185.106","src_port":33664,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":470,"source":"sites.pcapng","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_last_seen":1646495669804,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646495669804,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8GxZAAEAGN4nAqAGAbIq5aoOAAbvmWe+jAAAAAKAC+vCvxQAAAgQFtAQCCAqEU9WfAAAAAAEDAwc="} +00483{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":471,"source":"sites.pcapng","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_last_seen":1646495669812,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646495669812,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8yYIAAPcGEhxsirlqwKgBgAG7g4CERzW35lnvpKAS\/\/\/nPAAAAgQFoAQCCArIqUDThFPVnwEDAwg="} +01164{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":472,"source":"sites.pcapng","alias":"nDPId-test","flow_id":39,"flow_packet_id":3,"flow_last_seen":1646495669817,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646495669817,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5GxhAAEAGNYrAqAGAbIq5aoOAAbvmWe+khEc1uIAYAfZdLwAAAQEICoRT1avIqUDTFgMBAgABAAH8AwN96ffJWUDTazcjPKRqPmlOCDA7EP6e0q+5Knlqzgn4siDXwLeA2RnsV46x7ZH7OaLw+Chjc3EP4ZBJc+xWJC0l1wAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAXABUAABJ3d3cucHJpbWV2aWRlby5jb20AFwAA\/wEAAQAACgAOAAwAHQAXABgAGQEAAQEACwACAQAAIwAAABAADgAMAmgyCGh0dHAvMS4xAAUABQEAAAAAACIACgAIBAMFAwYDAgMAMwBrAGkAHQAgGExhTuOW51jqeKeMnZIkirN5TNVDUu2atdTJKyWyDBgAFwBBBNa6zHPDKyGGZ8TLrmG8xe75hAb+vBq5zYOy2EFwzMFPukEZchYJ5onOljVZmDEEihxmPvbweI2eyfjNpyF4jCAAKwAFBAMEAwMADQAYABYEAwUDBgMIBAgFCAYEAQUBBgECAwIBAC0AAgEBABwAAkABABUAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00905{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":472,"source":"sites.pcapng","alias":"nDPId-test","flow_id":39,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646495669804,"flow_last_seen":1646495669817,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646495669817,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"108.138.185.106","src_port":33664,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.AmazonVideo","breed":"Acceptable","category":"Video"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.primevideo.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00946{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":473,"source":"sites.pcapng","alias":"nDPId-test","flow_id":39,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646495669804,"flow_last_seen":1646495669824,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1428,"flow_tot_l4_payload_len":1945,"flow_avg_l4_payload_len":486,"midstream":0,"thread_ts_msec":1646495669824,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"108.138.185.106","src_port":33664,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.AmazonVideo","breed":"Acceptable","category":"Video"},"tls": {"version":"TLSv1.3","client_requested_server_name":"www.primevideo.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"f4febc55ea12b31ae17cfb7e614afda8","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00581{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":474,"source":"sites.pcapng","alias":"nDPId-test","flow_id":40,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646495697787,"flow_last_seen":1646495697787,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495697787,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.185.142","src_port":56458,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":474,"source":"sites.pcapng","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_last_seen":1646495697787,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646495697787,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8TvVAAEAG4RXAqAGAjvq5jtyKAbuisGnHAAAAAKAC+vDU+wAAAgQFtAQCCAq56si5AAAAAAEDAwc="} +00483{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":475,"source":"sites.pcapng","alias":"nDPId-test","flow_id":40,"flow_packet_id":2,"flow_last_seen":1646495697803,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646495697803,"pkt":"PKn0qB\/spJGxgjQ5CABFgAA8kPwAAHIGrI6O+rmOwKgBgAG73IpV9E4KorBpyKAS\/\/903wAAAgQFlgQCCAoX\/J8euerIuQEDAwg="} +01168{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":476,"source":"sites.pcapng","alias":"nDPId-test","flow_id":40,"flow_packet_id":3,"flow_last_seen":1646495697805,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646495697805,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5TvdAAEAG3xbAqAGAjvq5jtyKAbuisGnIVfROC4AYAfb\/+QAAAQEICrnqyMsX\/J8eFgMBAgABAAH8AwMm2R5Ju93q7BO1hUBCbI67+PD2u7\/isSvjCgLKpqok\/yCAWXfAe1hCLkH2e7v9afeyqpqQSwrsncirtbeBJ9H19AAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAVABMAABBkcml2ZS5nb29nbGUuY29tABcAAP8BAAEAAAoADgAMAB0AFwAYABkBAAEBAAsAAgEAACMAAAAQAA4ADAJoMghodHRwLzEuMQAFAAUBAAAAAAAiAAoACAQDBQMGAwIDADMAawBpAB0AIN3ozE7d4X5ID5WvLeFvcVfA+y6MygI54w6MzPaYwOcyABcAQQTFpbayzL1z3QPN8cTTIDg5o4CXfe8\/xuT5UCf9QOlCuSljPogKq5ahl7f7neEgUhdrgF5Z8PWW8a+71cG5NS4HACsABQQDBAMDAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAQAcAAJAAQAVAIYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00903{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":476,"source":"sites.pcapng","alias":"nDPId-test","flow_id":40,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646495697787,"flow_last_seen":1646495697805,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646495697805,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.185.142","src_port":56458,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.GoogleDrive","breed":"Acceptable","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"drive.google.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00944{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":477,"source":"sites.pcapng","alias":"nDPId-test","flow_id":40,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646495697787,"flow_last_seen":1646495697827,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1418,"flow_tot_l4_payload_len":1935,"flow_avg_l4_payload_len":483,"midstream":0,"thread_ts_msec":1646495697827,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.185.142","src_port":56458,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.GoogleDrive","breed":"Acceptable","category":"Cloud"},"tls": {"version":"TLSv1.3","client_requested_server_name":"drive.google.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"eb1d94daa7e0344597e756a1fb6e7054","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00578{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":478,"source":"sites.pcapng","alias":"nDPId-test","flow_id":41,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646495710343,"flow_last_seen":1646495710343,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495710343,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"13.81.118.91","src_port":33102,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":478,"source":"sites.pcapng","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_last_seen":1646495710343,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646495710343,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8tchAAEAGPx\/AqAGADVF2W4FOAbtTwyfkAAAAAKAC+vBryAAAAgQFtAQCCAom4HXhAAAAAAEDAwc="} +00471{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":479,"source":"sites.pcapng","alias":"nDPId-test","flow_id":41,"flow_packet_id":2,"flow_last_seen":1646495710376,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1646495710376,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA0mxFAAG4GK94NUXZbwKgBgAG7gU7a1m2vU8Mn5YAS\/\/\/iBwAAAgQFoAEDAwgBAQQC"} +01150{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":480,"source":"sites.pcapng","alias":"nDPId-test","flow_id":41,"flow_packet_id":3,"flow_last_seen":1646495710381,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"thread_ts_msec":1646495710381,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAIttcpAAEAGPSzAqAGADVF2W4FOAbtTwyfl2tZtsFAYAfZlCgAAFgMBAgABAAH8AwMcPgJU1zrnl+hPKuEgTOmCA8DSxG0x4ZP+nrnS1ukwmSB2tLYK4RsCmYHQ+tv7RzCytXVHC3ipih0buXJEGgMzzAAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAARAA8AAAxvbmVkcml2ZS5jb20AFwAA\/wEAAQAACgAOAAwAHQAXABgAGQEAAQEACwACAQAAIwAAABAADgAMAmgyCGh0dHAvMS4xAAUABQEAAAAAACIACgAIBAMFAwYDAgMAMwBrAGkAHQAgkhEItWzjEiug\/WBaiPCJVLwOMCFSobcq6gZ3ZM5d7hUAFwBBBKUDUTjCPdZ8Ll1S+z857hqnZsJZ3Vatea3adXIfU3XxBdTrso0nY7PLm8teDMagz\/bdRE3yXoqXxIphrdW4ROsAKwAFBAMEAwMADQAYABYEAwUDBgMIBAgFCAYEAQUBBgECAwIBAC0AAgEBABwAAkABABUAigAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00890{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":480,"source":"sites.pcapng","alias":"nDPId-test","flow_id":41,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646495710343,"flow_last_seen":1646495710381,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646495710381,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"13.81.118.91","src_port":33102,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Azure","breed":"Acceptable","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"onedrive.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +01315{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":484,"source":"sites.pcapng","alias":"nDPId-test","flow_id":41,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":1646495710343,"flow_last_seen":1646495710415,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":6356,"flow_avg_l4_payload_len":908,"midstream":0,"thread_ts_msec":1646495710415,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"13.81.118.91","src_port":33102,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"onedrive.com","server_names":"onedrive.com,p.sfx.ms,*.live.com,*.live.net,*.skydrive.live.com,*.onedrive.live.com,*.onedrive.com,d.sfx-df.ms,*.odwebb.svc.ms,*.odwebp.svc.ms,*.odwebdf.svc.ms,*.odwebpl.svc.ms","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"67bfe5d15ae567fb35fd7837f0116eec","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01","subjectDN":"CN=onedrive.com","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"50:2F:33:10:92:AC:27:7B:17:BE:82:68:3B:E2:29:AD:97:41:B7:BB"}} +00578{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":487,"source":"sites.pcapng","alias":"nDPId-test","flow_id":42,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646495710534,"flow_last_seen":1646495710534,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495710534,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"13.107.42.13","src_port":56836,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":487,"source":"sites.pcapng","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_last_seen":1646495710534,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646495710534,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8CqVAAEAGNnfAqAGADWsqDd4EAbvOscftAAAAAKAC+vD21AAAAgQFtAQCCArXIg8YAAAAAAEDAwc="} +00470{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":488,"source":"sites.pcapng","alias":"nDPId-test","flow_id":42,"flow_packet_id":2,"flow_last_seen":1646495710555,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1646495710555,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA0VKNAAHUGt4ANayoNwKgBgAG73gT+RZAmzrHH7oAS\/\/9wpwAAAgQFoAEDAwgBAQQC"} +01151{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":489,"source":"sites.pcapng","alias":"nDPId-test","flow_id":42,"flow_packet_id":3,"flow_last_seen":1646495710557,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"thread_ts_msec":1646495710557,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAItCqdAAEAGNITAqAGADWsqDd4EAbvOscfu\/kWQJ1AYAfaM8QAAFgMBAgABAAH8AwNoOd\/HU8dseMv53a0gjDg57feHmv3ZKYt3PSUCEOAz7yDC+9qh9Lsnn2pjQO0NmdEK9+51DwzlDpkQTXJ0hGSXhgAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAWABQAABFvbmVkcml2ZS5saXZlLmNvbQAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAIgAKAAgEAwUDBgMCAwAzAGsAaQAdACAI7FYCMeLngdMxbkPLy3IoQelSFCsyCvetq1oFf6z+UQAXAEEEWlI8xcTn+Mao6N7i2Le6X1KJI9pYZKIE\/2dqJMzsIrHC0C7HZlpYDP5BCM3Qrb983QL8azL17uscE+MtJARpvAArAAUEAwQDAwANABgAFgQDBQMGAwgECAUIBgQBBQEGAQIDAgEALQACAQEAHAACQAEAFQCFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00901{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":489,"source":"sites.pcapng","alias":"nDPId-test","flow_id":42,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646495710534,"flow_last_seen":1646495710557,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646495710557,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"13.107.42.13","src_port":56836,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.MS_OneDrive","breed":"Acceptable","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"onedrive.live.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +01328{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":494,"source":"sites.pcapng","alias":"nDPId-test","flow_id":42,"flow_state":"info","flow_packets_processed":8,"flow_first_seen":1646495710534,"flow_last_seen":1646495710577,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":6361,"flow_avg_l4_payload_len":795,"midstream":0,"thread_ts_msec":1646495710577,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"13.107.42.13","src_port":56836,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.MS_OneDrive","breed":"Acceptable","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"onedrive.live.com","server_names":"onedrive.com,p.sfx.ms,*.live.com,*.live.net,*.skydrive.live.com,*.onedrive.live.com,*.onedrive.com,d.sfx-df.ms,*.odwebb.svc.ms,*.odwebp.svc.ms,*.odwebdf.svc.ms,*.odwebpl.svc.ms","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"a66ea560599a2f5c89eec8c3a0d69cee","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02","subjectDN":"CN=onedrive.com","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"77:7F:F2:95:29:A7:E3:CC:0F:BF:2F:BA:2E:6F:2A:38:62:8B:48:4D"}} +00581{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":497,"source":"sites.pcapng","alias":"nDPId-test","flow_id":43,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646495749875,"flow_last_seen":1646495749875,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495749875,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"129.226.107.210","src_port":45014,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00481{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":497,"source":"sites.pcapng","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_last_seen":1646495749875,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646495749875,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8bgJAAEAGHN3AqAGAgeJr0q\/WAbvpKcA1AAAAAKAC+vDq5gAAAgQFtAQCCAoyACVaAAAAAAEDAwc="} +00468{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":498,"source":"sites.pcapng","alias":"nDPId-test","flow_id":43,"flow_packet_id":2,"flow_last_seen":1646495750196,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1646495750196,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA0AABAAC8Gm+eB4mvSwKgBgAG7r9bNFCqu6SnANoASOQgzewAAAgQFoAEBBAIBAwMH"} +01153{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":499,"source":"sites.pcapng","alias":"nDPId-test","flow_id":43,"flow_packet_id":3,"flow_last_seen":1646495750202,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"thread_ts_msec":1646495750202,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAItbgRAAEAGGurAqAGAgeJr0q\/WAbvpKcA2zRQqr1AYAfYZ+QAAFgMBAgABAAH8AwMSMXO4WcNq177CYxST5Cayi57AGXeQdEMNPed0f\/vO+CBsnRDIIeROJeOlCByvk7lr9pRUbeR06Cs4dVzQT0oYEAAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAASABAAAA13d3cuaWZsaXguY29tABcAAP8BAAEAAAoADgAMAB0AFwAYABkBAAEBAAsAAgEAACMAAAAQAA4ADAJoMghodHRwLzEuMQAFAAUBAAAAAAAiAAoACAQDBQMGAwIDADMAawBpAB0AIOmUL4m7jSQuaHGCv6++\/yOU0VJCaPyexIMcIsguXG5nABcAQQTHBHql0\/iCD7AqH7jE0qyA2MF\/+\/iD9HNmfv2msqiXNFGoZilNx52dlYpSngcjMahYCZatuJxecuXUWxhAYPfzACsABQQDBAMDAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAQAcAAJAAQAVAIkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00887{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":499,"source":"sites.pcapng","alias":"nDPId-test","flow_id":43,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646495749875,"flow_last_seen":1646495750202,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646495750202,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"129.226.107.210","src_port":45014,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.IFLIX","breed":"Fun","category":"Video"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.iflix.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00943{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":500,"source":"sites.pcapng","alias":"nDPId-test","flow_id":43,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646495749875,"flow_last_seen":1646495750523,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1432,"flow_tot_l4_payload_len":1949,"flow_avg_l4_payload_len":487,"midstream":0,"thread_ts_msec":1646495750523,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"129.226.107.210","src_port":45014,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.IFLIX","breed":"Fun","category":"Video"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.iflix.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"00447ab319e9d94ba2b4c1248e155917","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +01507{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":502,"source":"sites.pcapng","alias":"nDPId-test","flow_id":43,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1646495749875,"flow_last_seen":1646495750523,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1432,"flow_tot_l4_payload_len":4189,"flow_avg_l4_payload_len":698,"midstream":0,"thread_ts_msec":1646495750523,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"129.226.107.210","src_port":45014,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.IFLIX","breed":"Fun","category":"Video"},"tls": {"version":"TLSv1.2","client_requested_server_name":"www.iflix.com","server_names":"jan18-2022-1.ias.iflix.com,access.iflix.com,accounts.iflix.com,debugaccess.iflix.com,hwvip.iflix.com,iflix.com,live.iflix.com,pbaccess.iflix.com,pbdebugaccess.iflix.com,test.iflix.com,testupload.iflix.com,tv.iflix.com,upload.iflix.com,vplay.iflix.com,www.iflix.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"00447ab319e9d94ba2b4c1248e155917","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=DigiCert Inc, CN=DigiCert Secure Site CN CA G3","subjectDN":"C=CN, ST=Guangdong Province, L=Shenzhen, O=Shenzhen Tencent Computer Systems Company Limited, CN=jan18-2022-1.ias.iflix.com","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"6F:FD:C1:38:F4:2A:0B:65:51:9C:0E:11:86:63:B5:58:52:FC:96:B0"}} +00591{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":505,"source":"sites.pcapng","alias":"nDPId-test","flow_id":44,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646495785326,"flow_last_seen":1646495785326,"flow_idle_time":180000,"flow_min_l4_payload_len":1357,"flow_max_l4_payload_len":1357,"flow_tot_l4_payload_len":1357,"flow_avg_l4_payload_len":1357,"midstream":0,"thread_ts_msec":1646495785326,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"216.58.212.142","src_port":38642,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +02271{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":505,"source":"sites.pcapng","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_last_seen":1646495785326,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1399,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1399,"pkt_l4_len":1365,"thread_ts_msec":1646495785326,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAVpAABAAEARxpLAqAGA2DrUjpbyAbsFVWFvygAAAAEIEaJhA\/pmmGIDGZVnAEJ9k4MXlQzkENByBWBPG6JdLnJ97tZTge\/8kX\/RhzOqc4jakqIni2HiqmCs6hTSmZEhkbOUs3lvKsO9F9+XIhOeXqIykOCxzeDPOvDHVnxP2ftNUD1lroHjevW4+JYs\/R0VPIgtCayG\/meCf7Lef9QhWL6YQmXx48ui2W6tYfyIEiaXDMtExoqL+hacVg2HpNlIwJe4PE0\/HEg3ezCS0HD8j4RVM2gk+MitT95qpQmfRz8ntx5WznfpVZvMxU23bid9\/dO3KP4LRTXApe0VNoqcMS8eAgkUyCgd5nSQ87LPgFqnkCEFratISm41sDhhr7ve32C1I\/TlAIhgBRfW87C3WFDVCBagaYOeonExydEo\/D28evz\/tjH6aV7xu0wNblTQywt3lynmNkuwCW7cnmeQuau6oQOA9GiSOfN51L3rFmCObunfGa2ezZE4y2FjFlEEKO\/QIf2CassSbDJm49YK5w7PoSq58kn\/6qIb0Tn5xVj\/LonVQw1HAkNmcP8ql0C7shrF43UdoYXvT\/hOCOA\/VAd6JiIod3M38vXNHkTBOnLJf9TfjJE64UfVXvq5UqVG0r6WldLJGu2xtNgpeDi11dyXdfvaPJX4DN1wutu28hbCiIktfSp6wZpMBmAyygGuO73TqglRovt2xSE4EHwrJMCD4O2TYEurb9uUa0gMyyJFr9\/L+BwLQIYk52z2VLzFmq3EMYlrlu4r\/zm7z83+qa7ryx2Qegl3wdMjyEciWgqgcac28uJhD3lOGWLmvmFxM9fEY1jJKzrVnaWs\/i+ophLeLFpkmeSef74TmyzGpEZIsuPNpoyrlLRH7YPjpxJQS81Wg3bRzpRPypt93N8AAAABCBGiYQP6ZphiAxmVZ0A7KMwiGjnAKddrCOyv2PDiBRWs1qpECiw2xTVInm4f3DIdG9S3r6Co1Q+QqgROt51vL3O9dOvlXAZmpcYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00824{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":505,"source":"sites.pcapng","alias":"nDPId-test","flow_id":44,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646495785326,"flow_last_seen":1646495785326,"flow_idle_time":180000,"flow_min_l4_payload_len":1357,"flow_max_l4_payload_len":1357,"flow_tot_l4_payload_len":1357,"flow_avg_l4_payload_len":1357,"midstream":0,"thread_ts_msec":1646495785326,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"216.58.212.142","src_port":38642,"dst_port":443,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"QUIC.Google","breed":"Acceptable","category":"Web"},"quic": {"client_requested_server_name":"hangouts.google.com","version":"TLSv1.3","alpn":"h3","ja3":"2a18e6bf307f97c5e27f0ab407dc65db","tls_supported_versions":"TLSv1.3"}} +02279{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":506,"source":"sites.pcapng","alias":"nDPId-test","flow_id":44,"flow_packet_id":2,"flow_last_seen":1646495785351,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1399,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1399,"pkt_l4_len":1365,"thread_ts_msec":1646495785351,"pkt":"PKn0qB\/spJGxgjQ5CABFgAVpAABAADMR0xLYOtSOwKgBgAG7lvIFVdbOwgAAAAEDGZVnCBGiYQP6ZphiAEPst9JjIfZ6zFXkACoVjtJE04mEvUBO80J9CXDI1AzGWloBOqzPXI+URdYvHEecgUeYllSRgTGQ\/pdzmzfdkga4V0DlNh9sMthgcZTrWfMiNpOkeHh+8VGEpoSOyr5bTtr6qKEGYg7ZZM+3g8CNri4\/Y4rmU\/u2ucvFt3wUyTEBNlGlntUryhGUoERRNT55NmFJqVuhU\/GueMTfSHsKfOOCMhdksMgHmrVyRumUWVrccMpyqwcE3vpmgCs+uFNthYNXlEj8FMdYAA6FIKpTcrXTgZ3Nm3DRRlDCt76rYa9Ed5zm8JxO+MhvWTGGpqVfgXpQEWyeWMNxG693XFsxTB07PJ3\/YeWP9LrYnM2HgdinrEmJ9dHI16vwi5FQ0cWQJ92cHEvIGKGiq8SA5HEgTnQVmdK2xOmx7dj0KaicL3ol58t8ltkbIXgfkxYhp5yyTHcH3z0UKdCT7GAS6tTRIUS1R7xH75rixlq6B8ZSkGHfajnn6P2ZcdZ\/x0f91Ed0FleO4gdbHHIHetNxBiPPjmSYid1gKObR53SjxAV83g\/W5uVBPG0cabwLojDjBF4yItmMF8ard0uchzKjL7+VPzEBpyA8VAKvlvVbjeonWQ9zdLjCu+3DI5DnZF04lHG772bPMCDbbp1L2TwHKUlogQBjbGpHA7cGqXQ+7rgXzsp8A1LJ4M7UOfhwAhpEZinbjHrtptlKXt3FIxug5QT3rZRFmRCTzNoEN+lueCUbvABz5ahUadsFXVwk+QV6y6OfittlgN9FPzvu2wbXQsdpR7HuGw5be5n5hrjM\/gt9Cn1qYtj8W7tpYyeOF6J2KVyL\/JC\/QJoDFTRmNJOaSu8I9GPipG+PZyHfbkz460Q5SYy9J6Yty8H0OpgvMOxAZyJfdY6HpBJ73a3hMG\/oeLH2XJGbp7tfnJSbIrw7OjnmUjZjC3QFC5ZT\/D9lfLZQtLioZhFU2dvfGzIgp3e6A6JbEE0vFluuvChl2C+0rBUUI4BDQaLDC36yd\/nqeU9YkBNuGMLNwmS1nu9FZU8mcDANqVoY5yVLg2kamNS5X1hNq7e0ZttiC++uqF2vAilhDlKm4Sn9UjPckZuiZBomYpyg0Mx2VTEwtpKds6MA+UAswT6IhWCQVBWewjai+fOWFc9I1PVuJXv6wszew3Hcqcb00f6u5LLpYQLzSeihJuZrVlM1j6lGBHe0EhJ6DL1teURdZuXWHdzyDqDjp983xiqcs411z8ivoxsAQrnJoCWJxd7jZsORlrj+qRu70MzdRwWows6Ir5D2WLnk\/xr5xZXlxc0qq35KzQxuScxBBYPpS5ZzPphWbiD4nd3CHT+adzTjAAAAAQMZlWcIEaJhA\/pmmGJA9VVpI4dKlmrgeF\/YggQi8sjf99E3nv5OtPvRrtZcyuW01yoBM35YdPwOsg50xXr\/BiQRHRmpg5AI\/Gxv40hVq1L2PZoVADVhqqGncF1oScVHTbM9W4m3oXbHay1EHfQ5lAWTWpN49l9Tiv7IrVgj7Dp+73Bh+\/I4be++4+GN0yWQOqn0T+ijD3iAvjW07u4KFggANU2wFU17wsvlJuMqKoty0iSiIcZD1Fpv8YeBupA3Jd5TcFAQxL\/\/amaXv8CyobSjSega7I6w3iSVpXXusfvcoL9IwMGqCbpjl4yujE+\/2nPBKVvs4iEZolT1zqdJU8Q5tR5vWxmVZ56Vkqmz6hVG35AqABKCyEo\/gk\/PneTs58wsy3Z+6AWG31mbKVGDVWKfuUivH9e1GriPy0Y1T2Vi68\/VxrxY\/w=="} +00581{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":507,"source":"sites.pcapng","alias":"nDPId-test","flow_id":45,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646495836963,"flow_last_seen":1646495836963,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646495836963,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.185.206","src_port":50608,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":507,"source":"sites.pcapng","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_last_seen":1646495836963,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646495836963,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8O4hAAEAG9ELAqAGAjvq5zsWwAbtVp40sAAAAAKAC+vA0nQAAAgQFtAQCCApsJfcbAAAAAAEDAwc="} +00483{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":508,"source":"sites.pcapng","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_last_seen":1646495836979,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646495836979,"pkt":"PKn0qB\/spJGxgjQ5CABFgAA8r34AAHIGjcyO+rnOwKgBgAG7xbDcn6Z3VaeNLaAS\/\/\/zpwAAAgQFlgQCCApyIEa6bCX3GwEDAwg="} +01166{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":509,"source":"sites.pcapng","alias":"nDPId-test","flow_id":45,"flow_packet_id":3,"flow_last_seen":1646495836983,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646495836983,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5O4pAAEAG8kPAqAGAjvq5zsWwAbtVp40t3J+meIAYAfYRowAAAQEICmwl9zByIEa6FgMBAgABAAH8AwOIf7nJ5breQpxi5aty74p4A0tH8s+YhJ7uQwoAchgbeyDiYRrjyIJgoj6ghTCikRuTluEoGumBBaOR1N7eUGiD\/gAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAATABEAAA5nb29nbGVwbHVzLmNvbQAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAIgAKAAgEAwUDBgMCAwAzAGsAaQAdACBQQOMOQqFJCXmUicpi9d2kYaSiqPqeBjWpdYiUO92OBgAXAEEEwEm0an4CaV7UYrRD1yMS8F4iZzs0QylP5VOKPX+Fji27U1gjEJPJGZS7PVMPfJS0GsqWWRpHV\/lDyKacoCtA0wArAAUEAwQDAwANABgAFgQDBQMGAwgECAUIBgQBBQEGAQIDAgEALQACAQEAHAACQAEAFQCIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00894{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":509,"source":"sites.pcapng","alias":"nDPId-test","flow_id":45,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646495836963,"flow_last_seen":1646495836983,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646495836983,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.185.206","src_port":50608,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Google","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"googleplus.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00935{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":510,"source":"sites.pcapng","alias":"nDPId-test","flow_id":45,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646495836963,"flow_last_seen":1646495837006,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1418,"flow_tot_l4_payload_len":1935,"flow_avg_l4_payload_len":483,"midstream":0,"thread_ts_msec":1646495837006,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.185.206","src_port":50608,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Google","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"googleplus.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"eb1d94daa7e0344597e756a1fb6e7054","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00592{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":511,"source":"sites.pcapng","alias":"nDPId-test","flow_id":46,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646495837086,"flow_last_seen":1646495837086,"flow_idle_time":180000,"flow_min_l4_payload_len":1357,"flow_max_l4_payload_len":1357,"flow_tot_l4_payload_len":1357,"flow_avg_l4_payload_len":1357,"midstream":0,"thread_ts_msec":1646495837086,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.181.238","src_port":36832,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +02265{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":511,"source":"sites.pcapng","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_last_seen":1646495837086,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1399,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1399,"pkt_l4_len":1365,"thread_ts_msec":1646495837086,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAVpAABAAEARLnPAqAGAjvq17o\/gAbsFVdqKwQAAAAEIGskra7CKZYEDuYLxAEIVFxxqmZ08lCd3LEamnRnTwqMewjQTOXHJ+bQBCnc75qyddTeYHQ3SnzAULSCTOvy9BuronZfx+Rok2NEb\/1BsWpwM7HvouqIbg\/UM9rh+Oz94fTVRKCbJSe1Rt9Wi3IS3cTWhF88qqkbPlVNVfTP6qf147kmXwAclEb200UQEzcAZIv3o++EPu3L79R8FmBpBYJnCKkgaxbqODau1mi\/955te0zmkf2846gwZzwMXzDwbr6\/3HnP3h8OfoVM0MIFN9x7Ds+vGpVKDRpQM0NlvNQfFfblQvgPKr6\/wJHgowwd40oBCNI3FTXFgafKbw2f8iXs1MuIi6dbw5qDMfDg7neN7v6\/vcX4HSf8y6PVeyxCvA4+7q957ap\/3PII07iu47YhDzCD0lwTDjfi\/a1raoLz70\/SPK9NEbeWnxibfZXFeg8+E6Qmd9DFP4zQ2QPKahjqlPM4ZePdB1N+sWTrGnHY+e5VOY4qYOyABuFGeuadAN35ZvnTav7s\/+rzxtiAo1AWyqO5W85hkYntoGdWyMOzcrhaGvKoJNlyQWa3gWJkpY39Z1uzVJ9G3lDdAsC9\/zRJfbRKvAouMAfcWbKNWIPlVEx425CNhqzWnjNjSzKi5ec4e5C4us09IcxcJ6YiARP3HINF5Ycp8CM+O3SAPpWjAj1wgjVCtDNLk+H+lVLgNqHb0nSuRRFGscCZoJV0VpfhM0MYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00828{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":511,"source":"sites.pcapng","alias":"nDPId-test","flow_id":46,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646495837086,"flow_last_seen":1646495837086,"flow_idle_time":180000,"flow_min_l4_payload_len":1357,"flow_max_l4_payload_len":1357,"flow_tot_l4_payload_len":1357,"flow_avg_l4_payload_len":1357,"midstream":0,"thread_ts_msec":1646495837086,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.181.238","src_port":36832,"dst_port":443,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"QUIC.GooglePlus","breed":"Fun","category":"SocialNetwork"},"quic": {"client_requested_server_name":"plus.google.com","version":"TLSv1.3","alpn":"h3","ja3":"b719940c5ab9a3373cb4475d8143ff88","tls_supported_versions":"TLSv1.3"}} +02275{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":512,"source":"sites.pcapng","alias":"nDPId-test","flow_id":46,"flow_packet_id":2,"flow_last_seen":1646495837102,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1399,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1399,"pkt_l4_len":1365,"thread_ts_msec":1646495837102,"pkt":"PKn0qB\/spJGxgjQ5CABFgAVpAABAADMROvOO+rXuwKgBgAG7j+AFVSXtyAAAAAEDuYLxCBrJK2uwimWBAEU4Tznrzq28hb1XmRDs0MFqelTnhcFUZ84H4q1aY4G8iO4oHDfc48pBHn\/VwFJa95gqSHvH4Ev8Om2dP0drKfHTm5RIabnMUwABEpNiK30Wb+s0DC1P8fJqrYirSkcMUtk+OScepXvvMoUJqb3oK\/SHueY\/CR+1r94ahlb+lQ5CMkRrFEpV8Y80c9Tk558ky1YvZroBJocv+D8x22dTrB3Nr2zV5BXUe4IfZjyM1uOvrGOzm7BFlSrMgOj6FKIkCgp\/pf+jrmIN6zoTCYHljLfpxOi3CtJlotE5kvBNJfYTIlpV6ePxOeaBHnLAnR8AUiLMe4EQhoCyafpPSu2uRilBt0zY24SPHj+Vr1q8JDD3+tdbrEpwnhqALSf4fMlI0nlCiW6KDCz9YYUL75K4IS9444yNzf1Yr99Mh0kbqbRkqVD2lz0sc+tejmla91jt2s1ymwqM2Dkc57wq\/ZGL2qTvHoCDCrWXzzSFq2DtMODbeFddKrW7D2S\/WC6gNpi8CkmnUEfrksPztXbMxr+4svM2m36IzD+uTDtBonQOeeetS42fSNmayHtkfbHFRhxhKIWxbXnDeYhaHVYjCQ+4X0zwkTVPladnLIcVEBYqwYQv5\/bz9ieX8wyoykaDLtE9CrJi2EKtZ8wkCC7Z741Zd+Wml1GFTEX8vTPcXOs4jWXGa8by36ak7R21cVgtCbMzCsX51MXYO9rxKpqzQ90YL3ZJybESTLyCZVaetnFQQy0zj9i3aMbEeaF1GIY8fpv41LJIfBTcuddEsku5mHk0ET+hIJRQHhrqv3\/7dLCFIB8IbFzqoMNXvst3vFd153RNd4+wDFw0PTKp3WxAax7aH3o4vpIKkH5MYZZm6QdYg4AXeCOVs+yOQckfo449mppsZnBCauNFwyGHgfdImQc5ChUcBackKfZKPm+8gpfez3Lh5cIH5TVZfBcX2049yxCxwBIQNMHRFZ\/l6px98JrGqv9wlLvZ9x05f9o+OBwqtGjSma1n6CqkHTjCKDb9wEKbD27oXi\/IB1KPHp2u9d\/c+7X2RVtjWmizhI43eqsfAt6YQSI\/I6i5XWGJRa1qw\/6lLbvQvj\/jHqXTS68GWhBdBLJUtfTko6qCsN7rqu1qRzGoIhl0BkGE92lNyYY\/ZTU6\/hdcvPHH\/gVolLu3hFDPu+ipgvDDLIZuRl+UaoOI4gJccnN1m37oKsX6NQtnyeGSc2tM6+62ei3A6X8waSaElCusvteiUGCHQxwaHmAxN+l0Fnrtj2W9v8HqhbG8zavLaMSK9TCSurpq1GtTp5SAztNP1KCrvVnqVhJrjpPBsMoRZgIibHU+b02bSrZ5vLUq8fMRq1DHjSpmxuFXNZXv4gyNl3Dl6lhcF466Vu3DVIKOpmXUnOt94P9drBleL2pc6g\/Rsi+uKui90velUE0hGPgoOIhhDJ0ymy34LYnDdDZuGwprFKEAglwy2+YC1sXbba6gKVjcOV1Ca5zHuLIWZHit470RXXzr7m1Xi\/5cXZYyKSyJACVo6ge6ve+Upi7YI+aW+jgyPqmHMKb+I\/eIOcKZeHyih24R2l7AgjvcvMggC5W8nbNUSu9cpnGWdlPqjTB0D+d7oT5+bGyUabkzh3dJ2t9fzH8gnGtlT1zFzufTmcBCKpbCY6sP\/0lUq7vHjuvu650M0IhuYA8e9G78Y8vHGY8YN9zIOLD+CF2bDXHwqf3VW0Z0KdlLeLkOH0oqFJ9UgLOZLQqYMUReoZ97In3a7hJ65ZurIhpFxCeAoO9kMhJrGIJTN\/Ls9g=="} +00562{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":513,"source":"sites.pcapng","alias":"nDPId-test","packets-captured":513,"packets-processed":512,"total-skipped-flows":0,"total-l4-data-len":233934,"total-not-detected-flows":0,"total-guessed-flows":4,"total-detected-flows":42,"total-detection-updates":47,"total-updates":0,"current-active-flows":10,"total-active-flows":46,"total-idle-flows":36,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":319,"global_ts_msec":1646568788171} +00579{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":513,"source":"sites.pcapng","alias":"nDPId-test","flow_id":47,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1646568788171,"flow_last_seen":1646568788171,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1646568788171,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"208.85.40.158","src_port":53978,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":513,"source":"sites.pcapng","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_last_seen":1646568788171,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646568788171,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAA8AQRAAEAGfpzAqAGA0FUontLaAbs4n4KKAAAAAKAC+vB1NgAAAgQFtAQCCArSjLpwAAAAAAEDAwc="} +00480{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":514,"source":"sites.pcapng","alias":"nDPId-test","flow_id":47,"flow_packet_id":2,"flow_last_seen":1646568788337,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1646568788337,"pkt":"PKn0qB\/spJGxgjQ5CABFAAA8Ke1AAPAGpbLQVSiewKgBgAG70tpN2CtOOJ+Ci6ASOQiNqgAAAgQFtAEDAwAEAggKXyXRHtKMunA="} +01169{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":515,"source":"sites.pcapng","alias":"nDPId-test","flow_id":47,"flow_packet_id":3,"flow_last_seen":1646568788341,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_msec":1646568788341,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAI5AQZAAEAGfJ3AqAGA0FUontLaAbs4n4KLTdgrT4AYAfYOtAAAAQEICtKMuxtfJdEeFgMBAgABAAH8AwNyi5pZnYizmESRNRsWFzLDUgF4AIT\/tX3zYbufDRkzzyDMV\/FK528iuv6PxN\/1DD4BU1TMzFBPBIF01ZAvPFWIVwAiEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAnACdAC8ANQEAAZEAAAAQAA4AAAtwYW5kb3JhLmNvbQAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAIgAKAAgEAwUDBgMCAwAzAGsAaQAdACBUk5TxRwMmI7m3PUpmyv2jiTq1G62x80KdY2tfOvxfVgAXAEEEr8O4oznU2jNZk5ZC+\/pUpJeqcDtGn2NikTZa2J69CfKpIdzohOHLj9fffI5zTez3ppU6JIFTO2\/VBVQmSVbRwwArAAUEAwQDAwANABgAFgQDBQMGAwgECAUIBgQBBQEGAQIDAgEALQACAQEAHAACQAEAFQCLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00889{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":515,"source":"sites.pcapng","alias":"nDPId-test","flow_id":47,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1646568788171,"flow_last_seen":1646568788341,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1646568788341,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"208.85.40.158","src_port":53978,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Pandora","breed":"Fun","category":"Streaming"},"tls": {"version":"TLSv1.2","client_requested_server_name":"pandora.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +00945{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":516,"source":"sites.pcapng","alias":"nDPId-test","flow_id":47,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":1646568788171,"flow_last_seen":1646568788508,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646568788508,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"208.85.40.158","src_port":53978,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Pandora","breed":"Fun","category":"Streaming"},"tls": {"version":"TLSv1.2","client_requested_server_name":"pandora.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"7047b9d842ee4b3fba6a86353828c915","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}} +01231{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":518,"source":"sites.pcapng","alias":"nDPId-test","flow_id":47,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1646568788171,"flow_last_seen":1646568788673,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":3789,"flow_avg_l4_payload_len":631,"midstream":0,"thread_ts_msec":1646568788673,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"208.85.40.158","src_port":53978,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Pandora","breed":"Fun","category":"Streaming"},"tls": {"version":"TLSv1.2","client_requested_server_name":"pandora.com","server_names":"*.pandora.com,pandora.com","ja3":"579ccef312d18482fc42e2b822ca2430","ja3s":"7047b9d842ee4b3fba6a86353828c915","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=GeoTrust TLS RSA CA G1","subjectDN":"C=US, ST=California, L=Oakland, O=Pandora Media, LLC, CN=*.pandora.com","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"40:BB:03:6C:E8:D4:7C:D7:72:59:2F:8D:DB:4B:64:4F:8F:C4:EB:AF"}} +00696{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":520,"source":"sites.pcapng","alias":"nDPId-test","flow_id":39,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646495669804,"flow_last_seen":1646495669824,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1428,"flow_tot_l4_payload_len":1945,"flow_avg_l4_payload_len":486,"midstream":0,"thread_ts_msec":1646568788847,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"108.138.185.106","src_port":33664,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.AmazonVideo","breed":"Acceptable","category":"Video"}} +00696{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":520,"source":"sites.pcapng","alias":"nDPId-test","flow_id":40,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646495697787,"flow_last_seen":1646495697827,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1418,"flow_tot_l4_payload_len":1935,"flow_avg_l4_payload_len":483,"midstream":0,"thread_ts_msec":1646568788847,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.185.142","src_port":56458,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.GoogleDrive","breed":"Acceptable","category":"Cloud"}} +00689{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":520,"source":"sites.pcapng","alias":"nDPId-test","flow_id":45,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646495836963,"flow_last_seen":1646495837006,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1418,"flow_tot_l4_payload_len":1935,"flow_avg_l4_payload_len":483,"midstream":0,"thread_ts_msec":1646568788847,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.185.206","src_port":50608,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Google","breed":"Acceptable","category":"Web"}} +00687{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":520,"source":"sites.pcapng","alias":"nDPId-test","flow_id":47,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":1646568788171,"flow_last_seen":1646568788847,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":4237,"flow_avg_l4_payload_len":529,"midstream":0,"thread_ts_msec":1646568788847,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"208.85.40.158","src_port":53978,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Pandora","breed":"Fun","category":"Streaming"}} +00694{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":520,"source":"sites.pcapng","alias":"nDPId-test","flow_id":42,"flow_state":"finished","flow_packets_processed":10,"flow_first_seen":1646495710534,"flow_last_seen":1646495710610,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":6845,"flow_avg_l4_payload_len":684,"midstream":0,"thread_ts_msec":1646568788847,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"13.107.42.13","src_port":56836,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.MS_OneDrive","breed":"Acceptable","category":"Cloud"}} +00692{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":520,"source":"sites.pcapng","alias":"nDPId-test","flow_id":44,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1646495785326,"flow_last_seen":1646495785351,"flow_idle_time":180000,"flow_min_l4_payload_len":1357,"flow_max_l4_payload_len":1357,"flow_tot_l4_payload_len":2714,"flow_avg_l4_payload_len":1357,"midstream":0,"thread_ts_msec":1646568788847,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"216.58.212.142","src_port":38642,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"QUIC.Google","breed":"Acceptable","category":"Web"}} +00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":520,"source":"sites.pcapng","alias":"nDPId-test","flow_id":43,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":1646495749875,"flow_last_seen":1646495750848,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1432,"flow_tot_l4_payload_len":4556,"flow_avg_l4_payload_len":569,"midstream":0,"thread_ts_msec":1646568788847,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"129.226.107.210","src_port":45014,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.IFLIX","breed":"Fun","category":"Video"}} +00685{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":520,"source":"sites.pcapng","alias":"nDPId-test","flow_id":41,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":1646495710343,"flow_last_seen":1646495710456,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":6565,"flow_avg_l4_payload_len":729,"midstream":0,"thread_ts_msec":1646568788847,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"13.81.118.91","src_port":33102,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"}} +00700{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":520,"source":"sites.pcapng","alias":"nDPId-test","flow_id":46,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1646495837086,"flow_last_seen":1646495837102,"flow_idle_time":180000,"flow_min_l4_payload_len":1357,"flow_max_l4_payload_len":1357,"flow_tot_l4_payload_len":2714,"flow_avg_l4_payload_len":1357,"midstream":0,"thread_ts_msec":1646568788847,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"142.250.181.238","src_port":36832,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"QUIC.GooglePlus","breed":"Fun","category":"SocialNetwork"}} +00691{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":520,"source":"sites.pcapng","alias":"nDPId-test","flow_id":38,"flow_state":"finished","flow_packets_processed":8,"flow_first_seen":1646495650748,"flow_last_seen":1646495650832,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":4927,"flow_avg_l4_payload_len":615,"midstream":0,"thread_ts_msec":1646568788847,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"52.113.194.132","src_port":57878,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"}} +00700{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":520,"source":"sites.pcapng","alias":"nDPId-test","flow_id":37,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1646495488872,"flow_last_seen":1646495488890,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1965,"flow_avg_l4_payload_len":491,"midstream":0,"thread_ts_msec":1646568788847,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"15.160.39.187","src_port":45898,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TLS.AppleSiri","breed":"Acceptable","category":"VirtAssistant"}} +00563{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":520,"source":"sites.pcapng","alias":"nDPId-test","packets-captured":520,"packets-processed":520,"total-skipped-flows":0,"total-l4-data-len":238171,"total-not-detected-flows":0,"total-guessed-flows":4,"total-detected-flows":43,"total-detection-updates":49,"total-updates":0,"current-active-flows":0,"total-active-flows":47,"total-idle-flows":47,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":338,"global_ts_msec":1646568788847} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 520/520 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 238171 bytes +~~ total detected protocols..: 43 +~~ total active/idle flows...: 47/47 +~~ total timeout flows.......: 4 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5548002 bytes +~~ total memory freed........: 5548002 bytes +~~ total allocations/frees...: 114142/114142 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 463 chars +~~ json string max len.......: 2306 chars +~~ json string avg len.......: 1384 chars diff --git a/test/results/skype-conference-call.pcap.out b/test/results/skype-conference-call.pcap.out index 21cae9e90..fea106e0f 100644 --- a/test/results/skype-conference-call.pcap.out +++ b/test/results/skype-conference-call.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4693518 bytes -~~ total memory freed........: 4693518 bytes -~~ total allocations/frees...: 101345/101345 +~~ total memory allocated....: 5192425 bytes +~~ total memory freed........: 5192425 bytes +~~ total allocations/frees...: 113227/113227 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 477 chars ~~ json string max len.......: 852 chars diff --git a/test/results/skype.pcap.out b/test/results/skype.pcap.out index c71fd22b6..8c087b359 100644 --- a/test/results/skype.pcap.out +++ b/test/results/skype.pcap.out @@ -1473,9 +1473,9 @@ ~~ total active/idle flows...: 293/293 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5359585 bytes -~~ total memory freed........: 5359585 bytes -~~ total allocations/frees...: 105238/105238 +~~ total memory allocated....: 5858492 bytes +~~ total memory freed........: 5858492 bytes +~~ total allocations/frees...: 117120/117120 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 444 chars ~~ json string max len.......: 1773 chars diff --git a/test/results/skype_no_unknown.pcap.out b/test/results/skype_no_unknown.pcap.out index 7dbee9ba9..5b5332281 100644 --- a/test/results/skype_no_unknown.pcap.out +++ b/test/results/skype_no_unknown.pcap.out @@ -1299,9 +1299,9 @@ ~~ total active/idle flows...: 267/267 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5200995 bytes -~~ total memory freed........: 5200995 bytes -~~ total allocations/frees...: 104126/104126 +~~ total memory allocated....: 5699902 bytes +~~ total memory freed........: 5699902 bytes +~~ total allocations/frees...: 116008/116008 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 197 chars ~~ json string max len.......: 1776 chars diff --git a/test/results/skype_udp.pcap.out b/test/results/skype_udp.pcap.out index af00950a3..73ee0d98e 100644 --- a/test/results/skype_udp.pcap.out +++ b/test/results/skype_udp.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679655 bytes -~~ total memory freed........: 4679655 bytes -~~ total allocations/frees...: 101148/101148 +~~ total memory allocated....: 5178562 bytes +~~ total memory freed........: 5178562 bytes +~~ total allocations/frees...: 113030/113030 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 672 chars diff --git a/test/results/smb_deletefile.pcap.out b/test/results/smb_deletefile.pcap.out index 2b60457d8..4a363854b 100644 --- a/test/results/smb_deletefile.pcap.out +++ b/test/results/smb_deletefile.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682439 bytes -~~ total memory freed........: 4682439 bytes -~~ total allocations/frees...: 101244/101244 +~~ total memory allocated....: 5181346 bytes +~~ total memory freed........: 5181346 bytes +~~ total allocations/frees...: 113126/113126 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 460 chars ~~ json string max len.......: 1139 chars diff --git a/test/results/smbv1.pcap.out b/test/results/smbv1.pcap.out index 9885e3809..c1f7cc472 100644 --- a/test/results/smbv1.pcap.out +++ b/test/results/smbv1.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681761 bytes -~~ total memory freed........: 4681761 bytes -~~ total allocations/frees...: 101151/101151 +~~ total memory allocated....: 5180668 bytes +~~ total memory freed........: 5180668 bytes +~~ total allocations/frees...: 113033/113033 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 1045 chars diff --git a/test/results/smpp_in_general.pcap.out b/test/results/smpp_in_general.pcap.out index bfc838616..67fa32816 100644 --- a/test/results/smpp_in_general.pcap.out +++ b/test/results/smpp_in_general.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4682051 bytes -~~ total memory freed........: 4682051 bytes -~~ total allocations/frees...: 101161/101161 +~~ total memory allocated....: 5180958 bytes +~~ total memory freed........: 5180958 bytes +~~ total allocations/frees...: 113043/113043 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 694 chars diff --git a/test/results/smtp-starttls.pcap.out b/test/results/smtp-starttls.pcap.out index e28cee7d8..e956f099a 100644 --- a/test/results/smtp-starttls.pcap.out +++ b/test/results/smtp-starttls.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680554 bytes -~~ total memory freed........: 4680554 bytes -~~ total allocations/frees...: 101179/101179 +~~ total memory allocated....: 5179461 bytes +~~ total memory freed........: 5179461 bytes +~~ total allocations/frees...: 113061/113061 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 691 chars diff --git a/test/results/smtp.pcap.out b/test/results/smtp.pcap.out index 8971e6d35..03b6e335e 100644 --- a/test/results/smtp.pcap.out +++ b/test/results/smtp.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4684313 bytes -~~ total memory freed........: 4684313 bytes -~~ total allocations/frees...: 101239/101239 +~~ total memory allocated....: 5183220 bytes +~~ total memory freed........: 5183220 bytes +~~ total allocations/frees...: 113121/113121 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 456 chars ~~ json string max len.......: 680 chars diff --git a/test/results/smtps.pcapng.out b/test/results/smtps.pcapng.out new file mode 100644 index 000000000..6a0c8d56c --- /dev/null +++ b/test/results/smtps.pcapng.out @@ -0,0 +1,24 @@ +00458{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"smtps.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00544{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"smtps.pcapng","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1614938504972} +00573{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"smtps.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1614938504972,"flow_last_seen":1614938504972,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1614938504972,"l3_proto":"ip4","src_ip":"62.43.36.99","dst_ip":"21.65.95.132","src_port":37682,"dst_port":465,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00466{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"smtps.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1614938504972,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1614938504972,"pkt":"AAAAAAAAAAEA\/khbCABFAAA0\/aNAAEAGZc0+KyRjFUFfhJMyAdF0clasAAAAAIACFrAhIQAAAgQFhAEBBAIBAwMC"} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"smtps.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1614938505205,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1614938505205,"pkt":"AAAAAAAAAAEA\/khbCABFAAA0AABAAC4GdXEVQV+EPiskYwHRkzJiRoeidHJWrYASchDbkQAAAgQFtAEBBAIBAwMH"} +01146{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"smtps.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1614938505342,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"thread_ts_msec":1614938505342,"pkt":"AAAAAAAAAAEA\/khbCABFAAIt\/aVAAEAGY9I+KyRjFUFfhJMyAdF0clatYkaHo1AYBazqdwAAFgMBAgABAAH8AwO7S\/DbiCyixZpW6cPhrJJZKMPmmGE2v4GGVrqm684TKwAArMAwwCzAKMAkwBTACgClAKMAoQCfAGsAagBpAGgAOQA4ADcANgCIAIcAhgCFwDLALsAqwCbAD8AFAJ0APQA1AITAL8ArwCfAI8ATwAkApACiAKAAngBnAEAAPwA+ADMAMgAxADAAmgCZAJgAlwBFAEQAQwBCwDHALcApwCXADsAEAJwAPAAvAJYAQQAHwBHAB8AMwAIABQAEwBLACAAWABMAEAANwA3AAwAKAP8BAAEnAAsABAMAAQIACgAcABoAFwAZABwAGwAYABoAFgAOAA0ACwAMAAkACgAjAAAADQAgAB4GAQYCBgMFAQUCBQMEAQQCBAMDAQMCAwMCAQICAgMADwABAQAVAM4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00884{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"smtps.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":3,"flow_first_seen":1614938504972,"flow_last_seen":1614938505342,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":172,"midstream":0,"thread_ts_msec":1614938505342,"l3_proto":"ip4","src_ip":"62.43.36.99","dst_ip":"21.65.95.132","src_port":37682,"dst_port":465,"l4_proto":"tcp","ndpi": {"flow_risk": {"15": {"risk":"TLS (probably) Not Carrying HTTPS","severity":"Low","risk_score": {"total":760,"client":680,"server":80}},"24": {"risk":"Missing SNI TLS Extension","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"4":"DPI"},"proto":"SMTPS","breed":"Safe","category":"Email"}} +00923{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4,"source":"smtps.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1614938504972,"flow_last_seen":1614938505439,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":696,"flow_avg_l4_payload_len":174,"midstream":0,"thread_ts_msec":1614938505439,"l3_proto":"ip4","src_ip":"62.43.36.99","dst_ip":"21.65.95.132","src_port":37682,"dst_port":465,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"15": {"risk":"TLS (probably) Not Carrying HTTPS","severity":"Low","risk_score": {"total":760,"client":680,"server":80}},"24": {"risk":"Missing SNI TLS Extension","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"4":"DPI"},"proto":"SMTPS","breed":"Safe","category":"Email"}} +00548{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":4,"source":"smtps.pcapng","alias":"nDPId-test","packets-captured":4,"packets-processed":4,"total-skipped-flows":0,"total-l4-data-len":696,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1614938505439} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 4/4 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 696 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5180581 bytes +~~ total memory freed........: 5180581 bytes +~~ total allocations/frees...: 113030/113030 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 463 chars +~~ json string max len.......: 1151 chars +~~ json string avg len.......: 787 chars diff --git a/test/results/snapchat.pcap.out b/test/results/snapchat.pcap.out index 1fd924974..87ec136b5 100644 --- a/test/results/snapchat.pcap.out +++ b/test/results/snapchat.pcap.out @@ -30,9 +30,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4689040 bytes -~~ total memory freed........: 4689040 bytes -~~ total allocations/frees...: 101210/101210 +~~ total memory allocated....: 5187947 bytes +~~ total memory freed........: 5187947 bytes +~~ total allocations/frees...: 113092/113092 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 456 chars ~~ json string max len.......: 1118 chars diff --git a/test/results/snapchat_call.pcapng.out b/test/results/snapchat_call.pcapng.out index 689c84f34..b3a6fdb4f 100644 --- a/test/results/snapchat_call.pcapng.out +++ b/test/results/snapchat_call.pcapng.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680960 bytes -~~ total memory freed........: 4680960 bytes -~~ total allocations/frees...: 101193/101193 +~~ total memory allocated....: 5179867 bytes +~~ total memory freed........: 5179867 bytes +~~ total allocations/frees...: 113075/113075 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 471 chars ~~ json string max len.......: 2286 chars diff --git a/test/results/snmp.pcap.out b/test/results/snmp.pcap.out new file mode 100644 index 000000000..c45bc244e --- /dev/null +++ b/test/results/snmp.pcap.out @@ -0,0 +1,118 @@ +00455{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"snmp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00541{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"snmp.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1597326815572} +00575{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"snmp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597326815572,"flow_last_seen":1597326815572,"flow_idle_time":180000,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"thread_ts_msec":1597326815572,"l3_proto":"ip4","src_ip":"176.211.60.43","dst_ip":"97.0.115.163","src_port":43015,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"snmp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1597326815572,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"thread_ts_msec":1597326815572,"pkt":"AAAAmdpxAAwpCIFqCABFAABHM75AAEARRUaw0zwrYQBzo6gHAKEAM+IpMCkCAQAEBnB1YmxpY6EcAgRLeBpuAgEAAgEAMA4wDAYIKwYBAgEBBQAFAA=="} +00634{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"snmp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597326815572,"flow_last_seen":1597326815572,"flow_idle_time":180000,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"thread_ts_msec":1597326815572,"l3_proto":"ip4","src_ip":"176.211.60.43","dst_ip":"97.0.115.163","src_port":43015,"dst_port":161,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00504{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"snmp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1597326815678,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":99,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":99,"pkt_l4_len":65,"thread_ts_msec":1597326815678,"pkt":"AAwpCIFqAAAAmdpxCABFAABVAAIAAP8R+fNhAHOjsNM8KwChqAcAQdFWMDcCAQAEBnB1YmxpY6IqAgRLeBpuAgEAAgEAMBwwGgYIKwYBAgEBBgAEDkdsb2JvbWFudGljc0hR"} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"snmp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1597326815679,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"thread_ts_msec":1597326815679,"pkt":"AAAAmdpxAAwpCIFqCABFAABHM+lAAEARRRuw0zwrYQBzo6gHAKEAM+EqMCkCAQAEBnB1YmxpY6AcAgRLeBpvAgEAAgEAMA4wDAYIKwYBAgEBBQAFAA=="} +00576{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5,"source":"snmp.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597326838035,"flow_last_seen":1597326838035,"flow_idle_time":180000,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"thread_ts_msec":1597326838035,"l3_proto":"ip4","src_ip":"65.2.162.193","dst_ip":"130.70.149.185","src_port":59988,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"snmp.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1597326838035,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"thread_ts_msec":1597326838035,"pkt":"AAAAl9K2AAwpQXJyCABFAABHTItAAEAR8ldBAqLBgkaVuepUAKEAM4b6MCkCAQEEBnB1YmxpY6EcAgRQZ9ZcAgEAAgEAMA4wDAYIKwYBAgEBBQAFAA=="} +00635{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":5,"source":"snmp.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597326838035,"flow_last_seen":1597326838035,"flow_idle_time":180000,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"thread_ts_msec":1597326838035,"l3_proto":"ip4","src_ip":"65.2.162.193","dst_ip":"130.70.149.185","src_port":59988,"dst_port":161,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00504{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"snmp.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1597326838141,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":99,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":99,"pkt_l4_len":65,"thread_ts_msec":1597326838141,"pkt":"AAwpQXJyAAAAl9K2CABFAABVAAQAAP8Rv9CCRpW5QQKiwQCh6lQAQXYnMDcCAQEEBnB1YmxpY6IqAgRQZ9ZcAgEAAgEAMBwwGgYIKwYBAgEBBgAEDkdsb2JvbWFudGljc0hR"} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"snmp.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1597326838143,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"thread_ts_msec":1597326838143,"pkt":"AAAAl9K2AAwpQXJyCABFAABHTNhAAEAR8gpBAqLBgkaVuepUAKEAM4X7MCkCAQEEBnB1YmxpY6AcAgRQZ9ZdAgEAAgEAMA4wDAYIKwYBAgEBBQAFAA=="} +00575{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":9,"source":"snmp.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597326858008,"flow_last_seen":1597326858008,"flow_idle_time":180000,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"thread_ts_msec":1597326858008,"l3_proto":"ip4","src_ip":"176.211.60.43","dst_ip":"97.0.115.163","src_port":37224,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"snmp.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":1597326858008,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"thread_ts_msec":1597326858008,"pkt":"AAAAmdpxAAwpCIFqCABFAABHgc9AAEAR9zSw0zwrYQBzo5FoAKEAMzYdMCkCAQAEBnB1YmxpY6EcAgQJUAlZAgEAAgEAMA4wDAYIKwYBAgEBBAAFAA=="} +00634{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":9,"source":"snmp.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597326858008,"flow_last_seen":1597326858008,"flow_idle_time":180000,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"thread_ts_msec":1597326858008,"l3_proto":"ip4","src_ip":"176.211.60.43","dst_ip":"97.0.115.163","src_port":37224,"dst_port":161,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00505{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"snmp.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":1597326858136,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":97,"pkt_l4_len":63,"thread_ts_msec":1597326858136,"pkt":"AAwpCIFqAAAAmdpxCABFAABTAAYAAP8R+fFhAHOjsNM8KwChkWgAP8oWMDUCAQAEBnB1YmxpY6IoAgQJUAlZAgEAAgEAMBowGAYIKwYBAgEBBQAEDFIxLmxhYi5sb2NhbA=="} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"snmp.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_last_seen":1597326858140,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"thread_ts_msec":1597326858140,"pkt":"AAAAmdpxAAwpCIFqCABFAABHgiVAAEAR9t6w0zwrYQBzo5FoAKEAMzUeMCkCAQAEBnB1YmxpY6AcAgQJUAlaAgEAAgEAMA4wDAYIKwYBAgEBBAAFAA=="} +00577{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":13,"source":"snmp.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597326863415,"flow_last_seen":1597326863415,"flow_idle_time":180000,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"thread_ts_msec":1597326863415,"l3_proto":"ip4","src_ip":"65.2.162.193","dst_ip":"130.70.149.185","src_port":58433,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"snmp.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_last_seen":1597326863415,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"thread_ts_msec":1597326863415,"pkt":"AAAAl9K2AAwpQXJyCABFAABHlH1AAEARqmVBAqLBgkaVueRBAKEAM6R0MCkCAQEEBnB1YmxpY6EcAgQesaH7AgEAAgEAMA4wDAYIKwYBAgEBBAAFAA=="} +00636{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":13,"source":"snmp.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597326863415,"flow_last_seen":1597326863415,"flow_idle_time":180000,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"thread_ts_msec":1597326863415,"l3_proto":"ip4","src_ip":"65.2.162.193","dst_ip":"130.70.149.185","src_port":58433,"dst_port":161,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00505{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"snmp.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_last_seen":1597326863591,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":97,"pkt_l4_len":63,"thread_ts_msec":1597326863591,"pkt":"AAwpQXJyAAAAl9K2CABFAABTAAgAAP8Rv86CRpW5QQKiwQCh5EEAPzhuMDUCAQEEBnB1YmxpY6IoAgQesaH7AgEAAgEAMBowGAYIKwYBAgEBBQAEDFIxLmxhYi5sb2NhbA=="} +00489{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"snmp.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":3,"flow_last_seen":1597326863597,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"thread_ts_msec":1597326863597,"pkt":"AAAAl9K2AAwpQXJyCABFAABHlIBAAEARqmJBAqLBgkaVueRBAKEAM6N1MCkCAQEEBnB1YmxpY6AcAgQesaH8AgEAAgEAMA4wDAYIKwYBAgEBBAAFAA=="} +00577{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":17,"source":"snmp.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597326976979,"flow_last_seen":1597326976979,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":1597326976979,"l3_proto":"ip4","src_ip":"30.54.142.240","dst_ip":"250.58.112.87","src_port":56251,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00520{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17,"source":"snmp.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_last_seen":1597326976979,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"thread_ts_msec":1597326976979,"pkt":"AAAAuxzeAAwpBeNBCABFAABcyKtAAEARWi0eNo7w+jpwV9u7AKEASImwMD4CAQMwEQIEbJr1bgIDAP\/jBAEEAgEDBBAwDgQAAgEAAgEABAAEAAQAMBQEAAQAoA4CBHUFWIgCAQACAQAwAA=="} +00636{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":17,"source":"snmp.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597326976979,"flow_last_seen":1597326976979,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":1597326976979,"l3_proto":"ip4","src_ip":"30.54.142.240","dst_ip":"250.58.112.87","src_port":56251,"dst_port":161,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00572{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"snmp.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_last_seen":1597326977116,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":147,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":147,"pkt_l4_len":113,"thread_ts_msec":1597326977116,"pkt":"AAwpBeNBAAAAuxzeCABFAACFAAoAAP8Ro6X6OnBXHjaO8ACh27sAcS3eMGcCAQMwEAIEbJr1bgICBdwEAQACAQMEHTAbBAyAAAAJAwCqu8wAAQACAQwCAgLNBAAEAAQAMDEEDIAAAAkDAKq7zAABAAQAqB8CBHUFWIgCAQACAQAwETAPBgorBgEGAw8BAQQAQQEB"} +00589{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"snmp.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_last_seen":1597326977118,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":157,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":157,"pkt_l4_len":123,"thread_ts_msec":1597326977118,"pkt":"AAAAuxzeAAwpBeNBCABFAACPyNFAAEARWdQeNo7w+jpwV9u7AKEAe86sMHECAQMwEQIEbJr1bQIDAP\/jBAEEAgEDBCkwJwQMgAAACQMAqrvMAAEAAgEMAgICzQQMTk9BVVRITk9QUklWBAAEADAuBAyAAAAJAwCqu8wAAQAEAKEcAgR1BViHAgEAAgEAMA4wDAYIKwYBAgEBBQAFAA=="} +00577{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":23,"source":"snmp.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597326981183,"flow_last_seen":1597326981183,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":1597326981183,"l3_proto":"ip4","src_ip":"30.54.142.240","dst_ip":"250.58.112.87","src_port":52435,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00520{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"snmp.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_last_seen":1597326981183,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"thread_ts_msec":1597326981183,"pkt":"AAAAuxzeAAwpBeNBCABFAABcyU5AAEARWYoeNo7w+jpwV8zTAKEASN4QMD4CAQMwEQIEW6KoJAIDAP\/jBAEEAgEDBBAwDgQAAgEAAgEABAAEAAQAMBQEAAQAoA4CBAxVvh4CAQACAQAwAA=="} +00636{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":23,"source":"snmp.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597326981183,"flow_last_seen":1597326981183,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":1597326981183,"l3_proto":"ip4","src_ip":"30.54.142.240","dst_ip":"250.58.112.87","src_port":52435,"dst_port":161,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00572{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"snmp.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_last_seen":1597326981296,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":147,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":147,"pkt_l4_len":113,"thread_ts_msec":1597326981296,"pkt":"AAwpBeNBAAAAuxzeCABFAACFAA0AAP8Ro6L6OnBXHjaO8AChzNMAcYE6MGcCAQMwEAIEW6KoJAICBdwEAQACAQMEHTAbBAyAAAAJAwCqu8wAAQACAQwCAgLRBAAEAAQAMDEEDIAAAAkDAKq7zAABAAQAqB8CBAxVvh4CAQACAQAwETAPBgorBgEGAw8BAQQAQQEC"} +00589{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":25,"source":"snmp.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_last_seen":1597326981298,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":157,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":157,"pkt_l4_len":123,"thread_ts_msec":1597326981298,"pkt":"AAAAuxzeAAwpBeNBCABFAACPyaxAAEARWPkeNo7w+jpwV8zTAKEAezX3MHECAQMwEQIEW6KoIwIDAP\/jBAEEAgEDBCkwJwQMgAAACQMAqrvMAAEAAgEMAgIC0QQMTk9BVVRITk9QUklWBAAEADAuBAyAAAAJAwCqu8wAAQAEAKEcAgQMVb4dAgEAAgEAMA4wDAYIKwYBAgEBBAAFAA=="} +00548{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":29,"source":"snmp.pcap","alias":"nDPId-test","packets-captured":29,"packets-processed":28,"total-skipped-flows":0,"total-l4-data-len":2120,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":6,"total-detection-updates":0,"total-updates":0,"current-active-flows":6,"total-active-flows":6,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":33,"global_ts_msec":1597327640387} +00576{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":29,"source":"snmp.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597327640387,"flow_last_seen":1597327640387,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":1597327640387,"l3_proto":"ip4","src_ip":"35.95.158.217","dst_ip":"30.79.214.36","src_port":60440,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00521{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":29,"source":"snmp.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_last_seen":1597327640387,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"thread_ts_msec":1597327640387,"pkt":"AAAA82AcAAwpEAFdCABFAABcnENAAEAR56EjX57ZHk\/WJOwYAKEASB50MD4CAQMwEQIEPsyxCwIDAP\/jBAEEAgEDBBAwDgQAAgEAAgEABAAEAAQAMBQEAAQAoA4CBGdAU6sCAQACAQAwAA=="} +00635{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":29,"source":"snmp.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597327640387,"flow_last_seen":1597327640387,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":1597327640387,"l3_proto":"ip4","src_ip":"35.95.158.217","dst_ip":"30.79.214.36","src_port":60440,"dst_port":161,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00572{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":30,"source":"snmp.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_last_seen":1597327640485,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":147,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":147,"pkt_l4_len":113,"thread_ts_msec":1597327640485,"pkt":"AAwpEAFdAAAA82AcCABFAACFAC4AAP8RBI4eT9YkI1+e2QCh7BgAcbQKMGcCAQMwEAIEPsyxCwICBdwEAQACAQMEHTAbBAyAAAAJAwCqu8wAAQACAQwCAgVkBAAEAAQAMDEEDIAAAAkDAKq7zAABAAQAqB8CBGdAU6sCAQACAQAwETAPBgorBgEGAw8BAQQAQQEN"} +00602{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":31,"source":"snmp.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":3,"flow_last_seen":1597327640489,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":167,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":167,"pkt_l4_len":133,"thread_ts_msec":1597327640489,"pkt":"AAAA82AcAAwpEAFdCABFAACZnE9AAEAR51gjX57ZHk\/WJOwYAKEAhSYyMHsCAQMwEQIEPsyxCgIDAP\/jBAEFAgEDBDMwMQQMgAAACQMAqrvMAAEAAgEMAgIFZAQKU0hBMU5PUFJJVgQM+aZLjyUgeKDqkPwVBAAwLgQMgAAACQMAqrvMAAEABAChHAIEZ0BTqgIBAAIBADAOMAwGCCsGAQIBAQUABQA="} +00576{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":35,"source":"snmp.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597327646611,"flow_last_seen":1597327646611,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":1597327646611,"l3_proto":"ip4","src_ip":"35.95.158.217","dst_ip":"30.79.214.36","src_port":49306,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00521{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":35,"source":"snmp.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_last_seen":1597327646611,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"thread_ts_msec":1597327646611,"pkt":"AAAA82AcAAwpEAFdCABFAABcoAFAAEAR4+MjX57ZHk\/WJMCaAKEASMHoMD4CAQMwEQIEaTnV4AIDAP\/jBAEEAgEDBBAwDgQAAgEAAgEABAAEAAQAMBQEAAQAoA4CBH1wgzUCAQACAQAwAA=="} +00635{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":35,"source":"snmp.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597327646611,"flow_last_seen":1597327646611,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":1597327646611,"l3_proto":"ip4","src_ip":"35.95.158.217","dst_ip":"30.79.214.36","src_port":49306,"dst_port":161,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00572{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":36,"source":"snmp.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_last_seen":1597327646725,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":147,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":147,"pkt_l4_len":113,"thread_ts_msec":1597327646725,"pkt":"AAwpEAFdAAAA82AcCABFAACFADEAAP8RBIseT9YkI1+e2QChwJoAcVZ4MGcCAQMwEAIEaTnV4AICBdwEAQACAQMEHTAbBAyAAAAJAwCqu8wAAQACAQwCAgVrBAAEAAQAMDEEDIAAAAkDAKq7zAABAAQAqB8CBH1wgzUCAQACAQAwETAPBgorBgEGAw8BAQQAQQEO"} +00602{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":37,"source":"snmp.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":3,"flow_last_seen":1597327646730,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":167,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":167,"pkt_l4_len":133,"thread_ts_msec":1597327646730,"pkt":"AAAA82AcAAwpEAFdCABFAACZoDlAAEAR424jX57ZHk\/WJMCaAKEAhS98MHsCAQMwEQIEaTnV3wIDAP\/jBAEFAgEDBDMwMQQMgAAACQMAqrvMAAEAAgEMAgIFawQKU0hBMU5PUFJJVgQMdsqnL4gHLPYGipA6BAAwLgQMgAAACQMAqrvMAAEABAChHAIEfXCDNAIBAAIBADAOMAwGCCsGAQIBAQQABQA="} +00676{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":41,"source":"snmp.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1597326838035,"flow_last_seen":1597326838291,"flow_idle_time":180000,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":57,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":1597327647026,"l3_proto":"ip4","src_ip":"65.2.162.193","dst_ip":"130.70.149.185","src_port":59988,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00675{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":41,"source":"snmp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1597326815572,"flow_last_seen":1597326815833,"flow_idle_time":180000,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":57,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":49,"midstream":0,"thread_ts_msec":1597327647026,"l3_proto":"ip4","src_ip":"176.211.60.43","dst_ip":"97.0.115.163","src_port":43015,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00678{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":41,"source":"snmp.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":1597326976979,"flow_last_seen":1597326977413,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":128,"flow_tot_l4_payload_len":653,"flow_avg_l4_payload_len":108,"midstream":0,"thread_ts_msec":1597327647026,"l3_proto":"ip4","src_ip":"30.54.142.240","dst_ip":"250.58.112.87","src_port":56251,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00676{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":41,"source":"snmp.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1597326863415,"flow_last_seen":1597326863776,"flow_idle_time":180000,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":205,"flow_avg_l4_payload_len":51,"midstream":0,"thread_ts_msec":1597327647026,"l3_proto":"ip4","src_ip":"65.2.162.193","dst_ip":"130.70.149.185","src_port":58433,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00675{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":41,"source":"snmp.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1597326858008,"flow_last_seen":1597326858289,"flow_idle_time":180000,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":205,"flow_avg_l4_payload_len":51,"midstream":0,"thread_ts_msec":1597327647026,"l3_proto":"ip4","src_ip":"176.211.60.43","dst_ip":"97.0.115.163","src_port":37224,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00678{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":41,"source":"snmp.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":1597326981183,"flow_last_seen":1597326981598,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":136,"flow_tot_l4_payload_len":661,"flow_avg_l4_payload_len":110,"midstream":0,"thread_ts_msec":1597327647026,"l3_proto":"ip4","src_ip":"30.54.142.240","dst_ip":"250.58.112.87","src_port":52435,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00578{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":41,"source":"snmp.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597327800258,"flow_last_seen":1597327800258,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":1597327800258,"l3_proto":"ip4","src_ip":"131.179.49.165","dst_ip":"254.158.1.169","src_port":60694,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00521{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":41,"source":"snmp.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_last_seen":1597327800258,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"thread_ts_msec":1597327800258,"pkt":"AAAAV4hpAAwpsVpsCABFAABcjYRAAEAR92yDszGl\/p4Bqe0WAKEASKFzMD4CAQMwEQIESC476wIDAP\/jBAEEAgEDBBAwDgQAAgEAAgEABAAEAAQAMBQEAAQAoA4CBFFbpQoCAQACAQAwAA=="} +00637{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":41,"source":"snmp.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597327800258,"flow_last_seen":1597327800258,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":1597327800258,"l3_proto":"ip4","src_ip":"131.179.49.165","dst_ip":"254.158.1.169","src_port":60694,"dst_port":161,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00572{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":42,"source":"snmp.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_last_seen":1597327800373,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":147,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":147,"pkt_l4_len":113,"thread_ts_msec":1597327800373,"pkt":"AAwpsVpsAAAAV4hpCABFAACFADwAAP8RBYz+ngGpg7MxpQCh7RYAcTFqMGcCAQMwEAIESC476wICBdwEAQACAQMEHTAbBAyAAAAJAwCqu8wAAQACAQwCAgYEBAAEAAQAMDEEDIAAAAkDAKq7zAABAAQAqB8CBFFbpQoCAQACAQAwETAPBgorBgEGAw8BAQQAQQES"} +00619{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":43,"source":"snmp.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":3,"flow_last_seen":1597327800375,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":178,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":178,"pkt_l4_len":144,"thread_ts_msec":1597327800375,"pkt":"AAAAV4hpAAwpsVpsCABFAACkjZFAAEAR9xeDszGl\/p4Bqe0WAKEAkIDGMIGFAgEDMBECBEguO+oCAwD\/4wQBBwIBAwQ7MDkEDIAAAAkDAKq7zAABAAIBDAICBgQEClNIQTFBRVMxMjgEDFRZRuSc\/VhrMMFzGAQIOby89G+ocM4EMAJRqrL1y0ddF49kZLmuqEd2Zc5EUOuNk0HcYVl0aShUgcBxMzYymbe4GgHUhuqMnA=="} +00579{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":47,"source":"snmp.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597327805470,"flow_last_seen":1597327805470,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":1597327805470,"l3_proto":"ip4","src_ip":"131.179.49.165","dst_ip":"254.158.1.169","src_port":35970,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00522{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":47,"source":"snmp.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_last_seen":1597327805470,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"thread_ts_msec":1597327805470,"pkt":"AAAAV4hpAAwpsVpsCABFAABcmE1AAEAR7KODszGl\/p4BqYyCAKEASI48MD4CAQMwEQIETLLWIgIDAP\/jBAEEAgEDBBAwDgQAAgEAAgEABAAEAAQAMBQEAAQAoA4CBG51QB0CAQACAQAwAA=="} +00638{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":47,"source":"snmp.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597327805470,"flow_last_seen":1597327805470,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":64,"flow_avg_l4_payload_len":64,"midstream":0,"thread_ts_msec":1597327805470,"l3_proto":"ip4","src_ip":"131.179.49.165","dst_ip":"254.158.1.169","src_port":35970,"dst_port":161,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00573{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":48,"source":"snmp.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_last_seen":1597327805611,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":147,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":147,"pkt_l4_len":113,"thread_ts_msec":1597327805611,"pkt":"AAwpsVpsAAAAV4hpCABFAACFAD8AAP8RBYn+ngGpg7MxpQChjIIAcR0uMGcCAQMwEAIETLLWIgICBdwEAQACAQMEHTAbBAyAAAAJAwCqu8wAAQACAQwCAgYJBAAEAAQAMDEEDIAAAAkDAKq7zAABAAQAqB8CBG51QB0CAQACAQAwETAPBgorBgEGAw8BAQQAQQET"} +00621{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":49,"source":"snmp.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":3,"flow_last_seen":1597327805613,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":178,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":178,"pkt_l4_len":144,"thread_ts_msec":1597327805613,"pkt":"AAAAV4hpAAwpsVpsCABFAACkmNVAAEAR69ODszGl\/p4BqYyCAKEAkN2JMIGFAgEDMBECBEyy1iECAwD\/4wQBBwIBAwQ7MDkEDIAAAAkDAKq7zAABAAIBDAICBgkEClNIQTFBRVMxMjgEDJtziJHxaodwRs3eIQQIgB4HBiglqmIEMAupq3l+cOYYEzoCHoY5O4X4TJUa2wXJNOK\/b37r1sMKQ+nPnY1s\/d1MAtxa8BQz+g=="} +00550{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":53,"source":"snmp.pcap","alias":"nDPId-test","packets-captured":53,"packets-processed":52,"total-skipped-flows":0,"total-l4-data-len":4998,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":10,"total-detection-updates":0,"total-updates":0,"current-active-flows":4,"total-active-flows":10,"total-idle-flows":6,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":60,"global_ts_msec":1597328385284} +00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":53,"source":"snmp.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597328385284,"flow_last_seen":1597328385284,"flow_idle_time":180000,"flow_min_l4_payload_len":173,"flow_max_l4_payload_len":173,"flow_tot_l4_payload_len":173,"flow_avg_l4_payload_len":173,"midstream":0,"thread_ts_msec":1597328385284,"l3_proto":"ip4","src_ip":"92.135.15.240","dst_ip":"137.49.110.186","src_port":54318,"dst_port":162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00667{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":53,"source":"snmp.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_last_seen":1597328385284,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":215,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":215,"pkt_l4_len":181,"thread_ts_msec":1597328385284,"pkt":"AAwpOSzhAAAASwKNCABFAADJAAAAAP8RVsFchw\/wiTFuutQuAKIAtdeqMIGqAgEBBAhwdWJsaWMyY6eBmgIBFwIBAAIBADCBjjAPBggrBgECAQEDAEMDAz\/FMBcGCisGAQYDAQEEAQAGCSsGAQYDAQEFAzAPBgorBgECAQICAQECAgECMBkGCisGAQIBAgIBAgIEC0V0aGVybmV0MC8xMA8GCisGAQIBAgIBAwICAQYwJQYMKwYBBAEJAgIBARQCBBVhZG1pbmlzdHJhdGl2ZWx5IGRvd24="} +00642{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":53,"source":"snmp.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597328385284,"flow_last_seen":1597328385284,"flow_idle_time":180000,"flow_min_l4_payload_len":173,"flow_max_l4_payload_len":173,"flow_tot_l4_payload_len":173,"flow_avg_l4_payload_len":173,"midstream":0,"thread_ts_msec":1597328385284,"l3_proto":"ip4","src_ip":"92.135.15.240","dst_ip":"137.49.110.186","src_port":54318,"dst_port":162,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00679{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":54,"source":"snmp.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":1597327800258,"flow_last_seen":1597327800683,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":149,"flow_tot_l4_payload_len":737,"flow_avg_l4_payload_len":122,"midstream":0,"thread_ts_msec":1597328385284,"l3_proto":"ip4","src_ip":"131.179.49.165","dst_ip":"254.158.1.169","src_port":60694,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00677{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":54,"source":"snmp.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":1597327640387,"flow_last_seen":1597327640799,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":139,"flow_tot_l4_payload_len":695,"flow_avg_l4_payload_len":115,"midstream":0,"thread_ts_msec":1597328385284,"l3_proto":"ip4","src_ip":"35.95.158.217","dst_ip":"30.79.214.36","src_port":60440,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00677{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":54,"source":"snmp.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":1597327646611,"flow_last_seen":1597327647026,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":146,"flow_tot_l4_payload_len":702,"flow_avg_l4_payload_len":117,"midstream":0,"thread_ts_msec":1597328385284,"l3_proto":"ip4","src_ip":"35.95.158.217","dst_ip":"30.79.214.36","src_port":49306,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00680{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":54,"source":"snmp.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":1597327805470,"flow_last_seen":1597327805899,"flow_idle_time":180000,"flow_min_l4_payload_len":64,"flow_max_l4_payload_len":156,"flow_tot_l4_payload_len":744,"flow_avg_l4_payload_len":124,"midstream":0,"thread_ts_msec":1597328385284,"l3_proto":"ip4","src_ip":"131.179.49.165","dst_ip":"254.158.1.169","src_port":35970,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00638{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":54,"source":"snmp.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_last_seen":1597328420435,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":195,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":195,"pkt_l4_len":161,"thread_ts_msec":1597328420435,"pkt":"AAwpOSzhAAAASwKNCABFAAC1AAEAAP8RVtRchw\/wiTFuutQuAKIAoQR+MIGWAgEBBAhwdWJsaWMyY6eBhgIBHAIBAAIBADB7MA8GCCsGAQIBAQMAQwMDTYAwFwYKKwYBBgMBAQQBAAYJKwYBBgMBAQUEMA8GCisGAQIBAgIBAQICAQIwGQYKKwYBAgECAgECAgQLRXRoZXJuZXQwLzEwDwYKKwYBAgECAgEDAgIBBjASBgwrBgEEAQkCAgEBFAIEAnVw"} +00585{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":55,"source":"snmp.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597328648399,"flow_last_seen":1597328648399,"flow_idle_time":180000,"flow_min_l4_payload_len":146,"flow_max_l4_payload_len":146,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":146,"midstream":0,"thread_ts_msec":1597328648399,"l3_proto":"ip4","src_ip":"200.76.132.137","dst_ip":"189.111.255.214","src_port":54318,"dst_port":162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00632{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":55,"source":"snmp.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_last_seen":1597328648399,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":188,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":188,"pkt_l4_len":154,"thread_ts_msec":1597328648399,"pkt":"AAwpl\/zFAAAAQogiCABFAACuAAIAAP8RsSDITISJvW\/\/1tQuAKIAmmoKMIGPAgEABAZwdWJsaWOkgYEGCCsGAQYDAQEFQAQKAR4BAgECAgEAQwMDpowwZDAPBgorBgECAQICAQECAgECMBkGCisGAQIBAgIBAgIEC0V0aGVybmV0MC8xMA8GCisGAQIBAgIBAwICAQYwJQYMKwYBBAEJAgIBARQCBBVhZG1pbmlzdHJhdGl2ZWx5IGRvd24="} +00644{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":55,"source":"snmp.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597328648399,"flow_last_seen":1597328648399,"flow_idle_time":180000,"flow_min_l4_payload_len":146,"flow_max_l4_payload_len":146,"flow_tot_l4_payload_len":146,"flow_avg_l4_payload_len":146,"midstream":0,"thread_ts_msec":1597328648399,"l3_proto":"ip4","src_ip":"200.76.132.137","dst_ip":"189.111.255.214","src_port":54318,"dst_port":162,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00584{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":56,"source":"snmp.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1597328385284,"flow_last_seen":1597328420435,"flow_idle_time":180000,"flow_min_l4_payload_len":153,"flow_max_l4_payload_len":173,"flow_tot_l4_payload_len":326,"flow_avg_l4_payload_len":163,"midstream":0,"thread_ts_msec":1597328648399,"l3_proto":"ip4","src_ip":"92.135.15.240","dst_ip":"137.49.110.186","src_port":54318,"dst_port":162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00604{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":56,"source":"snmp.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_last_seen":1597328660640,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":167,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":167,"pkt_l4_len":133,"thread_ts_msec":1597328660640,"pkt":"AAwpl\/zFAAAAQogiCABFAACZAAMAAP8RsTTITISJvW\/\/1tQuAKIAhYZxMHsCAQAEBnB1YmxpY6RuBggrBgEGAwEBBUAECgEeAQIBAwIBAEMDA6tUMFEwDwYKKwYBAgECAgEBAgIBAjAZBgorBgECAQICAQICBAtFdGhlcm5ldDAvMTAPBgorBgECAQICAQMCAgEGMBIGDCsGAQQBCQICAQEUAgQCdXA="} +00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":57,"source":"snmp.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597328704045,"flow_last_seen":1597328704045,"flow_idle_time":180000,"flow_min_l4_payload_len":250,"flow_max_l4_payload_len":250,"flow_tot_l4_payload_len":250,"flow_avg_l4_payload_len":250,"midstream":0,"thread_ts_msec":1597328704045,"l3_proto":"ip4","src_ip":"113.19.156.111","dst_ip":"135.201.124.55","src_port":54318,"dst_port":162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00769{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":57,"source":"snmp.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_last_seen":1597328704045,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":292,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":292,"pkt_l4_len":258,"thread_ts_msec":1597328704045,"pkt":"AAwpOzE1AAAAQZqWCABFAAEWAAQAAP8RqU9xE5xvh8l8N9QuAKIBAqHIMIH3AgEDMA0CASACAgXcBAEBAgEDBDMwMQQMgAAACQMAqrvMAAEAAgEMAgIJjAQKU0hBMU5PUFJJVgQM1oH0ll47GC4cDzqhBAAwga0EDIAAAAkDAKq7zAABAAQAp4GaAgEnAgEAAgEAMIGOMA8GCCsGAQIBAQMAQwMDvEgwFwYKKwYBBgMBAQQBAAYJKwYBBgMBAQUDMA8GCisGAQIBAgIBAQICAQIwGQYKKwYBAgECAgECAgQLRXRoZXJuZXQwLzEwDwYKKwYBAgECAgEDAgIBBjAlBgwrBgEEAQkCAgEBFAIEFWFkbWluaXN0cmF0aXZlbHkgZG93bg=="} +00643{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":57,"source":"snmp.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597328704045,"flow_last_seen":1597328704045,"flow_idle_time":180000,"flow_min_l4_payload_len":250,"flow_max_l4_payload_len":250,"flow_tot_l4_payload_len":250,"flow_avg_l4_payload_len":250,"midstream":0,"thread_ts_msec":1597328704045,"l3_proto":"ip4","src_ip":"113.19.156.111","dst_ip":"135.201.124.55","src_port":54318,"dst_port":162,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00741{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":58,"source":"snmp.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_last_seen":1597328710051,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":272,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":272,"pkt_l4_len":238,"thread_ts_msec":1597328710051,"pkt":"AAwpOzE1AAAAQZqWCABFAAECAAUAAP8RqWJxE5xvh8l8N9QuAKIA7p+NMIHjAgEDMA0CASMCAgXcBAEBAgEDBDMwMQQMgAAACQMAqrvMAAEAAgEMAgIJkgQKU0hBMU5PUFJJVgQMcPbtNC5tixaBN+YcBAAwgZkEDIAAAAkDAKq7zAABAAQAp4GGAgEqAgEAAgEAMHswDwYIKwYBAgEBAwBDAwO+oTAXBgorBgEGAwEBBAEABgkrBgEGAwEBBQQwDwYKKwYBAgECAgEBAgIBAjAZBgorBgECAQICAQICBAtFdGhlcm5ldDAvMTAPBgorBgECAQICAQMCAgEGMBIGDCsGAQQBCQICAQEUAgQCdXA="} +00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":59,"source":"snmp.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597328734790,"flow_last_seen":1597328734790,"flow_idle_time":180000,"flow_min_l4_payload_len":262,"flow_max_l4_payload_len":262,"flow_tot_l4_payload_len":262,"flow_avg_l4_payload_len":262,"midstream":0,"thread_ts_msec":1597328734790,"l3_proto":"ip4","src_ip":"205.83.36.228","dst_ip":"160.174.106.32","src_port":54318,"dst_port":162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00789{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":59,"source":"snmp.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_last_seen":1597328734790,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"thread_ts_msec":1597328734790,"pkt":"AAwpO2J6AAAAsIjCCABFAAEiAAYAAP8Rvb7NUyTkoK5qINQuAKIBDjinMIIBAgIBAzANAgElAgIF3AQBAwIBAwQ7MDkEDIAAAAkDAKq7zAABAAIBDAICCaoEClNIQTFBRVMxMjgEDPKVtczhvcY8vhvJVAQIsS3M0yiHjgUEgbAnmr8wOCOyncERaoSBQmnUCi+GoiiHqqCMFm1apQAmwk\/cF1kswlENhkIfwuB9kMILtKYuWyXXhtZBleYhoJQEJYL7o1K69bHQdMdklHbovW30zBhWTTYkhrDbN4HddHDCYjhho5GVn7THewhnReV4IFApn9hzgyZDXzSTb2D\/0RJlFbaWfzYDq0UV1+MA7WWFcwUGZiNX1Ldy1p\/JOH\/FaH0e0KzJstFu7lv44GdmqQ=="} +00642{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":59,"source":"snmp.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597328734790,"flow_last_seen":1597328734790,"flow_idle_time":180000,"flow_min_l4_payload_len":262,"flow_max_l4_payload_len":262,"flow_tot_l4_payload_len":262,"flow_avg_l4_payload_len":262,"midstream":0,"thread_ts_msec":1597328734790,"l3_proto":"ip4","src_ip":"205.83.36.228","dst_ip":"160.174.106.32","src_port":54318,"dst_port":162,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00763{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":60,"source":"snmp.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_last_seen":1597328742081,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":283,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":283,"pkt_l4_len":249,"thread_ts_msec":1597328742081,"pkt":"AAwpO2J6AAAAsIjCCABFAAENAAcAAP8RvdLNUyTkoK5qINQuAKIA+WP9MIHuAgEDMA0CAScCAgXcBAEDAgEDBDswOQQMgAAACQMAqrvMAAEAAgEMAgIJsgQKU0hBMUFFUzEyOAQMO\/P\/PiMrdy+zI+pWBAixLczTKIeOBgSBnCB4NWdRsPt\/T9sXiMHAl69GjDJCReyQSzQtmF\/nJsUYLVpgPIp8uZxxPNbTjAYUMQF1Osi1p+iIFHpG7RpGbbDoCSdQgbLhTwfCVCvu95CHITG6rLcZ3QulV6HanbKQFQQW+YRQ9YjpumIMl5\/KtH3Wg4qxgFbt6UHjjb8VdU58\/THnGpgoaAoCTQPlYaIf1lQq7RYRPcJRLqyyuw=="} +00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":61,"source":"snmp.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597328757701,"flow_last_seen":1597328757701,"flow_idle_time":180000,"flow_min_l4_payload_len":240,"flow_max_l4_payload_len":240,"flow_tot_l4_payload_len":240,"flow_avg_l4_payload_len":240,"midstream":0,"thread_ts_msec":1597328757701,"l3_proto":"ip4","src_ip":"124.53.196.176","dst_ip":"103.248.22.47","src_port":54318,"dst_port":162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00754{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":61,"source":"snmp.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_last_seen":1597328757701,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":282,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":282,"pkt_l4_len":248,"thread_ts_msec":1597328757701,"pkt":"AAwpbM85AAAAgfGMCABFAAEMAAgAAP8R+8t8NcSwZ\/gWL9QuAKIA+FTTMIHtAgEDMA0CASgCAgXcBAEAAgEDBCkwJwQMgAAACQMAqrvMAAEAAgEMAgIJwQQMTk9BVVRITk9QUklWBAAEADCBrQQMgAAACQMAqrvMAAEABACngZoCAS8CAQACAQAwgY4wDwYIKwYBAgEBAwBDAwPRPjAXBgorBgEGAwEBBAEABgkrBgEGAwEBBQMwDwYKKwYBAgECAgEBAgIBAjAZBgorBgECAQICAQICBAtFdGhlcm5ldDAvMTAPBgorBgECAQICAQMCAgEGMCUGDCsGAQQBCQICAQEUAgQVYWRtaW5pc3RyYXRpdmVseSBkb3du"} +00642{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":61,"source":"snmp.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1597328757701,"flow_last_seen":1597328757701,"flow_idle_time":180000,"flow_min_l4_payload_len":240,"flow_max_l4_payload_len":240,"flow_tot_l4_payload_len":240,"flow_avg_l4_payload_len":240,"midstream":0,"thread_ts_msec":1597328757701,"l3_proto":"ip4","src_ip":"124.53.196.176","dst_ip":"103.248.22.47","src_port":54318,"dst_port":162,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00731{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":62,"source":"snmp.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_last_seen":1597328765050,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":262,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":262,"pkt_l4_len":228,"thread_ts_msec":1597328765050,"pkt":"AAwpbM85AAAAgfGMCABFAAD4AAkAAP8R+958NcSwZ\/gWL9QuAKIA5B3\/MIHZAgEDMA0CASkCAgXcBAEAAgEDBCkwJwQMgAAACQMAqrvMAAEAAgEMAgIJyQQMTk9BVVRITk9QUklWBAAEADCBmQQMgAAACQMAqrvMAAEABACngYYCATACAQACAQAwezAPBggrBgECAQEDAEMDA9QeMBcGCisGAQYDAQEEAQAGCSsGAQYDAQEFBDAPBgorBgECAQICAQECAgECMBkGCisGAQIBAgIBAgIEC0V0aGVybmV0MC8xMA8GCisGAQIBAgIBAwICAQYwEgYMKwYBBAEJAgIBARQCBAJ1cA=="} +00551{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":63,"source":"snmp.pcap","alias":"nDPId-test","packets-captured":63,"packets-processed":62,"total-skipped-flows":0,"total-l4-data-len":7038,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":15,"total-detection-updates":0,"total-updates":0,"current-active-flows":4,"total-active-flows":15,"total-idle-flows":11,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":86,"global_ts_msec":1643702947966} +00579{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":63,"source":"snmp.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1643702947966,"flow_last_seen":1643702947966,"flow_idle_time":180000,"flow_min_l4_payload_len":185,"flow_max_l4_payload_len":185,"flow_tot_l4_payload_len":185,"flow_avg_l4_payload_len":185,"midstream":0,"thread_ts_msec":1643702947966,"l3_proto":"ip4","src_ip":"10.231.2.134","dst_ip":"10.72.247.4","src_port":161,"dst_port":61088,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00686{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":63,"source":"snmp.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_last_seen":1643702947966,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":231,"pkt_type":2048,"pkt_l3_offset":18,"pkt_l4_offset":38,"pkt_len":231,"pkt_l4_len":193,"thread_ts_msec":1643702947966,"pkt":"AAAAAAAAAAEAAAAIgQADjAgARcAA1To\/AABAETBgCucChgpI9wQAoe6gAMF5TzCCALUCAQEEBGFkc2yiggCoAgJkLgIBEwIBATCCAJowggCWBg8rBgEEAa1zWwEBAQEBDwEEgYJCR01QAQAAAAAAAAEwMDAwMDAAAAAAAAAAAAAAAABSMS42MS4xMi4wMAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAQAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAQAA"} +00638{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":63,"source":"snmp.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1643702947966,"flow_last_seen":1643702947966,"flow_idle_time":180000,"flow_min_l4_payload_len":185,"flow_max_l4_payload_len":185,"flow_tot_l4_payload_len":185,"flow_avg_l4_payload_len":185,"midstream":0,"thread_ts_msec":1643702947966,"l3_proto":"ip4","src_ip":"10.231.2.134","dst_ip":"10.72.247.4","src_port":161,"dst_port":61088,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00586{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":64,"source":"snmp.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_packets_processed":2,"flow_first_seen":1597328648399,"flow_last_seen":1597328660640,"flow_idle_time":180000,"flow_min_l4_payload_len":125,"flow_max_l4_payload_len":146,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":135,"midstream":0,"thread_ts_msec":1643702947966,"l3_proto":"ip4","src_ip":"200.76.132.137","dst_ip":"189.111.255.214","src_port":54318,"dst_port":162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00682{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":64,"source":"snmp.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1597328704045,"flow_last_seen":1597328710051,"flow_idle_time":180000,"flow_min_l4_payload_len":230,"flow_max_l4_payload_len":250,"flow_tot_l4_payload_len":480,"flow_avg_l4_payload_len":240,"midstream":0,"thread_ts_msec":1643702947966,"l3_proto":"ip4","src_ip":"113.19.156.111","dst_ip":"135.201.124.55","src_port":54318,"dst_port":162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00681{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":64,"source":"snmp.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1597328757701,"flow_last_seen":1597328765050,"flow_idle_time":180000,"flow_min_l4_payload_len":220,"flow_max_l4_payload_len":240,"flow_tot_l4_payload_len":460,"flow_avg_l4_payload_len":230,"midstream":0,"thread_ts_msec":1643702947966,"l3_proto":"ip4","src_ip":"124.53.196.176","dst_ip":"103.248.22.47","src_port":54318,"dst_port":162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00681{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":64,"source":"snmp.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1597328734790,"flow_last_seen":1597328742081,"flow_idle_time":180000,"flow_min_l4_payload_len":241,"flow_max_l4_payload_len":262,"flow_tot_l4_payload_len":503,"flow_avg_l4_payload_len":251,"midstream":0,"thread_ts_msec":1643702947966,"l3_proto":"ip4","src_ip":"205.83.36.228","dst_ip":"160.174.106.32","src_port":54318,"dst_port":162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00685{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":64,"source":"snmp.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_last_seen":1643702958965,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":231,"pkt_type":2048,"pkt_l3_offset":18,"pkt_l4_offset":38,"pkt_len":231,"pkt_l4_len":193,"thread_ts_msec":1643702958965,"pkt":"AAAAAAAAAAEAAAAIgQADjAgARcAA1fKQAABAEXgOCucChgpI9wQAoe6gAMFeTzCCALUCAQEEBGFkc2yiggCoAgJkSQIBEwIBATCCAJowggCWBg8rBgEEAa1zWwEBAQEBDwEEgYJCR01QAQAAAAAAAAEwMDAwMDAAAAAAAAAAAAAAAABSMS42MS4xMi4wMAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAQAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAQAA"} +00686{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":65,"source":"snmp.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":3,"flow_last_seen":1643702975965,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":231,"pkt_type":2048,"pkt_l3_offset":18,"pkt_l4_offset":38,"pkt_len":231,"pkt_l4_len":193,"thread_ts_msec":1643702975965,"pkt":"AAAAAAAAAAEAAAAIgQADjAgARcAA1RJZAABAEVhGCucChgpI9wQAoe6gAME\/TzCCALUCAQEEBGFkc2yiggCoAgJkaAIBEwIBATCCAJowggCWBg8rBgEEAa1zWwEBAQEBDwEEgYJCR01QAQAAAAAAAAEwMDAwMDAAAAAAAAAAAAAAAABSMS42MS4xMi4wMAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAQAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAQAA"} +00584{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":66,"source":"snmp.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1643702987695,"flow_last_seen":1643702987695,"flow_idle_time":180000,"flow_min_l4_payload_len":1097,"flow_max_l4_payload_len":1097,"flow_tot_l4_payload_len":1097,"flow_avg_l4_payload_len":1097,"midstream":0,"thread_ts_msec":1643702987695,"l3_proto":"ip4","src_ip":"10.99.8.88","dst_ip":"10.100.253.146","src_port":43242,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +01906{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":66,"source":"snmp.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_last_seen":1643702987695,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1143,"pkt_type":2048,"pkt_l3_offset":18,"pkt_l4_offset":38,"pkt_len":1143,"pkt_l4_len":1105,"thread_ts_msec":1643702987695,"pkt":"AAAAAAAAAAUAAAAIgQAFHAgARQAEZQAAQAA7ESDXCmMIWApk\/ZKo6gChBFEqBzCCBEUCAQEEBnB1YmxpY6CCBDYCBCYSfb8CAQACAQAwggQmMA8GCysGAQIBHwEBAQZkBQAwDwYLKwYBAgEfAQEBCmwFADAPBgsrBgECAR8BAQEKBgUAMA8GCysGAQIBHwEBAQYLBQAwDwYLKwYBAgEfAQEBBk4FADAPBgsrBgECAR8BAQEGXQUAMA8GCysGAQIBHwEBAQpFBQAwDwYLKwYBAgEfAQEBCgEFADAPBgsrBgECAWMBAQEEEQUAMBAGDCsGAQIBHwEBAQaBAAUAMA8GCysGAQIBHwEBAQoDBQAwDwYLKwYBAgEfAQEBBmMFADAQBgwrBgECAR8BAQEKgRAFADAPBgsrBgECAR8BAQEGSAUAMA8GCysGAQIBHwEBAQoWBQAwDwYLKwYBAgFjAQEBBBMFADAPBgsrBgECAR8BAQEKRwUAMBAGDCsGAQIBHwEBAQaBCQUAMA8GCysGAQIBHwEBAQYCBQAwDwYLKwYBAgEfAQEBCkwFADAPBgsrBgECAR8BAQEKXgUAMA8GCysGAQIBHwEBAQpvBQAwDwYLKwYBAgEfAQEBCmEFADAPBgsrBgECAR8BAQEKOAUAMA8GCysGAQIBHwEBAQo\/BQAwDwYLKwYBAgEfAQEBBnYFADAPBgsrBgECAR8BAQEKFAUAMA8GCysGAQIBHwEBAQZfBQAwDwYLKwYBAgEfAQEBCkIFADAPBgsrBgECAR8BAQEKXwUAMA8GCysGAQIBHwEBAQZgBQAwEAYMKwYBAgEfAQEBCoEOBQAwEAYMKwYBAgEfAQEBBoELBQAwDwYLKwYBAgEfAQEBCjcFADAPBgsrBgECAR8BAQEKRgUAMBAGDCsGAQIBHwEBAQqBBwUAMBAGDCsGAQIBHwEBAQqETAUAMBAGDCsGAQIBHwEBAQqBDAUAMA8GCysGAQIBHwEBAQZHBQAwDwYLKwYBAgEfAQEBBlgFADAPBgsrBgECAR8BAQEGPQUAMA8GCysGAQIBHwEBAQZuBQAwDwYLKwYBAgEfAQEBBj4FADAPBgsrBgECAR8BAQEGUAUAMA8GCysGAQIBHwEBAQZpBQAwDwYLKwYBAgEfAQEBBnoFADAPBgsrBgECAR8BAQEKfwUAMA8GCysGAQIBHwEBAQZeBQAwDwYLKwYBAgEfAQEBBhQFADAPBgsrBgECAR8BAQEKTQUAMA8GCysGAQIBHwEBAQYEBQAwDwYLKwYBAgEfAQEBCjwFADAPBgsrBgECAR8BAQEKCgUAMA8GCysGAQIBHwEBAQYPBQAwDwYLKwYBAgEfAQEBBnsFADAPBgsrBgECAR8BAQEKeAUAMA8GCysGAQIBHwEBAQZUBQAwDwYLKwYBAgEfAQEBClUFADAPBgsrBgECAR8BAQEKewUAMA8GCysGAQIBHwEBAQZlBQAwDwYLKwYBAgEfAQEBBksFADAPBgsrBgECAR8BAQEGUgUA"} +00643{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":66,"source":"snmp.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1643702987695,"flow_last_seen":1643702987695,"flow_idle_time":180000,"flow_min_l4_payload_len":1097,"flow_max_l4_payload_len":1097,"flow_tot_l4_payload_len":1097,"flow_avg_l4_payload_len":1097,"midstream":0,"thread_ts_msec":1643702987695,"l3_proto":"ip4","src_ip":"10.99.8.88","dst_ip":"10.100.253.146","src_port":43242,"dst_port":161,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00474{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":67,"source":"snmp.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_last_seen":1643702987761,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":18,"pkt_l4_offset":38,"pkt_len":75,"pkt_l4_len":37,"thread_ts_msec":1643702987761,"pkt":"AAAAAAAAAAUAAAAIgQAFHAgARQAAOaWFAAA+Ebx9CmT9kgpjCFgAoajqACXVjjAbAgEBBAZwdWJsaWOiDgIEJhJ9vwIBAQIBADAA"} +01195{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":68,"source":"snmp.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":3,"flow_last_seen":1643702987763,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":611,"pkt_type":2048,"pkt_l3_offset":18,"pkt_l4_offset":38,"pkt_len":611,"pkt_l4_len":573,"thread_ts_msec":1643702987763,"pkt":"AAAAAAAAAAUAAAAIgQAFHAgARQACUQAAQAA7ESLrCmMIWApk\/ZKo6gChAj3MpjCCAjECAQEEBnB1YmxpY6CCAiICBCYSfcACAQACAQAwggISMA8GCysGAQIBHwEBAQZkBQAwDwYLKwYBAgEfAQEBCmwFADAPBgsrBgECAR8BAQEKBgUAMA8GCysGAQIBHwEBAQYLBQAwDwYLKwYBAgEfAQEBBk4FADAPBgsrBgECAR8BAQEGXQUAMA8GCysGAQIBHwEBAQpFBQAwDwYLKwYBAgEfAQEBCgEFADAPBgsrBgECAWMBAQEEEQUAMBAGDCsGAQIBHwEBAQaBAAUAMA8GCysGAQIBHwEBAQoDBQAwDwYLKwYBAgEfAQEBBmMFADAQBgwrBgECAR8BAQEKgRAFADAPBgsrBgECAR8BAQEGSAUAMA8GCysGAQIBHwEBAQoWBQAwDwYLKwYBAgFjAQEBBBMFADAPBgsrBgECAR8BAQEKRwUAMBAGDCsGAQIBHwEBAQaBCQUAMA8GCysGAQIBHwEBAQYCBQAwDwYLKwYBAgEfAQEBCkwFADAPBgsrBgECAR8BAQEKXgUAMA8GCysGAQIBHwEBAQpvBQAwDwYLKwYBAgEfAQEBCmEFADAPBgsrBgECAR8BAQEKOAUAMA8GCysGAQIBHwEBAQo\/BQAwDwYLKwYBAgEfAQEBBnYFADAPBgsrBgECAR8BAQEKFAUAMA8GCysGAQIBHwEBAQZfBQAwDwYLKwYBAgEfAQEBCkIFADAPBgsrBgECAR8BAQEKXwUAMA8GCysGAQIBHwEBAQZgBQA="} +00679{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":72,"source":"snmp.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":1643702987695,"flow_last_seen":1643702987801,"flow_idle_time":180000,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":1097,"flow_tot_l4_payload_len":3593,"flow_avg_l4_payload_len":598,"midstream":0,"thread_ts_msec":1643703001963,"l3_proto":"ip4","src_ip":"10.99.8.88","dst_ip":"10.100.253.146","src_port":43242,"dst_port":161,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00677{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":72,"source":"snmp.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"finished","flow_packets_processed":4,"flow_first_seen":1643702947966,"flow_last_seen":1643703001963,"flow_idle_time":180000,"flow_min_l4_payload_len":185,"flow_max_l4_payload_len":185,"flow_tot_l4_payload_len":740,"flow_avg_l4_payload_len":185,"midstream":0,"thread_ts_msec":1643703001963,"l3_proto":"ip4","src_ip":"10.231.2.134","dst_ip":"10.72.247.4","src_port":161,"dst_port":61088,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SNMP","breed":"Acceptable","category":"Network"}} +00555{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":72,"source":"snmp.pcap","alias":"nDPId-test","packets-captured":72,"packets-processed":72,"total-skipped-flows":0,"total-l4-data-len":11371,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":17,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":17,"total-idle-flows":17,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":103,"global_ts_msec":1643703001963} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 72/72 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 11371 bytes +~~ total detected protocols..: 17 +~~ total active/idle flows...: 17/17 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5194457 bytes +~~ total memory freed........: 5194457 bytes +~~ total allocations/frees...: 113145/113145 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 460 chars +~~ json string max len.......: 1911 chars +~~ json string avg len.......: 1180 chars diff --git a/test/results/socks-http-example.pcap.out b/test/results/socks-http-example.pcap.out new file mode 100644 index 000000000..1b5e6b26b --- /dev/null +++ b/test/results/socks-http-example.pcap.out @@ -0,0 +1,36 @@ +00469{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"socks-http-example.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00555{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"socks-http-example.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1386004309468} +00590{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1386004309468,"flow_last_seen":1386004309468,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1386004309468,"l3_proto":"ip4","src_ip":"10.180.156.185","dst_ip":"10.180.156.249","src_port":53533,"dst_port":1080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00494{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1386004309468,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"thread_ts_msec":1386004309468,"pkt":"ABNyxPHhAB9b\/1HLCABFAABAxApAAEAGJ5MKtJy5CrSc+dEdBDiu6S7xAAAAALAC\/\/9AOQAAAgQFtAEDAwQBAQgKFh7eWwAAAAAEAgAA"} +00488{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1386004309469,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1386004309469,"pkt":"AB9b\/1HLABNyxPHhCABFAAA8AABAAEAG66EKtJz5CrScuQQ40R2gPF01ruku8qASOJDLlAAAAgQFtAQCCApiX+0zFh7eWwEDAwc="} +00476{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1386004309469,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1386004309469,"pkt":"ABNyxPHhAB9b\/1HLCABFAAA0BhZAAEAG5ZMKtJy5CrSc+dEdBDiu6S7yoDxdNoAQICsSxgAAAQEIChYe3ltiX+0z"} +00647{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1386004309468,"flow_last_seen":1386004309473,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":9,"flow_tot_l4_payload_len":17,"flow_avg_l4_payload_len":2,"midstream":0,"thread_ts_msec":1386004309473,"l3_proto":"ip4","src_ip":"10.180.156.185","dst_ip":"10.180.156.249","src_port":53533,"dst_port":1080,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"SOCKS","breed":"Acceptable","category":"Web"}} +00591{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":15,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1386004312331,"flow_last_seen":1386004312331,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1386004312331,"l3_proto":"ip4","src_ip":"10.180.156.185","dst_ip":"10.180.156.249","src_port":53534,"dst_port":1080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00495{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1386004312331,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"thread_ts_msec":1386004312331,"pkt":"ABNyxPHhAB9b\/1HLCABFAABAPjdAAEAGrWYKtJy5CrSc+dEeBDi5gOhGAAAAALAC\/\/9xLQAAAgQFtAEDAwQBAQgKFh7peQAAAAAEAgAA"} +00490{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1386004312331,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1386004312331,"pkt":"AB9b\/1HLABNyxPHhCABFAAA8AABAAEAG66EKtJz5CrScuQQ40R7KitgsuYDoR6ASOJBMFQAAAgQFtAQCCApiX\/hhFh7peQEDAwc="} +00478{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1386004312331,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1386004312331,"pkt":"ABNyxPHhAB9b\/1HLCABFAAA0IDxAAEAGy20KtJy5CrSc+dEeBDi5gOhHyorYLYAQICuTRgAAAQEIChYe6XliX\/hh"} +00649{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":20,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1386004312331,"flow_last_seen":1386004312379,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":5,"midstream":0,"thread_ts_msec":1386004312379,"l3_proto":"ip4","src_ip":"10.180.156.185","dst_ip":"10.180.156.249","src_port":53534,"dst_port":1080,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"SOCKS","breed":"Acceptable","category":"Web"}} +00591{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":30,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1386004317979,"flow_last_seen":1386004317979,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1386004317979,"l3_proto":"ip4","src_ip":"10.180.156.185","dst_ip":"10.180.156.249","src_port":53535,"dst_port":1080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00498{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":30,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":1386004317979,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"thread_ts_msec":1386004317979,"pkt":"ABNyxPHhAB9b\/1HLCABFAABAZFdAAEAGh0YKtJy5CrSc+dEfBDg7J\/Q2AAAAALAC\/\/\/NpwAAAgQFtAEDAwQBAQgKFh7\/ZwAAAAAEAgAA"} +00490{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":31,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":1386004317980,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1386004317980,"pkt":"AB9b\/1HLABNyxPHhCABFAAA8AABAAEAG66EKtJz5CrScuQQ40R8tB48eOyf0N6ASOJB5EQAAAgQFtAQCCApiYA5xFh7\/ZwEDAwc="} +00479{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":32,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_last_seen":1386004317980,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":1386004317980,"pkt":"ABNyxPHhAB9b\/1HLCABFAAA0jiVAAEAGXYQKtJy5CrSc+dEfBDg7J\/Q3LQePH4AQICvAQgAAAQEIChYe\/2diYA5x"} +00694{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":46,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":14,"flow_first_seen":1386004309468,"flow_last_seen":1386004309478,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1754,"flow_avg_l4_payload_len":125,"midstream":0,"thread_ts_msec":1386004317989,"l3_proto":"ip4","src_ip":"10.180.156.185","dst_ip":"10.180.156.249","src_port":53533,"dst_port":1080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SOCKS","breed":"Acceptable","category":"Web"}} +00694{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":46,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":15,"flow_first_seen":1386004312331,"flow_last_seen":1386004312384,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1770,"flow_avg_l4_payload_len":118,"midstream":0,"thread_ts_msec":1386004317989,"l3_proto":"ip4","src_ip":"10.180.156.185","dst_ip":"10.180.156.249","src_port":53534,"dst_port":1080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"SOCKS","breed":"Acceptable","category":"Web"}} +00665{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":46,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":17,"flow_first_seen":1386004317979,"flow_last_seen":1386004317989,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1763,"flow_avg_l4_payload_len":103,"midstream":0,"thread_ts_msec":1386004317989,"l3_proto":"ip4","src_ip":"10.180.156.185","dst_ip":"10.180.156.249","src_port":53535,"dst_port":1080,"l4_proto":"tcp","ndpi": {"confidence": {"1":"Match by port"},"proto":"SOCKS","breed":"Acceptable","category":"Web"}} +00600{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":46,"source":"socks-http-example.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":17,"flow_first_seen":1386004317979,"flow_last_seen":1386004317989,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":1763,"flow_avg_l4_payload_len":103,"midstream":0,"thread_ts_msec":1386004317989,"l3_proto":"ip4","src_ip":"10.180.156.185","dst_ip":"10.180.156.249","src_port":53535,"dst_port":1080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00564{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":46,"source":"socks-http-example.pcap","alias":"nDPId-test","packets-captured":46,"packets-processed":46,"total-skipped-flows":0,"total-l4-data-len":5287,"total-not-detected-flows":0,"total-guessed-flows":1,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":3,"total-idle-flows":3,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":21,"global_ts_msec":1386004317989} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 46/46 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 5287 bytes +~~ total detected protocols..: 2 +~~ total active/idle flows...: 3/3 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5187639 bytes +~~ total memory freed........: 5187639 bytes +~~ total allocations/frees...: 113080/113080 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 474 chars +~~ json string max len.......: 699 chars +~~ json string avg len.......: 585 chars diff --git a/test/results/someip-tp.pcap.out b/test/results/someip-tp.pcap.out new file mode 100644 index 000000000..263560b1f --- /dev/null +++ b/test/results/someip-tp.pcap.out @@ -0,0 +1,24 @@ +00460{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"someip-tp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00546{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"someip-tp.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1433332443506} +00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"someip-tp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1433332443506,"flow_last_seen":1433332443506,"flow_idle_time":180000,"flow_min_l4_payload_len":1412,"flow_max_l4_payload_len":1412,"flow_tot_l4_payload_len":1412,"flow_avg_l4_payload_len":1412,"midstream":0,"thread_ts_msec":1433332443506,"l3_proto":"ip4","src_ip":"10.0.1.207","dst_ip":"10.0.1.1","src_port":56772,"dst_port":18193,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +02350{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"someip-tp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1433332443506,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1454,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1454,"pkt_l4_len":1420,"thread_ts_msec":1433332443506,"pkt":"bAAAAAAOdAAAAADhCABFAAWgNUcAAIARAAAKAAHPCgABAd3ERxEFjBxtAQEACQAABXwAAAAFAQEgAAAAAAEAADAAAAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn+AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6\/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t\/g4eLj5OXm5+jp6uvs7e7v8PHy8\/T19vf4+fr7\/P3+\/wABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpbXF1eX2BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ent8fX5\/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs\/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7\/Dx8vP09fb3+Pn6+\/z9\/v8AAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4\/QEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaW1xdXl9gYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr\/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u\/w8fLz9PX29\/j5+vv8\/f7\/AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn+AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6\/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t\/g4eLj5OXm5+jp6uvs7e7v8PHy8\/T19vf4+fr7\/P3+\/wABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpbXF1eX2BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ent8fX5\/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs\/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7\/Dx8vP09fb3+Pn6+\/z9\/v8AAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4\/QEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaW1xdXl9gYWJjZGVmZ2hpams="} +00780{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"someip-tp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1433332443506,"flow_last_seen":1433332443506,"flow_idle_time":180000,"flow_min_l4_payload_len":1412,"flow_max_l4_payload_len":1412,"flow_tot_l4_payload_len":1412,"flow_avg_l4_payload_len":1412,"midstream":0,"thread_ts_msec":1433332443506,"l3_proto":"ip4","src_ip":"10.0.1.207","dst_ip":"10.0.1.1","src_port":56772,"dst_port":18193,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"SOMEIP","breed":"Acceptable","category":"RPC"}} +02351{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"someip-tp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1433332443519,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1454,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1454,"pkt_l4_len":1420,"thread_ts_msec":1433332443519,"pkt":"bAAAAAAOdAAAAADhCABFAAWgNUgAAIARAAAKAAHPCgABAd3ERxEFjBxtAQEACQAABXwAAAAFAQEgAAAABXFsbW5vcHFyc3R1dnd4eXp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr\/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u\/w8fLz9PX29\/j5+vv8\/f7\/AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn+AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6\/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t\/g4eLj5OXm5+jp6uvs7e7v8PHy8\/T19vf4+fr7\/P3+\/wABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpbXF1eX2BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ent8fX5\/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs\/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7\/Dx8vP09fb3+Pn6+\/z9\/v8AAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4\/QEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaW1xdXl9gYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr\/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u\/w8fLz9PX29\/j5+vv8\/f7\/AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn+AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6\/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t\/g4eLj5OXm5+jp6uvs7e7v8PHy8\/T19vf4+fr7\/P3+\/wABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpbXF1eX2BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ent8fX5\/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs\/Q0dLT1NXW19jZ2ts="} +02353{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"someip-tp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1433332443524,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1454,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1454,"pkt_l4_len":1420,"thread_ts_msec":1433332443524,"pkt":"bAAAAAAOdAAAAADhCABFAAWgNUkAAIARAAAKAAHPCgABAd3ERxEFjBxtAQEACQAABXwAAAAFAQEgAAAACuHc3d7f4OHi4+Tl5ufo6err7O3u7\/Dx8vP09fb3+Pn6+\/z9\/v8AAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4\/QEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaW1xdXl9gYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr\/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u\/w8fLz9PX29\/j5+vv8\/f7\/AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn+AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6\/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t\/g4eLj5OXm5+jp6uvs7e7v8PHy8\/T19vf4+fr7\/P3+\/wABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpbXF1eX2BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ent8fX5\/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs\/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7\/Dx8vP09fb3+Pn6+\/z9\/v8AAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4\/QEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaW1xdXl9gYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr\/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u\/w8fLz9PX29\/j5+vv8\/f7\/AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn+AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6\/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t\/g4eLj5OXm5+jp6uvs7e7v8PHy8\/T19vf4+fr7\/P3+\/wABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AQUJDREVGR0hJSks="} +00820{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9,"source":"someip-tp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":1433332443506,"flow_last_seen":1433332443605,"flow_idle_time":180000,"flow_min_l4_payload_len":1176,"flow_max_l4_payload_len":1412,"flow_tot_l4_payload_len":12472,"flow_avg_l4_payload_len":1385,"midstream":0,"thread_ts_msec":1433332443605,"l3_proto":"ip4","src_ip":"10.0.1.207","dst_ip":"10.0.1.1","src_port":56772,"dst_port":18193,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"SOMEIP","breed":"Acceptable","category":"RPC"}} +00552{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":9,"source":"someip-tp.pcap","alias":"nDPId-test","packets-captured":9,"packets-processed":9,"total-skipped-flows":0,"total-l4-data-len":12472,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1433332443605} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 9/9 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 12472 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5178678 bytes +~~ total memory freed........: 5178678 bytes +~~ total allocations/frees...: 113034/113034 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 465 chars +~~ json string max len.......: 2358 chars +~~ json string avg len.......: 1395 chars diff --git a/test/results/someip-udp-method-call.pcapng.out b/test/results/someip-udp-method-call.pcapng.out new file mode 100644 index 000000000..3535e8480 --- /dev/null +++ b/test/results/someip-udp-method-call.pcapng.out @@ -0,0 +1,27 @@ +00475{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"someip-udp-method-call.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00561{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"someip-udp-method-call.pcapng","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1502789275686} +00596{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"someip-udp-method-call.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1502789275686,"flow_last_seen":1502789275686,"flow_idle_time":180000,"flow_min_l4_payload_len":328,"flow_max_l4_payload_len":328,"flow_tot_l4_payload_len":328,"flow_avg_l4_payload_len":328,"midstream":0,"thread_ts_msec":1502789275686,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"224.0.0.1","src_port":49190,"dst_port":49190,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00893{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"someip-udp-method-call.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1502789275686,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":370,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":370,"pkt_l4_len":336,"thread_ts_msec":1502789275686,"pkt":"AQBeAAABdAAAAAC5CABFAAFkAHhAAAER12bAqAAB4AAAAcAmwCYBULPJ\/\/+BAAAAAUAAAAfdAQECAMAAAAAAAADAAQAAIBI0APwBAAADAAAAAAECABAAAAABAQAAAwAAAAIBAwAQAAAAAQEAAAMAAAAAAQQAIAAAAAEBAAADAAAAAAEGABAAAAABAQAAAwAAAAEBAQAQAAAAAQEAAAMAAAAAAQAAIAAAAAEBAAADAAAAAAEBABAAAAABAgAAAwAAAAABAQAQAAAAAQEAAAMAAAAAAQEAEAAAAAEBAAADAAAAAAEHABAAAAABAQAAAwAAAAEBCAAQAAAAAQEAAAMAAAAAAAAAbAAJBADAqAABAAbAMQAJBADAqAABABHAMQAJBADAqAABAAbAPwAJBADAqAABAAbAPwAJBADAqAABAAbAPwAJBADAqAABABHAPwAJBADAqAABABHAPwAJBADAqAABAAbAPwAJBADAqAABABHAPw=="} +00793{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"someip-udp-method-call.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1502789275686,"flow_last_seen":1502789275686,"flow_idle_time":180000,"flow_min_l4_payload_len":328,"flow_max_l4_payload_len":328,"flow_tot_l4_payload_len":328,"flow_avg_l4_payload_len":328,"midstream":0,"thread_ts_msec":1502789275686,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"224.0.0.1","src_port":49190,"dst_port":49190,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"SOMEIP","breed":"Acceptable","category":"RPC"}} +00596{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"someip-udp-method-call.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1502789275711,"flow_last_seen":1502789275711,"flow_idle_time":180000,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"thread_ts_msec":1502789275711,"l3_proto":"ip4","src_ip":"192.168.0.125","dst_ip":"192.168.0.1","src_port":49191,"dst_port":49201,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"someip-udp-method-call.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1502789275711,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"thread_ts_msec":1502789275711,"pkt":"dAAAAAC5gAAAAAB1CABFAAA1AAAAAAERN+rAqAB9wKgAAcAnwDEAIefYEjQACAAAABEAAAABAQEAAAAAAAWrq6urqw=="} +00793{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"someip-udp-method-call.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1502789275711,"flow_last_seen":1502789275711,"flow_idle_time":180000,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"thread_ts_msec":1502789275711,"l3_proto":"ip4","src_ip":"192.168.0.125","dst_ip":"192.168.0.1","src_port":49191,"dst_port":49201,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"SOMEIP","breed":"Acceptable","category":"RPC"}} +00484{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"someip-udp-method-call.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1502789275713,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"thread_ts_msec":1502789275713,"pkt":"gAAAAAB1dAAAAAC5CABFAAA1do9AAAERgVrAqAABwKgAfcAxwCcAIWfYEjQACAAAABEAAAABAQGAAAAAAAWrq6urqw=="} +00832{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3,"source":"someip-udp-method-call.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":2,"flow_first_seen":1502789275711,"flow_last_seen":1502789275713,"flow_idle_time":180000,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":50,"flow_avg_l4_payload_len":25,"midstream":0,"thread_ts_msec":1502789275713,"l3_proto":"ip4","src_ip":"192.168.0.125","dst_ip":"192.168.0.1","src_port":49191,"dst_port":49201,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"SOMEIP","breed":"Acceptable","category":"RPC"}} +00832{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3,"source":"someip-udp-method-call.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":1502789275686,"flow_last_seen":1502789275686,"flow_idle_time":180000,"flow_min_l4_payload_len":328,"flow_max_l4_payload_len":328,"flow_tot_l4_payload_len":328,"flow_avg_l4_payload_len":328,"midstream":0,"thread_ts_msec":1502789275713,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"224.0.0.1","src_port":49190,"dst_port":49190,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"4":"DPI"},"proto":"SOMEIP","breed":"Acceptable","category":"RPC"}} +00566{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":3,"source":"someip-udp-method-call.pcapng","alias":"nDPId-test","packets-captured":3,"packets-processed":3,"total-skipped-flows":0,"total-l4-data-len":378,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":12,"global_ts_msec":1502789275713} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 3/3 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 378 bytes +~~ total detected protocols..: 2 +~~ total active/idle flows...: 2/2 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5179376 bytes +~~ total memory freed........: 5179376 bytes +~~ total allocations/frees...: 113031/113031 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 480 chars +~~ json string max len.......: 898 chars +~~ json string avg len.......: 688 chars diff --git a/test/results/someip_sd_sample.pcap.out b/test/results/someip_sd_sample.pcap.out new file mode 100644 index 000000000..2265deb1c --- /dev/null +++ b/test/results/someip_sd_sample.pcap.out @@ -0,0 +1,30 @@ +00467{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"someip_sd_sample.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00553{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"someip_sd_sample.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1559741544964} +00204{"error_event_id":1,"error_event_name":"Unknown datalink layer packet","datalink":192,"packet_id":1,"source":"someip_sd_sample.pcap","alias":"nDPId-test","layer_type":4096,"global_ts_msec":1559741544964} +00418{"packet_event_id":1,"packet_event_name":"packet","packet_id":1,"source":"someip_sd_sample.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":114,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":114,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"AAAQAAEAAAAIAAQAAAAAAAEAXgIDBQBUr+cDQAgARQAAVAAAQAD\/EXSfwKhYSesCAwV3GncaAEDieP\/\/gQAAAAAwAAAAAwEBAgDAAAAAAAAAEAEAABAA6wAAAQAAHgAAAAAAAAAMAAkEAMCoWEkAEcNQ"} +00204{"error_event_id":1,"error_event_name":"Unknown datalink layer packet","datalink":192,"packet_id":2,"source":"someip_sd_sample.pcap","alias":"nDPId-test","layer_type":4096,"global_ts_msec":1559741545065} +00418{"packet_event_id":1,"packet_event_name":"packet","packet_id":2,"source":"someip_sd_sample.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":114,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":114,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"AAAQAAEAAAAIAAQAAAAAAABUr+cDQABUr+cDAAgARQAAVAAAQAD\/EUmxwKhYTcCoWEl3GncaAECLdf\/\/gQAAAAAwAAAAAwEBAgDAAAAAAAAAEAYAABAA6wAAAQAAHgAAAAEAAAAMAAkEAMCoWE0AEepg"} +00204{"error_event_id":1,"error_event_name":"Unknown datalink layer packet","datalink":192,"packet_id":3,"source":"someip_sd_sample.pcap","alias":"nDPId-test","layer_type":4096,"global_ts_msec":1559741545065} +00403{"packet_event_id":1,"packet_event_name":"packet","packet_id":3,"source":"someip_sd_sample.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":102,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":102,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"AAAQAAEAAAAIAAQAAAAAAABUr+cDAABUr+cDQAgARQAASAAAQAD\/EUm9wKhYScCoWE13GncaADSSJ\/\/\/gQAAAAAkAAAAAgEBAgDAAAAAAAAAEAcAAAAA6wAAAQAAHgAAAAEAAAAA"} +00204{"error_event_id":1,"error_event_name":"Unknown datalink layer packet","datalink":192,"packet_id":4,"source":"someip_sd_sample.pcap","alias":"nDPId-test","layer_type":4096,"global_ts_msec":1559741545764} +00419{"packet_event_id":1,"packet_event_name":"packet","packet_id":4,"source":"someip_sd_sample.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":114,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":114,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"AAAQAAEAAAAIAAQAAAAAAAEAXgIDBQBUr+cDQAgARQAAVAAAQAD\/EXSfwKhYSesCAwV3GncaAEDid\/\/\/gQAAAAAwAAAABAEBAgDAAAAAAAAAEAEAABAA6wAAAQAAHgAAAAAAAAAMAAkEAMCoWEkAEcNQ"} +00204{"error_event_id":1,"error_event_name":"Unknown datalink layer packet","datalink":192,"packet_id":5,"source":"someip_sd_sample.pcap","alias":"nDPId-test","layer_type":4096,"global_ts_msec":1559741545865} +00418{"packet_event_id":1,"packet_event_name":"packet","packet_id":5,"source":"someip_sd_sample.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":114,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":114,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"AAAQAAEAAAAIAAQAAAAAAABUr+cDQABUr+cDAAgARQAAVAAAQAD\/EUmxwKhYTcCoWEl3GncaAECLdP\/\/gQAAAAAwAAAABAEBAgDAAAAAAAAAEAYAABAA6wAAAQAAHgAAAAEAAAAMAAkEAMCoWE0AEepg"} +00204{"error_event_id":1,"error_event_name":"Unknown datalink layer packet","datalink":192,"packet_id":6,"source":"someip_sd_sample.pcap","alias":"nDPId-test","layer_type":4096,"global_ts_msec":1559741545865} +00402{"packet_event_id":1,"packet_event_name":"packet","packet_id":6,"source":"someip_sd_sample.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":102,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":102,"pkt_l4_len":0,"thread_ts_msec":0,"pkt":"AAAQAAEAAAAIAAQAAAAAAABUr+cDAABUr+cDQAgARQAASAAAQAD\/EUm9wKhYScCoWE13GncaADSSJv\/\/gQAAAAAkAAAAAwEBAgDAAAAAAAAAEAcAAAAA6wAAAQAAHgAAAAEAAAAA"} +00556{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":6,"source":"someip_sd_sample.pcap","alias":"nDPId-test","packets-captured":6,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":15,"global_ts_msec":1559741545865} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 6/0 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 0 bytes +~~ total detected protocols..: 0 +~~ total active/idle flows...: 0/0 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5177545 bytes +~~ total memory freed........: 5177545 bytes +~~ total allocations/frees...: 113022/113022 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 209 chars +~~ json string max len.......: 561 chars +~~ json string avg len.......: 383 chars diff --git a/test/results/ssdp-m-search.pcap.out b/test/results/ssdp-m-search.pcap.out index 45ff91645..2087e50e0 100644 --- a/test/results/ssdp-m-search.pcap.out +++ b/test/results/ssdp-m-search.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680061 bytes -~~ total memory freed........: 4680061 bytes -~~ total allocations/frees...: 101162/101162 +~~ total memory allocated....: 5178968 bytes +~~ total memory freed........: 5178968 bytes +~~ total allocations/frees...: 113044/113044 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 694 chars diff --git a/test/results/ssh.pcap.out b/test/results/ssh.pcap.out index b4c1bae1a..d3d48ba4f 100644 --- a/test/results/ssh.pcap.out +++ b/test/results/ssh.pcap.out @@ -19,9 +19,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4688996 bytes -~~ total memory freed........: 4688996 bytes -~~ total allocations/frees...: 101405/101405 +~~ total memory allocated....: 5187903 bytes +~~ total memory freed........: 5187903 bytes +~~ total allocations/frees...: 113287/113287 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 459 chars ~~ json string max len.......: 1114 chars diff --git a/test/results/ssl-cert-name-mismatch.pcap.out b/test/results/ssl-cert-name-mismatch.pcap.out index 1d0860606..7d04e1e91 100644 --- a/test/results/ssl-cert-name-mismatch.pcap.out +++ b/test/results/ssl-cert-name-mismatch.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4688327 bytes -~~ total memory freed........: 4688327 bytes -~~ total allocations/frees...: 101172/101172 +~~ total memory allocated....: 5187234 bytes +~~ total memory freed........: 5187234 bytes +~~ total allocations/frees...: 113054/113054 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 478 chars ~~ json string max len.......: 1212 chars diff --git a/test/results/starcraft_battle.pcap.out b/test/results/starcraft_battle.pcap.out index 5081b2e03..4531ce9ca 100644 --- a/test/results/starcraft_battle.pcap.out +++ b/test/results/starcraft_battle.pcap.out @@ -321,9 +321,9 @@ ~~ total active/idle flows...: 52/52 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4773635 bytes -~~ total memory freed........: 4773635 bytes -~~ total allocations/frees...: 102163/102163 +~~ total memory allocated....: 5272542 bytes +~~ total memory freed........: 5272542 bytes +~~ total allocations/frees...: 114045/114045 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 199 chars ~~ json string max len.......: 1047 chars diff --git a/test/results/steam.pcap.out b/test/results/steam.pcap.out index d28c2b5bf..fa90f1498 100644 --- a/test/results/steam.pcap.out +++ b/test/results/steam.pcap.out @@ -270,9 +270,9 @@ ~~ total active/idle flows...: 55/55 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4729614 bytes -~~ total memory freed........: 4729614 bytes -~~ total allocations/frees...: 101409/101409 +~~ total memory allocated....: 5228521 bytes +~~ total memory freed........: 5228521 bytes +~~ total allocations/frees...: 113291/113291 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 681 chars diff --git a/test/results/steam_datagram_relay_ping.pcapng.out b/test/results/steam_datagram_relay_ping.pcapng.out index 8c15a6ca0..9cf75c6cb 100644 --- a/test/results/steam_datagram_relay_ping.pcapng.out +++ b/test/results/steam_datagram_relay_ping.pcapng.out @@ -14,9 +14,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679568 bytes -~~ total memory freed........: 4679568 bytes -~~ total allocations/frees...: 101145/101145 +~~ total memory allocated....: 5178475 bytes +~~ total memory freed........: 5178475 bytes +~~ total allocations/frees...: 113027/113027 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 483 chars ~~ json string max len.......: 2199 chars diff --git a/test/results/stun_facebook.pcapng.out b/test/results/stun_facebook.pcapng.out index 072b3d832..77ac449fe 100644 --- a/test/results/stun_facebook.pcapng.out +++ b/test/results/stun_facebook.pcapng.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4689893 bytes -~~ total memory freed........: 4689893 bytes -~~ total allocations/frees...: 101220/101220 +~~ total memory allocated....: 5188800 bytes +~~ total memory freed........: 5188800 bytes +~~ total allocations/frees...: 113102/113102 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 471 chars ~~ json string max len.......: 846 chars diff --git a/test/results/stun_signal.pcapng.out b/test/results/stun_signal.pcapng.out index d75eb7028..ac64ba425 100644 --- a/test/results/stun_signal.pcapng.out +++ b/test/results/stun_signal.pcapng.out @@ -147,9 +147,9 @@ ~~ total active/idle flows...: 23/23 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4720242 bytes -~~ total memory freed........: 4720242 bytes -~~ total allocations/frees...: 101671/101671 +~~ total memory allocated....: 5219149 bytes +~~ total memory freed........: 5219149 bytes +~~ total allocations/frees...: 113553/113553 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 852 chars diff --git a/test/results/synscan.pcap.out b/test/results/synscan.pcap.out index cc62c6de2..664ed38a5 100644 --- a/test/results/synscan.pcap.out +++ b/test/results/synscan.pcap.out @@ -7996,9 +7996,9 @@ ~~ total active/idle flows...: 1994/1994 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 6475725 bytes -~~ total memory freed........: 6475725 bytes -~~ total allocations/frees...: 109133/109133 +~~ total memory allocated....: 6974632 bytes +~~ total memory freed........: 6974632 bytes +~~ total allocations/frees...: 121015/121015 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 820 chars diff --git a/test/results/syslog.pcapng.out b/test/results/syslog.pcapng.out index fee369b63..a23f1d4d2 100644 --- a/test/results/syslog.pcapng.out +++ b/test/results/syslog.pcapng.out @@ -48,9 +48,9 @@ ~~ total active/idle flows...: 7/7 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685322 bytes -~~ total memory freed........: 4685322 bytes -~~ total allocations/frees...: 101181/101181 +~~ total memory allocated....: 5184229 bytes +~~ total memory freed........: 5184229 bytes +~~ total allocations/frees...: 113063/113063 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 848 chars diff --git a/test/results/teams.pcap.out b/test/results/teams.pcap.out index f599ec9c9..790e52a07 100644 --- a/test/results/teams.pcap.out +++ b/test/results/teams.pcap.out @@ -603,9 +603,9 @@ ~~ total active/idle flows...: 83/83 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 6078741 bytes -~~ total memory freed........: 6078741 bytes -~~ total allocations/frees...: 104609/104609 +~~ total memory allocated....: 6577648 bytes +~~ total memory freed........: 6577648 bytes +~~ total allocations/frees...: 116491/116491 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 184 chars ~~ json string max len.......: 1949 chars diff --git a/test/results/teamspeak3.pcap.out b/test/results/teamspeak3.pcap.out index f3664de2f..761ff4f3a 100644 --- a/test/results/teamspeak3.pcap.out +++ b/test/results/teamspeak3.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679887 bytes -~~ total memory freed........: 4679887 bytes -~~ total allocations/frees...: 101156/101156 +~~ total memory allocated....: 5178794 bytes +~~ total memory freed........: 5178794 bytes +~~ total allocations/frees...: 113038/113038 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 466 chars ~~ json string max len.......: 695 chars diff --git a/test/results/teamviewer.pcap.out b/test/results/teamviewer.pcap.out new file mode 100644 index 000000000..b433c9117 --- /dev/null +++ b/test/results/teamviewer.pcap.out @@ -0,0 +1,30 @@ +00461{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"teamviewer.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00555{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"teamviewer.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":330297,"flow_last_seen":330297,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":330297,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"162.250.2.170","src_port":35732,"dst_port":5938,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"teamviewer.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":330297,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":330297,"pkt":"UlQAEjUCCAAns+YuCABFAAA8OlxAAEAGTq0KAAIPovoCqouUFzIpaMgpAAAAAKAC+vCAjgAAAgQFtAQCCAosLVpIAAAAAAEDAwc="} +00447{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"teamviewer.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":330433,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_msec":330433,"pkt":"CAAns+YuUlQAEjUCCABFAAAsCdUAAEAGv0Si+gKqCgACDxcyi5QCaioBKWjIKmAS\/\/8lnwAAAgQFtA=="} +00445{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"teamviewer.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":330434,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_msec":330434,"pkt":"UlQAEjUCCAAns+YuCABFAAAoOl1AAEAGTsAKAAIPovoCqouUFzIpaMgqAmoqAlAQ+vBCawAAAAAAAAAA"} +00627{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"teamviewer.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":330297,"flow_last_seen":330434,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":9,"midstream":0,"thread_ts_msec":330434,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"162.250.2.170","src_port":35732,"dst_port":5938,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"TeamViewer","breed":"Acceptable","category":"RemoteAccess"}} +00561{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":238,"source":"teamviewer.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":520136,"flow_last_seen":520136,"flow_idle_time":180000,"flow_min_l4_payload_len":96,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":96,"midstream":0,"thread_ts_msec":520136,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.47.224.241","src_port":34417,"dst_port":36037,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00554{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":238,"source":"teamviewer.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":520136,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"thread_ts_msec":520136,"pkt":"UlQAEjUCCAAns+YuCABFAAB8z5cAAEARYKoKAAIPXS\/g8YZxjMUAaPehAAAAAAAAAAAAAAMXJEdQAAUAAAAAAAAAAAAAADkzLjQ3LjIyNC4yNDEAAADFjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} +00553{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":239,"source":"teamviewer.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":520148,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"thread_ts_msec":520148,"pkt":"CAAns+YuUlQAEjUCCABFAAB8FPQAAEARG05dL+DxCgACD4zFhnEAaPihAAAAAAAAAAAAAAMXJEdQAAUAAAAAAAAAAAAAADkzLjQ3LjIyNC4yNDEAAADEjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} +01045{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":240,"source":"teamviewer.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":520160,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":506,"pkt_l4_len":472,"thread_ts_msec":520160,"pkt":"CAAns+YuUlQAEjUCCABFAAHsFPcAAEARGdtdL+DxCgACD4zFhnEB2EYbAAAAAAAAAAAAAAMXJEfAAQQAAAA7Jmk0CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="} +00895{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":241,"source":"teamviewer.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":4,"flow_first_seen":520136,"flow_last_seen":520160,"flow_idle_time":180000,"flow_min_l4_payload_len":96,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":1680,"flow_avg_l4_payload_len":420,"midstream":0,"thread_ts_msec":520160,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.47.224.241","src_port":34417,"dst_port":36037,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"30": {"risk":"Desktop\/File Sharing Session","severity":"Low","risk_score": {"total":1000,"client":800,"server":200}}},"confidence": {"4":"DPI"},"proto":"TeamViewer","breed":"Acceptable","category":"RemoteAccess"}} +00555{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1283,"source":"teamviewer.pcap","alias":"nDPId-test","packets-captured":1283,"packets-processed":1282,"total-skipped-flows":0,"total-l4-data-len":643545,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":2,"total-active-flows":2,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":12,"global_ts_msec":633881} +00940{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1298,"source":"teamviewer.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":1009,"flow_first_seen":520136,"flow_last_seen":558067,"flow_idle_time":180000,"flow_min_l4_payload_len":16,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":520494,"flow_avg_l4_payload_len":515,"midstream":0,"thread_ts_msec":729854,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"93.47.224.241","src_port":34417,"dst_port":36037,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"30": {"risk":"Desktop\/File Sharing Session","severity":"Low","risk_score": {"total":1000,"client":800,"server":200}}},"confidence": {"4":"DPI"},"proto":"TeamViewer","breed":"Acceptable","category":"RemoteAccess"}} +00679{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1298,"source":"teamviewer.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":289,"flow_first_seen":330297,"flow_last_seen":729854,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1460,"flow_tot_l4_payload_len":125458,"flow_avg_l4_payload_len":434,"midstream":0,"thread_ts_msec":729854,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"162.250.2.170","src_port":35732,"dst_port":5938,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"TeamViewer","breed":"Acceptable","category":"RemoteAccess"}} +00557{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1298,"source":"teamviewer.pcap","alias":"nDPId-test","packets-captured":1298,"packets-processed":1298,"total-skipped-flows":0,"total-l4-data-len":645952,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":15,"global_ts_msec":729854} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 1298/1298 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 645952 bytes +~~ total detected protocols..: 2 +~~ total active/idle flows...: 2/2 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5216931 bytes +~~ total memory freed........: 5216931 bytes +~~ total allocations/frees...: 114326/114326 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 450 chars +~~ json string max len.......: 1050 chars +~~ json string avg len.......: 746 chars diff --git a/test/results/telegram.pcap.out b/test/results/telegram.pcap.out index 42cc6e39e..9ab70db0b 100644 --- a/test/results/telegram.pcap.out +++ b/test/results/telegram.pcap.out @@ -285,9 +285,9 @@ ~~ total active/idle flows...: 48/48 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4766004 bytes -~~ total memory freed........: 4766004 bytes -~~ total allocations/frees...: 102852/102852 +~~ total memory allocated....: 5264911 bytes +~~ total memory freed........: 5264911 bytes +~~ total allocations/frees...: 114734/114734 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 2278 chars diff --git a/test/results/telnet.pcap.out b/test/results/telnet.pcap.out new file mode 100644 index 000000000..25f394623 --- /dev/null +++ b/test/results/telnet.pcap.out @@ -0,0 +1,37 @@ +00457{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"telnet.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00542{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"telnet.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":943755158387} +00566{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"telnet.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":943755158387,"flow_last_seen":943755158387,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":943755158387,"l3_proto":"ip4","src_ip":"192.168.0.2","dst_ip":"192.168.0.1","src_port":1550,"dst_port":23,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00474{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"telnet.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":943755158387,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":943755158387,"pkt":"AADAn6CXAKDMO7\/6CABFEAA8RjxAAEAGcxzAqAACwKgAAQYOABeZxaDsAAAAAKACfXjgowAAAgQFtAQCCAoAnCckAAAAAAEDAwA="} +00474{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"telnet.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":943755158389,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":943755158389,"pkt":"AKDMO7\/6AADAn6CXCABFAAA8UeMAAEAGp4XAqAABwKgAAgAXBg4X8WM9mcWg7aASQ+D7twAAAgQFqAEDAwABAQgKACWmLACcJyQ="} +00463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"telnet.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":943755158389,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_msec":943755158389,"pkt":"AADAn6CXAKDMO7\/6CABFEAA0Rj1AAEAGcyPAqAACwKgAAQYOABeZxaDtF\/FjPoAQfXjt1wAAAQEICgCcJyQAJaYs"} +00789{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"telnet.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":943755158387,"flow_last_seen":943755158537,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":4,"midstream":0,"thread_ts_msec":943755158537,"l3_proto":"ip4","src_ip":"192.168.0.2","dst_ip":"192.168.0.1","src_port":1550,"dst_port":23,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Telnet","breed":"Unsafe","category":"RemoteAccess"},"telnet": {"username":"","password":""}} +00200{"error_event_id":9,"error_event_name":"nDPI IPv4\/L4 payload detection failed","datalink":1,"packet_id":18,"source":"telnet.pcap","alias":"nDPId-test","l4_data_len":32,"global_ts_msec":943755158548} +00357{"packet_event_id":1,"packet_event_name":"packet","packet_id":18,"source":"telnet.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":66,"pkt_l4_len":0,"thread_ts_msec":943755158547,"pkt":"AADAn6CXAKDMO7\/6CABFEACJRkRAAEAGcsfAqAACwKgAAQYOABeZxaFUF\/FjhIAYfXjMkwAAAQEICgCcJzQAJaYs"} +00801{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":29,"source":"telnet.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":28,"flow_first_seen":943755158387,"flow_last_seen":943755159705,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":85,"flow_tot_l4_payload_len":336,"flow_avg_l4_payload_len":12,"midstream":0,"thread_ts_msec":943755159705,"l3_proto":"ip4","src_ip":"192.168.0.2","dst_ip":"192.168.0.1","src_port":1550,"dst_port":23,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Telnet","breed":"Unsafe","category":"RemoteAccess"},"telnet": {"username":"","password":""}} +00809{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":31,"source":"telnet.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":30,"flow_first_seen":943755158387,"flow_last_seen":943755160949,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":85,"flow_tot_l4_payload_len":342,"flow_avg_l4_payload_len":11,"midstream":0,"thread_ts_msec":943755160949,"l3_proto":"ip4","src_ip":"192.168.0.2","dst_ip":"192.168.0.1","src_port":1550,"dst_port":23,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Telnet","breed":"Unsafe","category":"RemoteAccess"},"telnet": {"username":"fake\r\n","password":""}} +00200{"error_event_id":9,"error_event_name":"nDPI IPv4\/L4 payload detection failed","datalink":1,"packet_id":32,"source":"telnet.pcap","alias":"nDPId-test","l4_data_len":32,"global_ts_msec":943755160950} +00357{"packet_event_id":1,"packet_event_name":"packet","packet_id":32,"source":"telnet.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":66,"pkt_l4_len":0,"thread_ts_msec":943755160949,"pkt":"AADAn6CXAKDMO7\/6CABFEAA6RkpAAEAGcxDAqAACwKgAAQYOABeZxaGyF\/FjyYAYfXgMpwAAAQEICgCcKCQAJaYu"} +00809{"flow_event_id":7,"flow_event_name":"detection-update","thread_id":0,"packet_id":34,"source":"telnet.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":32,"flow_first_seen":943755158387,"flow_last_seen":943755160962,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":85,"flow_tot_l4_payload_len":348,"flow_avg_l4_payload_len":10,"midstream":0,"thread_ts_msec":943755160962,"l3_proto":"ip4","src_ip":"192.168.0.2","dst_ip":"192.168.0.1","src_port":1550,"dst_port":23,"l4_proto":"tcp","ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Telnet","breed":"Unsafe","category":"RemoteAccess"},"telnet": {"username":"fake\r\n","password":""}} +00200{"error_event_id":9,"error_event_name":"nDPI IPv4\/L4 payload detection failed","datalink":1,"packet_id":52,"source":"telnet.pcap","alias":"nDPId-test","l4_data_len":32,"global_ts_msec":943755178297} +00357{"packet_event_id":1,"packet_event_name":"packet","packet_id":52,"source":"telnet.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":66,"pkt_l4_len":0,"thread_ts_msec":943755178295,"pkt":"AADAn6CXAKDMO7\/6CABFEABORlNAAEAGcvPAqAACwKgAAQYOABeZxaHEF\/FmAIAYfXjBVQAAAQEICgCcLuoAJaY2"} +00200{"error_event_id":9,"error_event_name":"nDPI IPv4\/L4 payload detection failed","datalink":1,"packet_id":70,"source":"telnet.pcap","alias":"nDPId-test","l4_data_len":32,"global_ts_msec":943755184206} +00358{"packet_event_id":1,"packet_event_name":"packet","packet_id":70,"source":"telnet.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":66,"pkt_l4_len":0,"thread_ts_msec":943755184205,"pkt":"AADAn6CXAKDMO7\/6CABFEAA5RlxAAEAGcv\/AqAACwKgAAQYOABeZxaHeF\/Fns4AYfXjYKQAAAQEICgCcMTkAJaZf"} +00200{"error_event_id":9,"error_event_name":"nDPI IPv4\/L4 payload detection failed","datalink":1,"packet_id":78,"source":"telnet.pcap","alias":"nDPId-test","l4_data_len":32,"global_ts_msec":943755185261} +00357{"packet_event_id":1,"packet_event_name":"packet","packet_id":78,"source":"telnet.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":66,"pkt_l4_len":0,"thread_ts_msec":943755185260,"pkt":"AADAn6CXAKDMO7\/6CABFEAA4Rl9AAEAGcv3AqAACwKgAAQYOABeZxaHjF\/FoUIAYfXhjlAAAAQEICgCcMaMAJaZf"} +00793{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":92,"source":"telnet.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":87,"flow_first_seen":943755158387,"flow_last_seen":943755197958,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":488,"flow_tot_l4_payload_len":1660,"flow_avg_l4_payload_len":19,"midstream":0,"thread_ts_msec":943755197958,"l3_proto":"ip4","src_ip":"192.168.0.2","dst_ip":"192.168.0.1","src_port":1550,"dst_port":23,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"22": {"risk":"Unsafe Protocol","severity":"Low","risk_score": {"total":750,"client":575,"server":175}}},"confidence": {"4":"DPI"},"proto":"Telnet","breed":"Unsafe","category":"RemoteAccess"}} +00551{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":92,"source":"telnet.pcap","alias":"nDPId-test","packets-captured":92,"packets-processed":87,"total-skipped-flows":0,"total-l4-data-len":1660,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":3,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":22,"global_ts_msec":943755197958} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 92/87 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 1660 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5182988 bytes +~~ total memory freed........: 5182988 bytes +~~ total allocations/frees...: 113113/113113 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 205 chars +~~ json string max len.......: 814 chars +~~ json string avg len.......: 509 chars diff --git a/test/results/teredo.pcap.out b/test/results/teredo.pcap.out index 730d948e1..a432423f5 100644 --- a/test/results/teredo.pcap.out +++ b/test/results/teredo.pcap.out @@ -36,9 +36,9 @@ ~~ total active/idle flows...: 5/5 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4683694 bytes -~~ total memory freed........: 4683694 bytes -~~ total allocations/frees...: 101179/101179 +~~ total memory allocated....: 5182601 bytes +~~ total memory freed........: 5182601 bytes +~~ total allocations/frees...: 113061/113061 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 687 chars diff --git a/test/results/tftp.pcap.out b/test/results/tftp.pcap.out index 2dcb01ffd..6723aa5c1 100644 --- a/test/results/tftp.pcap.out +++ b/test/results/tftp.pcap.out @@ -30,9 +30,9 @@ ~~ total active/idle flows...: 4/4 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685142 bytes -~~ total memory freed........: 4685142 bytes -~~ total allocations/frees...: 101256/101256 +~~ total memory allocated....: 5184049 bytes +~~ total memory freed........: 5184049 bytes +~~ total allocations/frees...: 113138/113138 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 444 chars ~~ json string max len.......: 1213 chars diff --git a/test/results/tinc.pcap.out b/test/results/tinc.pcap.out index 6543c2bdc..f96a478f0 100644 --- a/test/results/tinc.pcap.out +++ b/test/results/tinc.pcap.out @@ -33,9 +33,9 @@ ~~ total active/idle flows...: 4/4 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4699832 bytes -~~ total memory freed........: 4699832 bytes -~~ total allocations/frees...: 101481/101481 +~~ total memory allocated....: 5198739 bytes +~~ total memory freed........: 5198739 bytes +~~ total allocations/frees...: 113363/113363 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 451 chars ~~ json string max len.......: 2397 chars diff --git a/test/results/tk.pcap.out b/test/results/tk.pcap.out index ebe663aff..0df369aed 100644 --- a/test/results/tk.pcap.out +++ b/test/results/tk.pcap.out @@ -27,9 +27,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681428 bytes -~~ total memory freed........: 4681428 bytes -~~ total allocations/frees...: 101155/101155 +~~ total memory allocated....: 5180335 bytes +~~ total memory freed........: 5180335 bytes +~~ total allocations/frees...: 113037/113037 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 458 chars ~~ json string max len.......: 777 chars diff --git a/test/results/tls-esni-fuzzed.pcap.out b/test/results/tls-esni-fuzzed.pcap.out index d95033d9d..6f151ede7 100644 --- a/test/results/tls-esni-fuzzed.pcap.out +++ b/test/results/tls-esni-fuzzed.pcap.out @@ -21,9 +21,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4688781 bytes -~~ total memory freed........: 4688781 bytes -~~ total allocations/frees...: 101163/101163 +~~ total memory allocated....: 5187688 bytes +~~ total memory freed........: 5187688 bytes +~~ total allocations/frees...: 113045/113045 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 471 chars ~~ json string max len.......: 1433 chars diff --git a/test/results/tls-rdn-extract.pcap.out b/test/results/tls-rdn-extract.pcap.out index 030f1402d..036943b4e 100644 --- a/test/results/tls-rdn-extract.pcap.out +++ b/test/results/tls-rdn-extract.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4721351 bytes -~~ total memory freed........: 4721351 bytes -~~ total allocations/frees...: 101198/101198 +~~ total memory allocated....: 5220258 bytes +~~ total memory freed........: 5220258 bytes +~~ total allocations/frees...: 113080/113080 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 471 chars ~~ json string max len.......: 3342 chars diff --git a/test/results/tls_alert.pcap.out b/test/results/tls_alert.pcap.out index 99648ee02..104f08e3c 100644 --- a/test/results/tls_alert.pcap.out +++ b/test/results/tls_alert.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681923 bytes -~~ total memory freed........: 4681923 bytes -~~ total allocations/frees...: 101156/101156 +~~ total memory allocated....: 5180830 bytes +~~ total memory freed........: 5180830 bytes +~~ total allocations/frees...: 113038/113038 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 1043 chars diff --git a/test/results/tls_certificate_too_long.pcap.out b/test/results/tls_certificate_too_long.pcap.out index 022027f90..7ef6a6dc7 100644 --- a/test/results/tls_certificate_too_long.pcap.out +++ b/test/results/tls_certificate_too_long.pcap.out @@ -224,9 +224,9 @@ ~~ total active/idle flows...: 35/35 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4830177 bytes -~~ total memory freed........: 4830177 bytes -~~ total allocations/frees...: 101675/101675 +~~ total memory allocated....: 5329084 bytes +~~ total memory freed........: 5329084 bytes +~~ total allocations/frees...: 113557/113557 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 2445 chars diff --git a/test/results/tls_cipher_lens.pcap.out b/test/results/tls_cipher_lens.pcap.out index feeeea5cd..14085bf91 100644 --- a/test/results/tls_cipher_lens.pcap.out +++ b/test/results/tls_cipher_lens.pcap.out @@ -29,9 +29,9 @@ ~~ total active/idle flows...: 5/5 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4693383 bytes -~~ total memory freed........: 4693383 bytes -~~ total allocations/frees...: 101165/101165 +~~ total memory allocated....: 5192290 bytes +~~ total memory freed........: 5192290 bytes +~~ total allocations/frees...: 113047/113047 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 471 chars ~~ json string max len.......: 975 chars diff --git a/test/results/tls_esni_sni_both.pcap.out b/test/results/tls_esni_sni_both.pcap.out index 8a53523a4..d1e9de0f8 100644 --- a/test/results/tls_esni_sni_both.pcap.out +++ b/test/results/tls_esni_sni_both.pcap.out @@ -23,9 +23,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4686766 bytes -~~ total memory freed........: 4686766 bytes -~~ total allocations/frees...: 101190/101190 +~~ total memory allocated....: 5185673 bytes +~~ total memory freed........: 5185673 bytes +~~ total allocations/frees...: 113072/113072 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 1215 chars diff --git a/test/results/tls_invalid_reads.pcap.out b/test/results/tls_invalid_reads.pcap.out index 74d7d4030..42bdcf8ec 100644 --- a/test/results/tls_invalid_reads.pcap.out +++ b/test/results/tls_invalid_reads.pcap.out @@ -30,9 +30,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4684710 bytes -~~ total memory freed........: 4684710 bytes -~~ total allocations/frees...: 101156/101156 +~~ total memory allocated....: 5183617 bytes +~~ total memory freed........: 5183617 bytes +~~ total allocations/frees...: 113038/113038 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 200 chars ~~ json string max len.......: 957 chars diff --git a/test/results/tls_long_cert.pcap.out b/test/results/tls_long_cert.pcap.out index 9730b1ec0..26ad3568f 100644 --- a/test/results/tls_long_cert.pcap.out +++ b/test/results/tls_long_cert.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4725626 bytes -~~ total memory freed........: 4725626 bytes -~~ total allocations/frees...: 101387/101387 +~~ total memory allocated....: 5224533 bytes +~~ total memory freed........: 5224533 bytes +~~ total allocations/frees...: 113269/113269 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 2434 chars diff --git a/test/results/tls_port_80.pcapng.out b/test/results/tls_port_80.pcapng.out index 3d93d3d64..af06d73e5 100644 --- a/test/results/tls_port_80.pcapng.out +++ b/test/results/tls_port_80.pcapng.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681935 bytes -~~ total memory freed........: 4681935 bytes -~~ total allocations/frees...: 101157/101157 +~~ total memory allocated....: 5180842 bytes +~~ total memory freed........: 5180842 bytes +~~ total allocations/frees...: 113039/113039 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 1245 chars diff --git a/test/results/tls_torrent.pcapng.out b/test/results/tls_torrent.pcapng.out index f9b606e84..3b9528176 100644 --- a/test/results/tls_torrent.pcapng.out +++ b/test/results/tls_torrent.pcapng.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4694239 bytes -~~ total memory freed........: 4694239 bytes -~~ total allocations/frees...: 101158/101158 +~~ total memory allocated....: 5193146 bytes +~~ total memory freed........: 5193146 bytes +~~ total allocations/frees...: 113040/113040 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 1343 chars diff --git a/test/results/tls_verylong_certificate.pcap.out b/test/results/tls_verylong_certificate.pcap.out index 02f3363e8..dee2ee92d 100644 --- a/test/results/tls_verylong_certificate.pcap.out +++ b/test/results/tls_verylong_certificate.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4853181 bytes -~~ total memory freed........: 4853181 bytes -~~ total allocations/frees...: 101328/101328 +~~ total memory allocated....: 5352088 bytes +~~ total memory freed........: 5352088 bytes +~~ total allocations/frees...: 113210/113210 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 480 chars ~~ json string max len.......: 3604 chars diff --git a/test/results/tor.pcap.out b/test/results/tor.pcap.out index 077d810ab..a2380c81a 100644 --- a/test/results/tor.pcap.out +++ b/test/results/tor.pcap.out @@ -362,9 +362,9 @@ ~~ total active/idle flows...: 11/11 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4810067 bytes -~~ total memory freed........: 4810067 bytes -~~ total allocations/frees...: 104888/104888 +~~ total memory allocated....: 5308974 bytes +~~ total memory freed........: 5308974 bytes +~~ total allocations/frees...: 116770/116770 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 182 chars ~~ json string max len.......: 1412 chars diff --git a/test/results/trickbot.pcap.out b/test/results/trickbot.pcap.out index e1bc6ae3b..102a32ed1 100644 --- a/test/results/trickbot.pcap.out +++ b/test/results/trickbot.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681843 bytes -~~ total memory freed........: 4681843 bytes -~~ total allocations/frees...: 101222/101222 +~~ total memory allocated....: 5180750 bytes +~~ total memory freed........: 5180750 bytes +~~ total allocations/frees...: 113104/113104 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 456 chars ~~ json string max len.......: 1253 chars diff --git a/test/results/tumblr.pcap.out b/test/results/tumblr.pcap.out index 55b1c0dab..3153279f4 100644 --- a/test/results/tumblr.pcap.out +++ b/test/results/tumblr.pcap.out @@ -278,9 +278,9 @@ ~~ total active/idle flows...: 47/47 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5856193 bytes -~~ total memory freed........: 5856193 bytes -~~ total allocations/frees...: 126116/126116 +~~ total memory allocated....: 6355100 bytes +~~ total memory freed........: 6355100 bytes +~~ total allocations/frees...: 137998/137998 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 1395 chars diff --git a/test/results/ubntac2.pcap.out b/test/results/ubntac2.pcap.out index d3f31c598..5a73aaaeb 100644 --- a/test/results/ubntac2.pcap.out +++ b/test/results/ubntac2.pcap.out @@ -41,9 +41,9 @@ ~~ total active/idle flows...: 8/8 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4685846 bytes -~~ total memory freed........: 4685846 bytes -~~ total allocations/frees...: 101172/101172 +~~ total memory allocated....: 5184753 bytes +~~ total memory freed........: 5184753 bytes +~~ total allocations/frees...: 113054/113054 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 463 chars ~~ json string max len.......: 703 chars diff --git a/test/results/upnp.pcap.out b/test/results/upnp.pcap.out index 98e88da40..4ff889b95 100644 --- a/test/results/upnp.pcap.out +++ b/test/results/upnp.pcap.out @@ -2,28 +2,28 @@ 00541{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"upnp.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1541515314826} 00587{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"upnp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1541515314826,"flow_last_seen":1541515314826,"flow_idle_time":180000,"flow_min_l4_payload_len":656,"flow_max_l4_payload_len":656,"flow_tot_l4_payload_len":656,"flow_avg_l4_payload_len":656,"midstream":0,"thread_ts_msec":1541515314826,"l3_proto":"ip6","src_ip":"fe80::3441:3d24:6d30:a807","dst_ip":"ff02::c","src_port":58932,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 01338{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"upnp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1541515314826,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":718,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":718,"pkt_l4_len":664,"thread_ts_msec":1541515314826,"pkt":"MzMAAAAMGNvyL6AYht1gDeGUApgRAf6AAAAAAAAANEE9JG0wqAf\/AgAAAAAAAAAAAAAAAAAM5jQOdgKYg108P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvUmVzb2x2ZTwvd3NhOkFjdGlvbj48d3NhOk1lc3NhZ2VJRD51cm46dXVpZDozZjQyZGM5YS0yNGNlLTQ4ZDEtODhmOS0xNmI5NmExMzdkNzE8L3dzYTpNZXNzYWdlSUQ+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6UmVzb2x2ZT48d3NhOkVuZHBvaW50UmVmZXJlbmNlPjx3c2E6QWRkcmVzcz51cm46dXVpZDplMzI0ODAwMC04MGNlLTExZGItODAwMC0wMDFiYTk5ZWM5NTY8L3dzYTpBZGRyZXNzPjwvd3NhOkVuZHBvaW50UmVmZXJlbmNlPjwvd3NkOlJlc29sdmU+PC9zb2FwOkJvZHk+PC9zb2FwOkVudmVsb3BlPg=="} +00645{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"upnp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1541515314826,"flow_last_seen":1541515314826,"flow_idle_time":180000,"flow_min_l4_payload_len":656,"flow_max_l4_payload_len":656,"flow_tot_l4_payload_len":656,"flow_avg_l4_payload_len":656,"midstream":0,"thread_ts_msec":1541515314826,"l3_proto":"ip6","src_ip":"fe80::3441:3d24:6d30:a807","dst_ip":"ff02::c","src_port":58932,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} 00583{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"upnp.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1541515314827,"flow_last_seen":1541515314827,"flow_idle_time":180000,"flow_min_l4_payload_len":656,"flow_max_l4_payload_len":656,"flow_tot_l4_payload_len":656,"flow_avg_l4_payload_len":656,"midstream":0,"thread_ts_msec":1541515314827,"l3_proto":"ip4","src_ip":"192.168.61.66","dst_ip":"239.255.255.250","src_port":58931,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 01312{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"upnp.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1541515314827,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":698,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":698,"pkt_l4_len":664,"thread_ts_msec":1541515314827,"pkt":"AQBef\/\/6GNvyL6AYCABFAAKsCtYAAAERvobAqD1C7\/\/\/+uYzDnYCmBmmPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5Ij48c29hcDpIZWFkZXI+PHdzYTpUbz51cm46c2NoZW1hcy14bWxzb2FwLW9yZzp3czoyMDA1OjA0OmRpc2NvdmVyeTwvd3NhOlRvPjx3c2E6QWN0aW9uPmh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5L1Jlc29sdmU8L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6M2Y0MmRjOWEtMjRjZS00OGQxLTg4ZjktMTZiOTZhMTM3ZDcxPC93c2E6TWVzc2FnZUlEPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOlJlc29sdmU+PHdzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NhOkFkZHJlc3M+dXJuOnV1aWQ6ZTMyNDgwMDAtODBjZS0xMWRiLTgwMDAtMDAxYmE5OWVjOTU2PC93c2E6QWRkcmVzcz48L3dzYTpFbmRwb2ludFJlZmVyZW5jZT48L3dzZDpSZXNvbHZlPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="} +00641{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"upnp.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1541515314827,"flow_last_seen":1541515314827,"flow_idle_time":180000,"flow_min_l4_payload_len":656,"flow_max_l4_payload_len":656,"flow_tot_l4_payload_len":656,"flow_avg_l4_payload_len":656,"midstream":0,"thread_ts_msec":1541515314827,"l3_proto":"ip4","src_ip":"192.168.61.66","dst_ip":"239.255.255.250","src_port":58931,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} 01338{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"upnp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1541515314944,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":718,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":718,"pkt_l4_len":664,"thread_ts_msec":1541515314944,"pkt":"MzMAAAAMGNvyL6AYht1gDeGUApgRAf6AAAAAAAAANEE9JG0wqAf\/AgAAAAAAAAAAAAAAAAAM5jQOdgKYg108P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvUmVzb2x2ZTwvd3NhOkFjdGlvbj48d3NhOk1lc3NhZ2VJRD51cm46dXVpZDozZjQyZGM5YS0yNGNlLTQ4ZDEtODhmOS0xNmI5NmExMzdkNzE8L3dzYTpNZXNzYWdlSUQ+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6UmVzb2x2ZT48d3NhOkVuZHBvaW50UmVmZXJlbmNlPjx3c2E6QWRkcmVzcz51cm46dXVpZDplMzI0ODAwMC04MGNlLTExZGItODAwMC0wMDFiYTk5ZWM5NTY8L3dzYTpBZGRyZXNzPjwvd3NhOkVuZHBvaW50UmVmZXJlbmNlPjwvd3NkOlJlc29sdmU+PC9zb2FwOkJvZHk+PC9zb2FwOkVudmVsb3BlPg=="} 01312{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"upnp.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1541515315006,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":698,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":698,"pkt_l4_len":664,"thread_ts_msec":1541515315006,"pkt":"AQBef\/\/6GNvyL6AYCABFAAKsCtcAAAERvoXAqD1C7\/\/\/+uYzDnYCmBmmPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5Ij48c29hcDpIZWFkZXI+PHdzYTpUbz51cm46c2NoZW1hcy14bWxzb2FwLW9yZzp3czoyMDA1OjA0OmRpc2NvdmVyeTwvd3NhOlRvPjx3c2E6QWN0aW9uPmh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5L1Jlc29sdmU8L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6M2Y0MmRjOWEtMjRjZS00OGQxLTg4ZjktMTZiOTZhMTM3ZDcxPC93c2E6TWVzc2FnZUlEPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOlJlc29sdmU+PHdzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NhOkFkZHJlc3M+dXJuOnV1aWQ6ZTMyNDgwMDAtODBjZS0xMWRiLTgwMDAtMDAxYmE5OWVjOTU2PC93c2E6QWRkcmVzcz48L3dzYTpFbmRwb2ludFJlZmVyZW5jZT48L3dzZDpSZXNvbHZlPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="} 01338{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"upnp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1541515315178,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":718,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":718,"pkt_l4_len":664,"thread_ts_msec":1541515315178,"pkt":"MzMAAAAMGNvyL6AYht1gDeGUApgRAf6AAAAAAAAANEE9JG0wqAf\/AgAAAAAAAAAAAAAAAAAM5jQOdgKYg108P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvUmVzb2x2ZTwvd3NhOkFjdGlvbj48d3NhOk1lc3NhZ2VJRD51cm46dXVpZDozZjQyZGM5YS0yNGNlLTQ4ZDEtODhmOS0xNmI5NmExMzdkNzE8L3dzYTpNZXNzYWdlSUQ+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6UmVzb2x2ZT48d3NhOkVuZHBvaW50UmVmZXJlbmNlPjx3c2E6QWRkcmVzcz51cm46dXVpZDplMzI0ODAwMC04MGNlLTExZGItODAwMC0wMDFiYTk5ZWM5NTY8L3dzYTpBZGRyZXNzPjwvd3NhOkVuZHBvaW50UmVmZXJlbmNlPjwvd3NkOlJlc29sdmU+PC9zb2FwOkJvZHk+PC9zb2FwOkVudmVsb3BlPg=="} 01312{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"upnp.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1541515315356,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":698,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":698,"pkt_l4_len":664,"thread_ts_msec":1541515315356,"pkt":"AQBef\/\/6GNvyL6AYCABFAAKsCtgAAAERvoTAqD1C7\/\/\/+uYzDnYCmBmmPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5Ij48c29hcDpIZWFkZXI+PHdzYTpUbz51cm46c2NoZW1hcy14bWxzb2FwLW9yZzp3czoyMDA1OjA0OmRpc2NvdmVyeTwvd3NhOlRvPjx3c2E6QWN0aW9uPmh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5L1Jlc29sdmU8L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6M2Y0MmRjOWEtMjRjZS00OGQxLTg4ZjktMTZiOTZhMTM3ZDcxPC93c2E6TWVzc2FnZUlEPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOlJlc29sdmU+PHdzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NhOkFkZHJlc3M+dXJuOnV1aWQ6ZTMyNDgwMDAtODBjZS0xMWRiLTgwMDAtMDAxYmE5OWVjOTU2PC93c2E6QWRkcmVzcz48L3dzYTpFbmRwb2ludFJlZmVyZW5jZT48L3dzZDpSZXNvbHZlPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="} -00656{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":14,"source":"upnp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":1541515314826,"flow_last_seen":1541515320458,"flow_idle_time":180000,"flow_min_l4_payload_len":656,"flow_max_l4_payload_len":656,"flow_tot_l4_payload_len":4592,"flow_avg_l4_payload_len":656,"midstream":0,"thread_ts_msec":1541515321472,"l3_proto":"ip6","src_ip":"fe80::3441:3d24:6d30:a807","dst_ip":"ff02::c","src_port":58932,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"1":"Match by port"},"proto":"WSD","breed":"Acceptable","category":"Network"}} -00590{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":14,"source":"upnp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":1541515314826,"flow_last_seen":1541515320458,"flow_idle_time":180000,"flow_min_l4_payload_len":656,"flow_max_l4_payload_len":656,"flow_tot_l4_payload_len":4592,"flow_avg_l4_payload_len":656,"midstream":0,"thread_ts_msec":1541515321472,"l3_proto":"ip6","src_ip":"fe80::3441:3d24:6d30:a807","dst_ip":"ff02::c","src_port":58932,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} -00652{"flow_event_id":5,"flow_event_name":"guessed","thread_id":0,"packet_id":14,"source":"upnp.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":1541515314827,"flow_last_seen":1541515321472,"flow_idle_time":180000,"flow_min_l4_payload_len":656,"flow_max_l4_payload_len":656,"flow_tot_l4_payload_len":4592,"flow_avg_l4_payload_len":656,"midstream":0,"thread_ts_msec":1541515321472,"l3_proto":"ip4","src_ip":"192.168.61.66","dst_ip":"239.255.255.250","src_port":58931,"dst_port":3702,"l4_proto":"udp","ndpi": {"confidence": {"1":"Match by port"},"proto":"WSD","breed":"Acceptable","category":"Network"}} -00586{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":14,"source":"upnp.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":7,"flow_first_seen":1541515314827,"flow_last_seen":1541515321472,"flow_idle_time":180000,"flow_min_l4_payload_len":656,"flow_max_l4_payload_len":656,"flow_tot_l4_payload_len":4592,"flow_avg_l4_payload_len":656,"midstream":0,"thread_ts_msec":1541515321472,"l3_proto":"ip4","src_ip":"192.168.61.66","dst_ip":"239.255.255.250","src_port":58931,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} -00550{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":14,"source":"upnp.pcap","alias":"nDPId-test","packets-captured":14,"packets-processed":14,"total-skipped-flows":0,"total-l4-data-len":9184,"total-not-detected-flows":0,"total-guessed-flows":2,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":15,"global_ts_msec":1541515321472} +00686{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":14,"source":"upnp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":1541515314826,"flow_last_seen":1541515320458,"flow_idle_time":180000,"flow_min_l4_payload_len":656,"flow_max_l4_payload_len":656,"flow_tot_l4_payload_len":4592,"flow_avg_l4_payload_len":656,"midstream":0,"thread_ts_msec":1541515321472,"l3_proto":"ip6","src_ip":"fe80::3441:3d24:6d30:a807","dst_ip":"ff02::c","src_port":58932,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} +00682{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":14,"source":"upnp.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":7,"flow_first_seen":1541515314827,"flow_last_seen":1541515321472,"flow_idle_time":180000,"flow_min_l4_payload_len":656,"flow_max_l4_payload_len":656,"flow_tot_l4_payload_len":4592,"flow_avg_l4_payload_len":656,"midstream":0,"thread_ts_msec":1541515321472,"l3_proto":"ip4","src_ip":"192.168.61.66","dst_ip":"239.255.255.250","src_port":58931,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WSD","breed":"Acceptable","category":"Network"}} +00550{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":14,"source":"upnp.pcap","alias":"nDPId-test","packets-captured":14,"packets-processed":14,"total-skipped-flows":0,"total-l4-data-len":9184,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":15,"global_ts_msec":1541515321472} ~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ ~~ packets captured/processed: 14/14 ~~ skipped flows.............: 0 ~~ total layer4 data length..: 9184 bytes -~~ total detected protocols..: 0 +~~ total detected protocols..: 2 ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4680788 bytes -~~ total memory freed........: 4680788 bytes -~~ total allocations/frees...: 101160/101160 +~~ total memory allocated....: 5179695 bytes +~~ total memory freed........: 5179695 bytes +~~ total allocations/frees...: 113042/113042 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 460 chars ~~ json string max len.......: 1343 chars diff --git a/test/results/viber.pcap.out b/test/results/viber.pcap.out index bd60a3ab9..905ad4d65 100644 --- a/test/results/viber.pcap.out +++ b/test/results/viber.pcap.out @@ -171,9 +171,9 @@ ~~ total active/idle flows...: 26/26 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4808157 bytes -~~ total memory freed........: 4808157 bytes -~~ total allocations/frees...: 101689/101689 +~~ total memory allocated....: 5307064 bytes +~~ total memory freed........: 5307064 bytes +~~ total allocations/frees...: 113571/113571 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 2407 chars diff --git a/test/results/vnc.pcap.out b/test/results/vnc.pcap.out index a7827028c..f57a0c345 100644 --- a/test/results/vnc.pcap.out +++ b/test/results/vnc.pcap.out @@ -21,9 +21,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4816457 bytes -~~ total memory freed........: 4816457 bytes -~~ total allocations/frees...: 105699/105699 +~~ total memory allocated....: 5315364 bytes +~~ total memory freed........: 5315364 bytes +~~ total allocations/frees...: 117581/117581 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 457 chars ~~ json string max len.......: 951 chars diff --git a/test/results/vrrp3.pcapng.out b/test/results/vrrp3.pcapng.out new file mode 100644 index 000000000..65673aa83 --- /dev/null +++ b/test/results/vrrp3.pcapng.out @@ -0,0 +1,28 @@ +00458{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"vrrp3.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00544{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"vrrp3.pcapng","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1589370606456} +00534{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"vrrp3.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1589370606456,"flow_last_seen":1589370606456,"flow_idle_time":600000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1589370606456,"l3_proto":"ip6","src_ip":"fe80::2","dst_ip":"ff02::12","l4_proto":112,"flow_datalink":1,"flow_max_packets":3} +00491{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"vrrp3.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1589370606456,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":82,"pkt_type":34525,"pkt_l3_offset":18,"pkt_l4_offset":58,"pkt_len":82,"pkt_l4_len":24,"thread_ts_msec":1589370606456,"pkt":"MzMAAAASAABeAAIkgQAAJIbdbgAAAAAYcP\/+gAAAAAAAAAAAAAAAAAAC\/wIAAAAAAAAAAAAAAAAAEjEkZAED6DQb\/oAAAAAAAAAAAAAAAAA2Ng=="} +00593{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"vrrp3.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1589370606456,"flow_last_seen":1589370606456,"flow_idle_time":600000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1589370606456,"l3_proto":"ip6","src_ip":"fe80::2","dst_ip":"ff02::12","l4_proto":112,"ndpi": {"confidence": {"4":"DPI"},"proto":"VRRP","breed":"Acceptable","category":"Network"}} +00534{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"vrrp3.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1589370606915,"flow_last_seen":1589370606915,"flow_idle_time":600000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1589370606915,"l3_proto":"ip6","src_ip":"fe80::1","dst_ip":"ff02::12","l4_proto":112,"flow_datalink":1,"flow_max_packets":3} +00491{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"vrrp3.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1589370606915,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":82,"pkt_type":34525,"pkt_l3_offset":18,"pkt_l4_offset":58,"pkt_len":82,"pkt_l4_len":24,"thread_ts_msec":1589370606915,"pkt":"MzMAAAASAABeAAIkgQAAJIbdbgAAAAAYcP\/+gAAAAAAAAAAAAAAAAAAB\/wIAAAAAAAAAAAAAAAAAEjEkaQED6C8c\/oAAAAAAAAAAAAAAAAA2Ng=="} +00593{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"vrrp3.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1589370606915,"flow_last_seen":1589370606915,"flow_idle_time":600000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1589370606915,"l3_proto":"ip6","src_ip":"fe80::1","dst_ip":"ff02::12","l4_proto":112,"ndpi": {"confidence": {"4":"DPI"},"proto":"VRRP","breed":"Acceptable","category":"Network"}} +00491{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"vrrp3.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1589370616409,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":82,"pkt_type":34525,"pkt_l3_offset":18,"pkt_l4_offset":58,"pkt_len":82,"pkt_l4_len":24,"thread_ts_msec":1589370616409,"pkt":"MzMAAAASAABeAAIkgQAAJIbdbgAAAAAYcP\/+gAAAAAAAAAAAAAAAAAAB\/wIAAAAAAAAAAAAAAAAAEjEkaQED6C8c\/oAAAAAAAAAAAAAAAAA2Ng=="} +00491{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"vrrp3.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1589370625308,"flow_idle_time":600000,"pkt_oversize":false,"pkt_caplen":82,"pkt_type":34525,"pkt_l3_offset":18,"pkt_l4_offset":58,"pkt_len":82,"pkt_l4_len":24,"thread_ts_msec":1589370625308,"pkt":"MzMAAAASAABeAAIkgQAAJIbdbgAAAAAYcP\/+gAAAAAAAAAAAAAAAAAAB\/wIAAAAAAAAAAAAAAAAAEjEkaQED6C8c\/oAAAAAAAAAAAAAAAAA2Ng=="} +00634{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":10,"source":"vrrp3.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":9,"flow_first_seen":1589370606915,"flow_last_seen":1589370680701,"flow_idle_time":600000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1589370680701,"l3_proto":"ip6","src_ip":"fe80::1","dst_ip":"ff02::12","l4_proto":112,"flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"VRRP","breed":"Acceptable","category":"Network"}} +00633{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":10,"source":"vrrp3.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":1,"flow_first_seen":1589370606456,"flow_last_seen":1589370606456,"flow_idle_time":600000,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"thread_ts_msec":1589370680701,"l3_proto":"ip6","src_ip":"fe80::2","dst_ip":"ff02::12","l4_proto":112,"flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"VRRP","breed":"Acceptable","category":"Network"}} +00552{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":10,"source":"vrrp3.pcapng","alias":"nDPId-test","packets-captured":10,"packets-processed":10,"total-skipped-flows":0,"total-l4-data-len":240,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":13,"global_ts_msec":1589370680701} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 10/10 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 240 bytes +~~ total detected protocols..: 2 +~~ total active/idle flows...: 2/2 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5179579 bytes +~~ total memory freed........: 5179579 bytes +~~ total allocations/frees...: 113038/113038 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 463 chars +~~ json string max len.......: 639 chars +~~ json string avg len.......: 548 chars diff --git a/test/results/vxlan.pcap.out b/test/results/vxlan.pcap.out index c71e6afff..c217a5895 100644 --- a/test/results/vxlan.pcap.out +++ b/test/results/vxlan.pcap.out @@ -59,9 +59,9 @@ ~~ total active/idle flows...: 9/9 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4690169 bytes -~~ total memory freed........: 4690169 bytes -~~ total allocations/frees...: 101294/101294 +~~ total memory allocated....: 5189076 bytes +~~ total memory freed........: 5189076 bytes +~~ total allocations/frees...: 113176/113176 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 2412 chars diff --git a/test/results/wa_video.pcap.out b/test/results/wa_video.pcap.out index 9fdc20a04..27ef3b4f0 100644 --- a/test/results/wa_video.pcap.out +++ b/test/results/wa_video.pcap.out @@ -88,9 +88,9 @@ ~~ total active/idle flows...: 14/14 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4799204 bytes -~~ total memory freed........: 4799204 bytes -~~ total allocations/frees...: 102766/102766 +~~ total memory allocated....: 5298111 bytes +~~ total memory freed........: 5298111 bytes +~~ total allocations/frees...: 114648/114648 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 464 chars ~~ json string max len.......: 2365 chars diff --git a/test/results/wa_voice.pcap.out b/test/results/wa_voice.pcap.out index 5b70cb18d..2f342e1a6 100644 --- a/test/results/wa_voice.pcap.out +++ b/test/results/wa_voice.pcap.out @@ -172,9 +172,9 @@ ~~ total active/idle flows...: 28/28 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4814260 bytes -~~ total memory freed........: 4814260 bytes -~~ total allocations/frees...: 101981/101981 +~~ total memory allocated....: 5313167 bytes +~~ total memory freed........: 5313167 bytes +~~ total allocations/frees...: 113863/113863 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 457 chars ~~ json string max len.......: 2425 chars diff --git a/test/results/waze.pcap.out b/test/results/waze.pcap.out index 91e1f85b7..ff233efc6 100644 --- a/test/results/waze.pcap.out +++ b/test/results/waze.pcap.out @@ -235,9 +235,9 @@ ~~ total active/idle flows...: 33/33 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4800273 bytes -~~ total memory freed........: 4800273 bytes -~~ total allocations/frees...: 101918/101918 +~~ total memory allocated....: 5299180 bytes +~~ total memory freed........: 5299180 bytes +~~ total allocations/frees...: 113800/113800 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 452 chars ~~ json string max len.......: 1355 chars diff --git a/test/results/webex.pcap.out b/test/results/webex.pcap.out index 7ab39d461..c9fa990d5 100644 --- a/test/results/webex.pcap.out +++ b/test/results/webex.pcap.out @@ -389,9 +389,9 @@ ~~ total active/idle flows...: 57/57 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5016961 bytes -~~ total memory freed........: 5016961 bytes -~~ total allocations/frees...: 103105/103105 +~~ total memory allocated....: 5515868 bytes +~~ total memory freed........: 5515868 bytes +~~ total allocations/frees...: 114987/114987 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 450 chars ~~ json string max len.......: 1866 chars diff --git a/test/results/websocket.pcap.out b/test/results/websocket.pcap.out index 1c3b3cc5c..0d963e5f3 100644 --- a/test/results/websocket.pcap.out +++ b/test/results/websocket.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4681703 bytes -~~ total memory freed........: 4681703 bytes -~~ total allocations/frees...: 101149/101149 +~~ total memory allocated....: 5180610 bytes +~~ total memory freed........: 5180610 bytes +~~ total allocations/frees...: 113031/113031 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 689 chars diff --git a/test/results/wechat.pcap.out b/test/results/wechat.pcap.out index 9cf2ce07f..d6c0d70d8 100644 --- a/test/results/wechat.pcap.out +++ b/test/results/wechat.pcap.out @@ -682,9 +682,9 @@ ~~ total active/idle flows...: 110/110 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5064618 bytes -~~ total memory freed........: 5064618 bytes -~~ total allocations/frees...: 103732/103732 +~~ total memory allocated....: 5563525 bytes +~~ total memory freed........: 5563525 bytes +~~ total allocations/frees...: 115614/115614 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 450 chars ~~ json string max len.......: 2275 chars diff --git a/test/results/weibo.pcap.out b/test/results/weibo.pcap.out index 25d4303ef..fe6930a4b 100644 --- a/test/results/weibo.pcap.out +++ b/test/results/weibo.pcap.out @@ -245,9 +245,9 @@ ~~ total active/idle flows...: 44/44 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4735414 bytes -~~ total memory freed........: 4735414 bytes -~~ total allocations/frees...: 101809/101809 +~~ total memory allocated....: 5234321 bytes +~~ total memory freed........: 5234321 bytes +~~ total allocations/frees...: 113691/113691 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 452 chars ~~ json string max len.......: 947 chars diff --git a/test/results/whatsapp_login_call.pcap.out b/test/results/whatsapp_login_call.pcap.out index 3084dd6fd..3cf6cca62 100644 --- a/test/results/whatsapp_login_call.pcap.out +++ b/test/results/whatsapp_login_call.pcap.out @@ -354,9 +354,9 @@ ~~ total active/idle flows...: 57/57 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4793616 bytes -~~ total memory freed........: 4793616 bytes -~~ total allocations/frees...: 102576/102576 +~~ total memory allocated....: 5292523 bytes +~~ total memory freed........: 5292523 bytes +~~ total allocations/frees...: 114458/114458 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 466 chars ~~ json string max len.......: 2437 chars diff --git a/test/results/whatsapp_login_chat.pcap.out b/test/results/whatsapp_login_chat.pcap.out index e712454c2..c26591487 100644 --- a/test/results/whatsapp_login_chat.pcap.out +++ b/test/results/whatsapp_login_chat.pcap.out @@ -57,9 +57,9 @@ ~~ total active/idle flows...: 9/9 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4695327 bytes -~~ total memory freed........: 4695327 bytes -~~ total allocations/frees...: 101263/101263 +~~ total memory allocated....: 5194234 bytes +~~ total memory freed........: 5194234 bytes +~~ total allocations/frees...: 113145/113145 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 475 chars ~~ json string max len.......: 2420 chars diff --git a/test/results/whatsapp_voice_and_message.pcap.out b/test/results/whatsapp_voice_and_message.pcap.out index 55ce86f59..39ad5e3d8 100644 --- a/test/results/whatsapp_voice_and_message.pcap.out +++ b/test/results/whatsapp_voice_and_message.pcap.out @@ -87,9 +87,9 @@ ~~ total active/idle flows...: 13/13 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4715991 bytes -~~ total memory freed........: 4715991 bytes -~~ total allocations/frees...: 101447/101447 +~~ total memory allocated....: 5214898 bytes +~~ total memory freed........: 5214898 bytes +~~ total allocations/frees...: 113329/113329 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 472 chars ~~ json string max len.......: 843 chars diff --git a/test/results/whatsappfiles.pcap.out b/test/results/whatsappfiles.pcap.out index 136832d5c..0d022f31f 100644 --- a/test/results/whatsappfiles.pcap.out +++ b/test/results/whatsappfiles.pcap.out @@ -24,9 +24,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4708907 bytes -~~ total memory freed........: 4708907 bytes -~~ total allocations/frees...: 101780/101780 +~~ total memory allocated....: 5207814 bytes +~~ total memory freed........: 5207814 bytes +~~ total allocations/frees...: 113662/113662 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 469 chars ~~ json string max len.......: 1338 chars diff --git a/test/results/whois.pcapng.out b/test/results/whois.pcapng.out index aa8383157..990751202 100644 --- a/test/results/whois.pcapng.out +++ b/test/results/whois.pcapng.out @@ -30,9 +30,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4691588 bytes -~~ total memory freed........: 4691588 bytes -~~ total allocations/frees...: 101179/101179 +~~ total memory allocated....: 5190495 bytes +~~ total memory freed........: 5190495 bytes +~~ total allocations/frees...: 113061/113061 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 453 chars ~~ json string max len.......: 2069 chars diff --git a/test/results/wireguard.pcap.out b/test/results/wireguard.pcap.out index 3337b2801..fd66805c3 100644 --- a/test/results/wireguard.pcap.out +++ b/test/results/wireguard.pcap.out @@ -17,9 +17,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4749081 bytes -~~ total memory freed........: 4749081 bytes -~~ total allocations/frees...: 103542/103542 +~~ total memory allocated....: 5247988 bytes +~~ total memory freed........: 5247988 bytes +~~ total allocations/frees...: 115424/115424 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 465 chars ~~ json string max len.......: 1533 chars diff --git a/test/results/wow.pcap.out b/test/results/wow.pcap.out new file mode 100644 index 000000000..82902c3e0 --- /dev/null +++ b/test/results/wow.pcap.out @@ -0,0 +1,49 @@ +00454{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"wow.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00540{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"wow.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1437858769436} +00572{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"wow.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1437858769436,"flow_last_seen":1437858769436,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1437858769436,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"12.129.222.53","src_port":39309,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00472{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"wow.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1437858769436,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1437858769436,"pkt":"JGUR0Ik6JGURQGHhCABFAAA8GJNAAIAGhLXAqLIUDIHeNZmNAFBo+hN9AAAAAKACIADawAAAAgQFtAEDAwIEAggKACnZUgAAAAA="} +00472{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"wow.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1437858769437,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1437858769437,"pkt":"JGUR0Ik6JGURQGHhCABFAAA8GJNAAIAGhLXAqLIUDIHeNZmNAFBo+hN9AAAAAKACIADawAAAAgQFtAEDAwIEAggKACnZUgAAAAA="} +00571{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"wow.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1437858769451,"flow_last_seen":1437858769451,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1437858769451,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"24.105.29.21","src_port":39312,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00472{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"wow.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_last_seen":1437858769451,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1437858769451,"pkt":"JGUR0Ik6JGURQGHhCABFAAA8GJRAAIAGOe3AqLIUGGkdFZmQAFAEh98cAAAAAKACIAAoyAAAAgQFtAEDAwIEAggKACnZVAAAAAA="} +00472{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"wow.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_last_seen":1437858769452,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1437858769452,"pkt":"JGUR0Ik6JGURQGHhCABFAAA8GJRAAIAGOe3AqLIUGGkdFZmQAFAEh98cAAAAAKACIAAoyAAAAgQFtAEDAwIEAggKACnZVAAAAAA="} +00472{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"wow.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1437858769649,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1437858769649,"pkt":"JGURQGHhJGUR0Ik6CABFAAA8AABAADMG6kgMgd41wKiyFABQmY301K7baPoTfqASFqCzawAAAgQFhAQCCAqn1+VGACnZUgEDAwc="} +00792{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"wow.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1437858769436,"flow_last_seen":1437858769651,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":85,"flow_tot_l4_payload_len":85,"flow_avg_l4_payload_len":14,"midstream":0,"thread_ts_msec":1437858769651,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"12.129.222.53","src_port":39309,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.WorldOfWarcraft","breed":"Fun","category":"Game"},"http": {"hostname":"us.scan.worldofwarcraft.com","url":"us.scan.worldofwarcraft.com\/update\/Launcher.txt","code":0,"content_type":"","user_agent":""}} +00457{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"wow.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_last_seen":1437858769673,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_msec":1437858769673,"pkt":"JGURQGHhJGUR0Ik6CABFAAAwGJRAAHEGSPkYaR0VwKiyFABQmZCXtfydBIffHXASIACqLAAAAgQFhAQCAAA="} +00779{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":13,"source":"wow.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1437858769451,"flow_last_seen":1437858769820,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":72,"flow_avg_l4_payload_len":12,"midstream":0,"thread_ts_msec":1437858769820,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"24.105.29.21","src_port":39312,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.WorldOfWarcraft","breed":"Fun","category":"Game"},"http": {"hostname":"launcher.worldofwarcraft.com","url":"launcher.worldofwarcraft.com\/alert","code":0,"content_type":"","user_agent":""}} +00576{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":49,"source":"wow.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1437858780584,"flow_last_seen":1437858780584,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1437858780584,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"12.129.228.153","src_port":39329,"dst_port":3724,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":49,"source":"wow.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_last_seen":1437858780584,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1437858780584,"pkt":"JGUR0Ik6JGURQGHhCABFAAA8GOFAAIAGfgPAqLIUDIHkmZmhDoyszXMNAAAAAKACIAAeTgAAAgQFtAEDAwIEAggKACndrQAAAAA="} +00473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":50,"source":"wow.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_last_seen":1437858780584,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1437858780584,"pkt":"JGUR0Ik6JGURQGHhCABFAAA8GOFAAIAGfgPAqLIUDIHkmZmhDoyszXMNAAAAAKACIAAeTgAAAgQFtAEDAwIEAggKACndrQAAAAA="} +00474{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":51,"source":"wow.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_last_seen":1437858780796,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1437858780796,"pkt":"JGURQGHhJGUR0Ik6CABFAAA8AABAADMG4+QMgeSZwKiyFA6MmaEZw7OGrM1zDqASOJCV8gAAAgQFhAQCCApCuV\/iACndrQEDAwc="} +00638{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":54,"source":"wow.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1437858780584,"flow_last_seen":1437858781018,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":50,"flow_tot_l4_payload_len":50,"flow_avg_l4_payload_len":8,"midstream":0,"thread_ts_msec":1437858781018,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"12.129.228.153","src_port":39329,"dst_port":3724,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"WorldOfWarcraft","breed":"Fun","category":"Game"}} +00576{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":65,"source":"wow.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1437858849489,"flow_last_seen":1437858849489,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1437858849489,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"12.129.228.153","src_port":39364,"dst_port":3724,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":65,"source":"wow.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_last_seen":1437858849489,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1437858849489,"pkt":"JGUR0Ik6JGURQGHhCABFAAA8GWRAAIAGfYDAqLIUDIHkmZnEDowRX7J7AAAAAKACIABfQAAAAgQFtAEDAwIEAggKACn4mAAAAAA="} +00473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":66,"source":"wow.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_last_seen":1437858849489,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1437858849489,"pkt":"JGUR0Ik6JGURQGHhCABFAAA8GWRAAIAGfYDAqLIUDIHkmZnEDowRX7J7AAAAAKACIABfQAAAAgQFtAEDAwIEAggKACn4mAAAAAA="} +00473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":67,"source":"wow.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":3,"flow_last_seen":1437858849702,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1437858849702,"pkt":"JGURQGHhJGUR0Ik6CABFAAA8AABAADMG4+QMgeSZwKiyFA6MmcRkqiOyEV+yfKASOJAOpgAAAgQFhAQCCApCum0NACn4mAEDAwc="} +00638{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":70,"source":"wow.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1437858849489,"flow_last_seen":1437858849924,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":50,"flow_tot_l4_payload_len":50,"flow_avg_l4_payload_len":8,"midstream":0,"thread_ts_msec":1437858849924,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"12.129.228.153","src_port":39364,"dst_port":3724,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"WorldOfWarcraft","breed":"Fun","category":"Game"}} +00547{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":83,"source":"wow.pcap","alias":"nDPId-test","packets-captured":83,"packets-processed":82,"total-skipped-flows":0,"total-l4-data-len":4309,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":4,"total-detection-updates":0,"total-updates":0,"current-active-flows":4,"total-active-flows":4,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":23,"global_ts_msec":1437859397750} +00576{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":83,"source":"wow.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1437859397750,"flow_last_seen":1437859397750,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"thread_ts_msec":1437859397750,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"12.129.228.152","src_port":39593,"dst_port":3724,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} +00473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":83,"source":"wow.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_last_seen":1437859397750,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1437859397750,"pkt":"JGUR0Ik6JGURQGHhCABFAAA8KdNAAIAGbRLAqLIUDIHkmJqpDoyvdi+RAAAAAKACIABtBAAAAgQFtAEDAwIEAggKACrOwgAAAAA="} +00473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":84,"source":"wow.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_last_seen":1437859397750,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1437859397750,"pkt":"JGUR0Ik6JGURQGHhCABFAAA8KdNAAIAGbRLAqLIUDIHkmJqpDoyvdi+RAAAAAKACIABtBAAAAgQFtAEDAwIEAggKACrOwgAAAAA="} +00473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":85,"source":"wow.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_last_seen":1437859397966,"flow_idle_time":7440000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_msec":1437859397966,"pkt":"JGURQGHhJGUR0Ik6CABFAAA8AABAADMG4+UMgeSYwKiyFA6Mmqlj7+ucr3YvkqASOJA2KQAAAgQFhAQCCApCwowWACrOwgEDAwc="} +00638{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":88,"source":"wow.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_packets_processed":6,"flow_first_seen":1437859397750,"flow_last_seen":1437859398184,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":50,"flow_tot_l4_payload_len":50,"flow_avg_l4_payload_len":8,"midstream":0,"thread_ts_msec":1437859398184,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"12.129.228.152","src_port":39593,"dst_port":3724,"l4_proto":"tcp","ndpi": {"confidence": {"4":"DPI"},"proto":"WorldOfWarcraft","breed":"Fun","category":"Game"}} +00683{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":95,"source":"wow.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_packets_processed":16,"flow_first_seen":1437858780584,"flow_last_seen":1437858782413,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":503,"flow_tot_l4_payload_len":2606,"flow_avg_l4_payload_len":162,"midstream":0,"thread_ts_msec":1437859398661,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"12.129.228.153","src_port":39329,"dst_port":3724,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WorldOfWarcraft","breed":"Fun","category":"Game"}} +00680{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":95,"source":"wow.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_packets_processed":18,"flow_first_seen":1437858849489,"flow_last_seen":1437858850365,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":50,"flow_tot_l4_payload_len":299,"flow_avg_l4_payload_len":16,"midstream":0,"thread_ts_msec":1437859398661,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"12.129.228.153","src_port":39364,"dst_port":3724,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WorldOfWarcraft","breed":"Fun","category":"Game"}} +00680{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":95,"source":"wow.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"finished","flow_packets_processed":13,"flow_first_seen":1437859397750,"flow_last_seen":1437859398661,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":50,"flow_tot_l4_payload_len":277,"flow_avg_l4_payload_len":21,"midstream":0,"thread_ts_msec":1437859398661,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"12.129.228.152","src_port":39593,"dst_port":3724,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"WorldOfWarcraft","breed":"Fun","category":"Game"}} +00682{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":95,"source":"wow.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":24,"flow_first_seen":1437858769436,"flow_last_seen":1437858780442,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":273,"flow_tot_l4_payload_len":716,"flow_avg_l4_payload_len":29,"midstream":0,"thread_ts_msec":1437859398661,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"12.129.222.53","src_port":39309,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.WorldOfWarcraft","breed":"Fun","category":"Game"}} +00681{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":95,"source":"wow.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_packets_processed":24,"flow_first_seen":1437858769451,"flow_last_seen":1437858780577,"flow_idle_time":7440000,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":544,"flow_tot_l4_payload_len":688,"flow_avg_l4_payload_len":28,"midstream":0,"thread_ts_msec":1437859398661,"l3_proto":"ip4","src_ip":"192.168.178.20","dst_ip":"24.105.29.21","src_port":39312,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"HTTP.WorldOfWarcraft","breed":"Fun","category":"Game"}} +00549{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":95,"source":"wow.pcap","alias":"nDPId-test","packets-captured":95,"packets-processed":95,"total-skipped-flows":0,"total-l4-data-len":4586,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":5,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":5,"total-idle-flows":5,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":34,"global_ts_msec":1437859398661} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 95/95 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 4586 bytes +~~ total detected protocols..: 5 +~~ total active/idle flows...: 5/5 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5190909 bytes +~~ total memory freed........: 5190909 bytes +~~ total allocations/frees...: 113139/113139 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 459 chars +~~ json string max len.......: 797 chars +~~ json string avg len.......: 627 chars diff --git a/test/results/xdmcp.pcap.out b/test/results/xdmcp.pcap.out new file mode 100644 index 000000000..0b835b3a9 --- /dev/null +++ b/test/results/xdmcp.pcap.out @@ -0,0 +1,24 @@ +00456{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"xdmcp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0} +00542{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"xdmcp.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1538467333581} +00563{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"xdmcp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1538467333581,"flow_last_seen":1538467333581,"flow_idle_time":180000,"flow_min_l4_payload_len":7,"flow_max_l4_payload_len":7,"flow_tot_l4_payload_len":7,"flow_avg_l4_payload_len":7,"midstream":0,"thread_ts_msec":1538467333581,"l3_proto":"ip4","src_ip":"10.1.2.2","dst_ip":"10.1.2.4","src_port":61426,"dst_port":177,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} +00455{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"xdmcp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1538467333581,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":15,"thread_ts_msec":1538467333581,"pkt":"CAAngNsFUlQAEjUACABFAAAjIEIAAP8Rg4AKAQICCgECBO\/yALEAD\/cgAAEAAgABAAAAAAAAAAAAAAAA"} +00628{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"xdmcp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1538467333581,"flow_last_seen":1538467333581,"flow_idle_time":180000,"flow_min_l4_payload_len":7,"flow_max_l4_payload_len":7,"flow_tot_l4_payload_len":7,"flow_avg_l4_payload_len":7,"midstream":0,"thread_ts_msec":1538467333581,"l3_proto":"ip4","src_ip":"10.1.2.2","dst_ip":"10.1.2.4","src_port":61426,"dst_port":177,"l4_proto":"udp","ndpi": {"confidence": {"4":"DPI"},"proto":"XDMCP","breed":"Acceptable","category":"RemoteAccess"}} +00470{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"xdmcp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1538467333586,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"thread_ts_msec":1538467333586,"pkt":"UlQAEjUACAAngNsFCABFAAA5uT5AAEARaW4KAQIECgECAgCx7\/IAJRg+AAEABQAXAAAAAAARV2lsbGluZyB0byBtYW5hZ2U="} +00689{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"xdmcp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1538467333586,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":231,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":231,"pkt_l4_len":197,"thread_ts_msec":1538467333586,"pkt":"CAAngNsFUlQAEjUACABFAADZIEMAAP8RgskKAQICCgECBO\/yALEAxWSsAAEABwC3AAAJAAAAAAAAAAAAAAAGAAYABgAGCQAExlrfKwAEwKg4AQAEqf5aAAAEqf5VYAAExj1eOQAQ\/oAAAAAAAAAUuwoXMyj2JAAQ\/oAAAAAAAAAND9alvNJ9SwAQ\/oAAAAAAAAClDBBzRudaAAAQ\/oAAAAAAAAChc6eH9dJVYAAAAAADABJNSVQtTUFHSUMtQ09PS0lFLTEAE1hETS1BVVRIT1JJWkFUSU9OLTEACVNVTi1ERVMtMQAA"} +00672{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6,"source":"xdmcp.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":6,"flow_first_seen":1538467333581,"flow_last_seen":1538467336601,"flow_idle_time":180000,"flow_min_l4_payload_len":7,"flow_max_l4_payload_len":189,"flow_tot_l4_payload_len":335,"flow_avg_l4_payload_len":55,"midstream":0,"thread_ts_msec":1538467336601,"l3_proto":"ip4","src_ip":"10.1.2.2","dst_ip":"10.1.2.4","src_port":61426,"dst_port":177,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"4":"DPI"},"proto":"XDMCP","breed":"Acceptable","category":"RemoteAccess"}} +00546{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":6,"source":"xdmcp.pcap","alias":"nDPId-test","packets-captured":6,"packets-processed":6,"total-skipped-flows":0,"total-l4-data-len":335,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1538467336601} +~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ +~~ packets captured/processed: 6/6 +~~ skipped flows.............: 0 +~~ total layer4 data length..: 335 bytes +~~ total detected protocols..: 1 +~~ total active/idle flows...: 1/1 +~~ total timeout flows.......: 0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ total memory allocated....: 5178591 bytes +~~ total memory freed........: 5178591 bytes +~~ total allocations/frees...: 113031/113031 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~ json string min len.......: 460 chars +~~ json string max len.......: 694 chars +~~ json string avg len.......: 570 chars diff --git a/test/results/youtube_quic.pcap.out b/test/results/youtube_quic.pcap.out index b05c15451..e753b1da1 100644 --- a/test/results/youtube_quic.pcap.out +++ b/test/results/youtube_quic.pcap.out @@ -27,9 +27,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4689779 bytes -~~ total memory freed........: 4689779 bytes -~~ total allocations/frees...: 101441/101441 +~~ total memory allocated....: 5188686 bytes +~~ total memory freed........: 5188686 bytes +~~ total allocations/frees...: 113323/113323 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 468 chars ~~ json string max len.......: 2273 chars diff --git a/test/results/youtubeupload.pcap.out b/test/results/youtubeupload.pcap.out index 0eb49490d..282bb1911 100644 --- a/test/results/youtubeupload.pcap.out +++ b/test/results/youtubeupload.pcap.out @@ -29,9 +29,9 @@ ~~ total active/idle flows...: 3/3 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4695635 bytes -~~ total memory freed........: 4695635 bytes -~~ total allocations/frees...: 101307/101307 +~~ total memory allocated....: 5194542 bytes +~~ total memory freed........: 5194542 bytes +~~ total allocations/frees...: 113189/113189 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 467 chars ~~ json string max len.......: 2279 chars diff --git a/test/results/z3950.pcapng.out b/test/results/z3950.pcapng.out index 09d05a6bf..cd74df623 100644 --- a/test/results/z3950.pcapng.out +++ b/test/results/z3950.pcapng.out @@ -22,9 +22,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4691738 bytes -~~ total memory freed........: 4691738 bytes -~~ total allocations/frees...: 101181/101181 +~~ total memory allocated....: 5190645 bytes +~~ total memory freed........: 5190645 bytes +~~ total allocations/frees...: 113063/113063 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 453 chars ~~ json string max len.......: 828 chars diff --git a/test/results/zabbix.pcap.out b/test/results/zabbix.pcap.out index 70e167466..0d7cdaaf5 100644 --- a/test/results/zabbix.pcap.out +++ b/test/results/zabbix.pcap.out @@ -15,9 +15,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4679800 bytes -~~ total memory freed........: 4679800 bytes -~~ total allocations/frees...: 101153/101153 +~~ total memory allocated....: 5178707 bytes +~~ total memory freed........: 5178707 bytes +~~ total allocations/frees...: 113035/113035 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 462 chars ~~ json string max len.......: 685 chars diff --git a/test/results/zattoo.pcap.out b/test/results/zattoo.pcap.out index 2df4dadba..d99f802c0 100644 --- a/test/results/zattoo.pcap.out +++ b/test/results/zattoo.pcap.out @@ -22,9 +22,9 @@ ~~ total active/idle flows...: 2/2 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4683669 bytes -~~ total memory freed........: 4683669 bytes -~~ total allocations/frees...: 101184/101184 +~~ total memory allocated....: 5182576 bytes +~~ total memory freed........: 5182576 bytes +~~ total allocations/frees...: 113066/113066 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 1369 chars diff --git a/test/results/zcash.pcap.out b/test/results/zcash.pcap.out index e46bbbd85..8262b45d9 100644 --- a/test/results/zcash.pcap.out +++ b/test/results/zcash.pcap.out @@ -16,9 +16,9 @@ ~~ total active/idle flows...: 1/1 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4693971 bytes -~~ total memory freed........: 4693971 bytes -~~ total allocations/frees...: 101291/101291 +~~ total memory allocated....: 5192878 bytes +~~ total memory freed........: 5192878 bytes +~~ total allocations/frees...: 113173/113173 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 930 chars diff --git a/test/results/zoom.pcap.out b/test/results/zoom.pcap.out index 4e9b25a2a..17f0579ff 100644 --- a/test/results/zoom.pcap.out +++ b/test/results/zoom.pcap.out @@ -217,9 +217,9 @@ ~~ total active/idle flows...: 33/33 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 4867403 bytes -~~ total memory freed........: 4867403 bytes -~~ total allocations/frees...: 102013/102013 +~~ total memory allocated....: 5366310 bytes +~~ total memory freed........: 5366310 bytes +~~ total allocations/frees...: 113895/113895 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 187 chars ~~ json string max len.......: 2328 chars diff --git a/test/results/zoom2.pcap.out b/test/results/zoom2.pcap.out index d4e04dfb8..cf7deb262 100644 --- a/test/results/zoom2.pcap.out +++ b/test/results/zoom2.pcap.out @@ -44,9 +44,9 @@ ~~ total active/idle flows...: 5/5 ~~ total timeout flows.......: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 5043516 bytes -~~ total memory freed........: 5043516 bytes -~~ total allocations/frees...: 113141/113141 +~~ total memory allocated....: 5542423 bytes +~~ total memory freed........: 5542423 bytes +~~ total allocations/frees...: 125023/125023 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 461 chars ~~ json string max len.......: 1367 chars |